“Intensive Read” Force to Recover the Incomplete Data

Date:04-18-2016


 

 “Intensive Read” can be explained as forcing to read. In order to enhance the readability of HDD with bad sectors, the program improves the intensity of working heads with a group of special instructions. Normally, that method is used in the application of such important data recovery by force. But we do not suggest that method due to degradation caused potentially. Only for a few of important files( such as evidence in court, database files, etc. ), the data recovery can have a good result beyond the normal mostly. For example, in an important case of investigation, the image recovered cannot display normally as following, but the second is a good result processed by intensive read.

 

01.jpg

Pic. 1#, normal recovery method on the HDD with bad sectors


02.jpg 

Pic. 2#, intensive read on the HDD

 

Recurrence: tutorial on “Intensive Read” hand-by-hand

Next, we will take a Seagate HDD( Model NO. ST94011A, SN: 3KW1AA08 ) of laptop as an example of data recovery.

 

1.        Inspection of HDD external

Firstly, we need to check the appearance of HDD. The drive should be good in external without opening disk. PCB should have no damaged part like burned.

 

2.        Connection to the computer

The HDD should be connected to the computer by the read-only device. With COM connection, the program can read the parameters of the HDD. But we lost the control of mouse in the OS. All programs cannot response and stuck there. We cannot see the partitions of the host as following.


03.jpg 

Pic. 3#, OS stuck and mouse missing, partition cannot be seen

 

3.        Scanning for bad sectors

To check the condition of data damaged at sight, we use bad sector checker to scan the HDD. The result is as following. It seems not positive of the HDD healthy condition.


04.jpg 

Pic 4#, the diagnosis result of HDD ST94011A under pre-inspection platform

 

According to the result of scanning, the HDD has a quite bad condition of the HDD. Here are many blocks in red and green. Green block indicates low speed in reading. Red block indicates difficult to read. Black block indicates bad sectors there or an error. As so far, it is not possible to recover data from the drive directly. The OS will load the information of all devices once it started. When it found the drive, the OS will read all partition information of the drive. When bad sectors occurs, the OS will read the bad sectors periodically which may cause a system standby.

 

4.        Data Recovery

Connected with Data Compass( DC ), the upper level program show us partitions and files in them. We can check all files to recover as following.


05.jpg

Pic 5#, DC connection


06.jpg

Pic 6#, the upper level program display

 

5.        Partly Recovered Files( Image Broken )

When we look into files recovered, we can find that many files are damaged and images broken and we get same results after many times of recovery. Opening images by Winhex, there we can see a lot of invalid information as “4040” which stands for nothing from reading. That  is caused by bad sectors in the area of data storage possibly. We have make an attempt with other programs such as EasyRecovery, R-Studio, etc. We get the same result in the end.


07.jpg

Pic 7#, Images Recovered are Incomplete


08.jpg

Pic 8#, “4040” error in Winhex

 

6.        Intensive Read

On the Shadow Control panel of DC, we initial and open the shadow disk and set the parameters correctly. Then we check the box of Intensive Read as following.


09.jpg

Pic 9#, Intensive Read

 

7.        Recovered File Successfully( Images Viewable )

Open the upper level program of DC, we use the former method to read “R0014628.jpg”. In the process of recovery, we can hear a different sound with normal recovery before. After a while, the process completed and the image is able to be viewed.


10.jpg

Pic 10#. Image Recovered by Intensive Read Function