Imagе damaged drives

Imaging preset for bad drives

Depending on their condition, drives require different approaches to image them. With good drives, the priority is reading and writing speed, and the acquisition process can be linear and fast. With bad drives, you need to prevent further damage and retrieve as much data as possible.

TaskForce has the Default preset for health drives and the Damaged preset for faulty drives. The preset for damaged drives is designed based on our decades-long experience in data recovery and utilizes our proprietary multipass imaging algorithm.

The Damaged preset for imaging faulty drives.

Multipass imaging algorithm with different parameters on each pass

To balance out thorough data extraction with careful treatment of damaged media, TaskForce has a multipass imaging functionality. It allows approaching bad areas in the most delicate way retrieving as much data as possible and helps achieve maximum imaging speeds in the good areas of the drive.

The multipass algorithm uses large blocks with short timeouts on the first few passes and schedules the reading of slow areas for later. On the last pass, when fewer sectors are left to be read, it uses the smallest block size to maximize the amount of acquired data.

The imaging preset for damaged drives utilized the multipass imaging engine to thoroughly retrieve maximum data from an unstable drive in a forensically sound way with minimal downtime. It has several major differences from default imaging settings:

• 5 passes instead of 1 for good drives.
• Different timeouts for each pass: 1 second on the first pass, 5 seconds on the second, third, and fourth passes, and 60 seconds on the last fifth pass.
• Jump on errors: from 1,000,000 sectors on the first pass to only 1 sector jump on the last pass.
• Read block sizes: 4,096 on the first, second, and third passes, 256 for the fourth and fifth passes.
• Segmented hashing with 4 GB segments instead of linear hashing is used by default for good drives.

Imaging in reverse direction

To acquire more data from a bad drive avoiding a damaged area, TaskForce can approach skipped areas of the drive from the other side on any selected pass.

When enabled in the imaging settings, this function maximizes reading from good sectors and reschedules imaging of problematic sectors for the following passes.

Max read block size adjustment

TaskForce lets you adjust the max read block size and timeout for each imaging pass. It might be useful for the toughest cases.

Although, for bad drives, we recommend using settings of the passes, predefined by the Damaged preset, unless a particular drive requires specific imaging parameters. The parameters of this preset are fine-tuned to fit a majority of problematic media and optimized based on our vast experience in the field of data recovery.

Short circuit protection

TaskForce has built-in short circuit protection and can detect shorted hard drives. It prevents damage to both the system and the connected drives. When you connect a shorted drive to TaskForce, the system displays a short circuit alert to notify you about the detected issue.

To know how to correctly image a shorted drive, see Imaging a shorted hard drive.

Automated handling of freezing drive

A bad drive may spend a long time trying to read data from the damaged areas, again and again. After a certain number of tries it gives up on a particular sector and returns an error.

To stop this from happening and avoid making the damage worse, TaskForce tells the drive to stop trying after a set amount of time. The system then moves on to the next area of the drive to retrieve data from there instead.

If the drive continues to try and read for too long even after being told to stop twice, TaskForce forcibly powers the drive off for 5 seconds and then tries again. If this still doesn't work, TaskForce stops trying to retrieve data from the drive altogether to avoid a complete freeze or further damage.

Imaging data from good heads only

During the diagnostics, TaskForce analyzes each part of the drive's head stack to detect head damage. If any head is damaged or degraded, attempts to read sectors with it will slow down an imaging process and can cause further damage to the hard drive.

To avoid further damage to the healthy parts of the drive, TaskForce lets you disable damaged or degraded heads and select good heads only. This way, you can acquire data from the good heads first. After that, the system pauses the session and produces a detailed imaging report with a log of all actions performed during the imaging session.

After you successfully retrieved data from the good heads, you can either try to image data with the damaged head or replace the head stack and image the remaining data with the new heads.

Disabling the damaged head in the imaging settings.

Disable read look-ahead mode

Contemporary hard drives can read more blocks sequentially than requested by software thanks to read look-ahead functionality.

This feature helps good drives to operate faster by caching data.

However, with bad drives, read look-ahead may address bad areas more frequently, causing the process to slow down and possibly freezing the drive. In these cases, we recommend disabling the read look-ahead option.

Simultaneous hash calculation

To ensure that a bad drive stays in working condition for longer, it is critical to limit the number of times you read data from it.

When dealing with a damaged drive, we recommend calculating hashes simultaneously with imaging. This way, TaskForce only reads the data on the drive once and helps to avoid further damage to fragile media.

Segmented hashing

Segmented hashing is a hashing method that ensures that an image can be verified even if the data gets corrupted later in the case’s life cycle. It is also the only hashing method to verify the integrity of an image of a damaged drive.

This method supports multipass imaging and handling of bad sectors and provides better resiliency against data corruption. That’s why we strongly recommend enabling segmented hashing when working with damaged media.

Using the SMART table to track changes in a drive's condition

To get information about a drive’s health, you can use its SMART table. It contains various attributes, recorded during the drive's life cycle and may differ depending on the drive manufacturer. The most critical attributes are:

• Reallocated sectors count
• Current pending sector count
• Uncorrectable sector count

The higher the values in the SMART table, the gentler the approach is required for the drive.

To help you track critical changes in the drive's health, TaskForce compares the values in the SMART table before and after imaging and highlights any differences.

Automatically generated detailed report with unread sectors

After the acquisition process is finished, TaskForce automatically generates an imaging report. It contains the number of sectors scheduled for imaging and the number of actually imaged sectors, as well as the number of reading errors that occurred during the imaging process.

The report also includes a full log of system events for that imaging session, with the addresses of unread sectors and exact types of read errors (if any).