Editor’s note: As a forensic data recovery expert, SalvationDATA receives different data recovery cases every day. Our forensic customers usually turn to us for help when they run into a case they are not able to handle. And among all the data lost situations, platter scratch is one of the most difficult kinds of problem to deal with. So in this issue, let’s see what is the correct forensic process for a platter scratched hard drive.
What is platter scratch?
When platters are damaged it is usually in the form of scratching caused by debris and or the read/write heads when they come in contact during the reading-writing process.
This is also known commonly as a head crash, although that term is often mistakenly used by inexperienced individuals to relate to clicking drives or hard drives that need a read/write head replacement.
Once the platters are scratched to a certain degree this will, in turn, damaged the read/write heads and will render the drive unreadable. Oftentimes this results in a clicking, scratching, chirping, or screeching sounds. However, these sounds don’t automatically mean the platters are scratched.
When the platters are scratched in this manner the drive will not be able to be recovered, the files and data contained on the drive will be lost forever. This is known as a catastrophic head crash and most hard drive failure recovery cannot fix this.
How to work with a hard drive with platter scratch?
Is platter scratch truly unrecoverable? Actually sometimes if the scratches to the platter surface are not too severe, there is still the possibility to recover and extract the data as long as we strictly follow operating procedures.
What tools do you need for this process?
HPE Pro is a hard drive repair tool Head Platter Exchange it is the unarguable and the only equipment built to handle head stack and drive motor issues, in case the drive corruption is not caused by firmware but head stack or drive spin motor. With the pioneer platter exchanger, it can prevent the head from further damage or misalignment due to incorrect operations to maintain the user data intact.
DRS (Data Recovery System) is our next generation intelligent all-in-one forensic data recovery tool that can acquire and recover data from both good and damaged storage media like HDD simply and easily.
How do we know if the hard drive is fixed, and can continue to the next step? DRS’s disk diagnostics feature perfectly helps to solve the problem. DRS is able to scan the source disk in advance. With fairly new FastCheck technology, it allows rapid check within 5 seconds, avoiding the risk of second damage made to an important evidentiary storage device.
Insert the hard disk in DRS, and simply click the one-key Diagnose function to complete the process. DRS will tell you the detailed disk health status in no time!
After repairing the physical damages, the hard drive could still be fragile and easy to fail again. If not handled with care, we may permanently lose the opportunity to recover and extract the data. Therefore, it is crucial to first secure data stored on the hard drive. DRS also provides the solution. The forensic imaging function of DRS secures the evidentiary digital data by creating a physical level sector-by-sector duplication of the damaged hard drive. Once finished, a forensic image will be exactly the same as the source data and can be stored safely and analyzed at any time appropriate.
Now with all the problems dealt with, we have one final step to make: recover and extract valuable evidentiary data. Use DRS’s File Recovery & File Carving function to locate and extract important digital files, and generate a forensic report at the end of the process. With DRS’s intelligent recovery technology, investigators can deal with deleted files, formatted partitions, corrupted file system and many other digital data lost situations without any professional skill requirements!
Platter scratch is the nightmare for data recovery engineers. However, it is not impossible to recover data from scratched platters. In this issue, we discussed the standard operating procedure to deal with a hard drive with platter scratch to maximize the possibility to recover and extract valuable evidentiary data. We hope the instructions we provide can help you with your work!https://video.wordpress.com/embed/MiSnIzf7?hd=0&autoPlay=0&permalink=0&loop=0
You can also visit our official YouTube channel for more videos: https://www.youtube.com/user/SalvationDataOfficia/featured
The latest update of VIP 2.0 (Video Investigation Portable) is released now!
V126.96.36.1993 Version upgrade instructions:
1.Added Walsh, Ezviz, xinhanshi, keshian and huiershi file system
2. Optimized NVR analysis of glass particle, Zhiteng and Yushi technology
3. Optimized the saving method of video files, and store the saved video files and corresponding verification files respectively
4. Optimized the filtering of video retrieval objects and cancel the upper limit of displaying up to 99 retrieval results
5. Optimized the scan result list and support inverse selection
6. Optimized disk imaging
7. Optimized batch transcoding tools and increase the upper limit of simultaneous transcoding
8. Supported closing the video service after closing the program
9. Supported the selection of mapped network disk path
10. Optimized search tools
11. Compatible with 2k and 4K resolution display
The latest update of SPF Pro (SmartPhone Forensic System) is released now!
V6.115.2 Version upgrade instructions:
1. Added OPPO dual APPs data extraction, allow manually setup WIFI
2. Optimized the scheme of copying media files for Android phones to improve the process speed of forensics
3. Added the maintenance entry of “material information” during the process of extraction
4. Optimized automatic extraction of Huawei mobile phone, supporting backup parsing to the latest version (188.8.131.520)
5. Supported HarmonyOS data backup and parsing
6. Updated some plug-ins
Android: UC Browser, Quark; iOS: AKeyChat, Quark
7. Added APPs search
8. Added plug-in online upgrade function
9. Bug fixed
Recently, Huawei announced that they plan to officially launch the long-awaited Harmony OS on June 2nd, by holding a product launch event.
Before then, the operating system, which has only been used in products such as smart screens and wearable devices.
Soon after the event, it’s expected to be used in more product categories including cellphones.
Besides, they also released a video of the startup of the Harmony mobile OS on Weibo on May 27th.
Due to chasing the most cutting-edge tech on mobile forensics, we made every efforts to obtain the qualification of the internal test long before so that we made great progress in advance for the upgrade of SPF Pro.
SalvationDATA began to pay close attention to HarmonyOS at the very beginning of its emergence. Until now, we have obtained a preliminary technical breakthrough and we’re proud to say we’re capable of data extraction from devices that run HarmonyOS!
After integrating the technology into Smartphone Forensics System（SPF Pro), it’ll officially meet with you guys in the next updated version (the new version is expected to be released on June 5th).
SPF Pro is able to support the extraction and forensics investigation of normal data and deleted data of mobile phones equipped with HarmonyOS, including data of mobile phones themselves and data of third-party applications.
The existing commonly used third-party applications are also supported, including but not limited to: QQ, WeChat, Yidui, Momo, Sina Weibo, QQ mailbox, Lianxin, Tantan, WhatsApp, Snapchat, and other mainstream apps.
Customers who want to be the first to experience HarmonyOS smartphone forensics could download the next version of SPF Pro from our official website after the release on June 5.
The latest update of DBF 6300 (Database Forensic Analysis System) is released now!
V6.113 Version upgrade instructions:
1. Added online database for Oracle, PostgreSQL, support data parsing, analyzing and exporting
2. Added file mode for CSV parsing, support CSV document parsing, analyzing, and exporting
3. New online database collection tool, support MySQL, SQL Server, Oracle, PostgreSQL database online collection
4. Rebuilt hierarchical analysis, added relationship chain marking, filtering deleted data, and improve the processing capacity of million-level hierarchical analysis
5. Added functions of identification and conversion of special data for data statistical analysis (PRC Resident ID card, currency rate, etc.) and real-time editing of map data
6. Added advanced query for filtering deleted data
7. Bug fixed
The latest update of SPF Pro (SmartPhone Forensic System Professional) is released now!
V6.113 Version upgrade instructions:
1. Optimized the automatic extraction of Huawei. Improved the backup speed, support to the latest HiSuite version backup analysis.
2. Optimized the OPPO automatic extraction and backup tool. Improved the backup speed, allow users to try to continue the backup in the event of a backup failure, and improved stability.
3. Optimized the automatic extraction of vivo. Solved the problem that some mobile phones cannot extract data from some third-party apps.
4. Added “default iTunes backup password” setting, no need to manually enter when extracting.
5. Added “Calculate MD5 value of file when extracting file” setting, support export to report.
6. Optimized the analysis of iOS WeChat. Added group nickname, group joining method, and WeChat favorites data analysis.
7. Upgraded the “photo/screenshot” function. Support to save screenshots and photos to a custom node, and synchronize to the extraction results.
8. Updated some plugins:
Android: Skype(Intl), Line, ArticleNews, KakaoTalk, NinthChat, OperaBrowser, OutlookMail, Snapchat, Whatsapp, XiaoMiBrowser
As an integrated digital forensics & forensic data recovery solution provider, would never stop satisfying clients by keeping updated its software. Here we are excited to announce that newest version of DRS (Data Recovery System) is releasing today!
Let’s have a look what new features have been added to this all-in-one forensic data recovery tool:
1. Physical diagnostics is now available for all drives attached to the DRS hardware unit and your PC. Quick Diagnostics, Scan Bad Sector and Sector View are all accessible for drives plugged to the hardware unit or not.
2. New file system support: CDFS, UDF, F2FS are now supported for analysis (CDFS & UDF not supported for Pattern Scan).
3. New image format support: VHD, VHDX.
4. New search options: folder name search and time search. Allow users to search for folders with certain keywords or specify a certain time period to narrow down their search.
5. New feature in Disk Imaging: large disk image to small disk.
6. New feature in Hash Calculator: Hash calculation for physical drives.
7. New feature in imaging report: authentication of forensic image.
8. Multiple bugs fixed.
Click HERE to learn more about DRS.