shredding files on a flash drive

Kristian Erik Hermansen kristian.hermansen-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org
Fri Jan 25 20:19:06 UTC 2008


On Jan 25, 2008 11:50 AM, James Knott <james.knott-bJEeYj9oJeDQT0dZR+AlfA at public.gmane.org> wrote:
> They work with more than just deleted files.  They recover data from
> drives with severe hardware damage.  Sometimes, such as after a fire,
> the only recourse is to pull the platters out and mount them in a
> similar drive.  IIRC, this was mentioned by the presenter at the TLUG
> meeting a few years back.

What you are perhaps referring to is a spin-stand.  However, you
*cannot* separate the platters and recover the data.  The reason is
that the tracking/data are written to multiple platters, and if minute
misalignment occurs, you cannot determine what bit is what bit.  You
just have garbage bits.  You also need to know the coding the drive
uses.  This varies widely among manufacturers.  The most elegant hack
would be to somehow replace the parts that were damaged and somehow
keep the platters perfectly aligned when you swap them into a similar
drive.  Then, data recovery may perhaps be possible, but not if the
platters become misaligned (and still it is very difficult to perfect
-- yes it is possible).  I think it is wise that you invest in reading
the following two PDF documents this weekend from the site below.
Still note, misaligned platters spell doom!

http://www.actionfront.com/ts_whitepaper.aspx
http://www.actionfront.com/whitepaper/Drive-Independent%20Data%20Recovery%20Ver14Alrs.pdf
http://www.actionfront.com/whitepaper/Drive%20Independent%20Data%20Recovery%20TMRC2005%20Preprint.pdf

I encourage you to read the entire articles, but if you are not
inclined, here is a short summary.  This does not substitute for the
wealth of information contained in those two entire documents however!

""'
          4.1.4 Move the Disks to Another Drive
                        If the base casting is badly damaged, or the
spindle motor is burned out, or the
                        spindle bearings have seized, it is necessary
to remove the disks from the failed
                        drive. These disks must be re-mounted on the
spindle motor of a good drive.
                                                  This procedure
requires all the skill of head
                                                  replacement with the
additional skill of remounting
                                                  disks without
further damaging them.
                                                  It is very important
to preserve the spacing between the
                                                  disks and their
rotational alignment to each other. This
                                                  makes the
possibility of servoing on the remounted
                                                  disks much more
likely. Furthermore, if two highly
                                                  polished surfaces,
such as those on disks or heads,
                                                  touch they can
become bonded together. This is usually
                                                  called stiction. If
two disk surfaces become bonded in
                                                  this manner, it is
usually impossible to separate them
                                                  without causing
excessive, but microscopic, damage.
                        Once the good heads are loaded onto the
remounted disks, the power-on
                        procedure can begin.
     4.2 "Magic Machines" and "Proprietary Processes"
                        Reading some data recovery websites can lead
one to believe that they have
                        "Magic Machines" that routinely recover data
from failed drives. I saw no
                        evidence or independent verification that such
devices exist for commercially
                        viable data recovery. If they do have a magic
machine it may have been created
                        for a high-value job in the past, and probably
only worked marginally.
Drive-Independent Data Recovery       www.ChannelScience.com
                            Page 18
ChannelScience
                        It is very telling that the US Department of
Defense's Combating Terrorism
                        Technology Support Office recently placed a
"Broad Agency Announcement"
                        seeking just such a magic machine for damaged,
erased, or overwritten media
                        [8].
                        Any "Proprietary Processes" cited by data
recovery companies are likely to be
                        custom fixtures, such as combs, and handling
procedures for replacing failed
                        parts without causing additional damage.
Companies may also have written their
                        own proprietary software tools for
re-assembling recovered sectors into useful
                        files.
                        However, there are very special machines used
by drive manufacturers for the
                        design and analysis of drive components. It is
often suggested that these
                        precision instruments, spin-stand testers and
magnetic force microscopes
                        (MFMs), can be used for data recovery.
          4.2.1 Spin-Stand Testers
                        Hard disk drive manufacturers and their head,
media, preamplifier, and read
                        channel suppliers do have very accurate, very
expensive "magic machines,"
                        called spin-stands [9]. These are used for
testing and experimenting with heads
                        and disks. They are used mostly by research
and development departments and
                        by incoming inspection, production testing,
and quality control personnel.
                        Spin-stands are very accurate and flexible –
for analyzing raw disks. Virtually
                        any data pattern can be written and the
positioning accuracy and repeatability
    Spin-stand          are in the nanometer range. However, this
typically requires that the tester write
     testers are        its own servo pattern. Reading a disk that has
been written by a drive is more
accurate, flexible      problematic.
instruments that
                        First the disk and head must be aligned as
close to their relationship in the disk
   illustrate the
                        drive as possible. Then the electronics and
software must be programmed to
benefits of drive-      utilize the servo pattern written on the disk.
If the servo can be followed, the
independent test        parameters for the head and channel still need
to be optimized. Assuming that is
    equipment.          possible, the data written to the disk should
be readable.
                        However, unless the exact read channel and its
coding options are available for
                        the tester, all that will be delivered is
scrambled, RLL encoded, ECC code words
                        at best. These must still be decoded and then
assembled into useful files. Note
                        also that the head will be flying over the
disk surface, so the disk must not be
                        significantly damaged.
                        In reality, the scenario above is very
difficult to successfully implement even for
                        a drive manufacturer. It takes a great deal of
trial-and-error investigation by a
                        very knowledgeable operator. It would be much
more difficult for a data
                        recovery company to implement this technique
successfully across virtually all
                        manufacturer's drives cost-effectively.
                        However, the drive-independent nature of the
spin-stand is a very appealing and
                        necessary feature for a general data recovery
tool. What is needed is a device
                        that offers similar flexibility, can detect
and decode the user's data, is much less
                        costly, ideally works for every drive made,
and will continue to work (with
                        modifications) for future drives.
Drive-Independent Data Recovery         www.ChannelScience.com
                             Page 19
       ChannelScience
                   4.2.2 Magnetic Force Microscopes (MFM)
                                  The ultimate tool for analyzing the
magnetic data on disks is the MFM. It is
                                  related to the atomic force
microscope (AFM), except it responds to the
              Track Motion,
                                  magnetic force of the disk's data
and servo patterns [10]. Typically the
             Relative to Head
                                  instrument offers both AFM and MFM
capabilities. It provides phenomenal
      guardbands
                                  images of the topology and
magnetization of the disk.
                                  The figure to the left is an MFM
image of a portion of a track of data. The dark
                                  and light horizontal lines are the
individual transitions. Assuming the transitions
                                  are 1s, the spaces in between the
transitions are the 0s. The detail clearly reveals
                                  the guardbands between tracks and
even the curl at the edges of the written track
1/bpi
                                  due to the shape of the write field.
                                  The MFM probe must be very close to
the disk surface in order to get these
                  1/tpi           images. Therefore it cannot easily
follow a badly damaged (e.g., bent) disk. The
                                  biggest drawback, however, is its
speed. The MFM scans about a 100 micron by
                                  100 micron area at a time, then the
sample must be moved and the next area
                                  scanned.
                                  As a very rough approximation, if a
3 1/2" disk is to be imaged and the MFM
                                  can scan and move to the next area
in one minute (quite fast!). It would take
                                  about 60 weeks of 24 hour/day
operation to scan one surface. If the disk surface
                                  holds 50GB of data, for example, the
image files that would be generated from
                                  the MFM would be many times this
amount – perhaps generating tens of
                                  terabytes of image information to
analyze. For example, all of these individual
                                  images would need to be stitched
together into a complete disk image and a
                                  software image processing algorithm
would need to be used to 1) servo on each
                                  track and 2) generate the read gate
to indicate the beginning and ending of each
                                  sector. Finally a signal from the
center of the track image would need to be
                                  generated as a readback signal,
detected, decoded and assembled into useful
                                  files.
                                  The most intriguing possibility for
magnetic force microscopy as a data recovery
                                                          tool is
reading overwritten data [11]. As shown in the
              Track N              Track N+1              image to the
left, when a track is overwritten there is often
                                                          a portion of
the previously written data remaining. This is
                                                          due to small
variations in the servo's placement of the
                                                          write
element as well as the effects of spindle runout. It is

theoretically possible to take all the steps listed above but
                                                          generate the
readback signal from in between tracks rather
                                                          than from
track center. This procedure will have about the
                                                          same level
of difficulty, but the error rate of the readback
                                                          signal will
be much worse. Also the overwritten signal
                                                          will be
slowly fading in and out due to non-repeatable
                    Previously written
                                                          spindle
runout that occurs during writing. Such an effort
                 (partially overwritten)
                                                          could only
be afforded for a small amount of the most
                    data in guardband
                                                          important
data for national security.
                   4.2.3 The Spin-Stand MFM?
                                  To over come the time of image
acquisition with an MFM, it has been
                                  demonstrated [12] that magnetic
recording heads can be used on a spin-stand
                                  tester to create an image of the
magnetic pattern on the disk. That is, a flying
       Drive-Independent Data Recovery          www.ChannelScience.com
                                         Page 20
ChannelScience
                     GMR head is used in place of an MFM probe. This
has the advantage of being
                     able to image a disk in a few hours, depending on
the resolution desired.
                     However, it still leaves all the problems of
analyzing (quickly) the many
                     terabytes of image data generated. The images
must be arranged in the correct
                     spatial pattern and the tracks followed by some
image processing servo routine.
                     The readback signal from the track center (or
guardband) must be generated.
                     And finally the data must be detected, decoded,
and assembled into useful files.
                     An improvement on this system would be to servo
the imaging head during the
                     scan by using the magnetic patterns written on the disk.
          4.2.4 Exotic Recovery
                     Although such exotic methods of data recovery are
theoretically possible, and
 It is theoretically
                     have even been discussed in the peer-reviewed
literature [11, 12], I have found
 possible to read    no evidence of commercially viable recoveries
being performed with them.
some overwritten     Furthermore, I have seen no public demonstrations
of any of these methods that
        data.        show the recovery of files or even user data –
only images or raw encoded data.
5. The Frontiers of What's Possible: What Makes Data
Unrecoverable?
                     From the preceding descriptions of hard disk
drive technology it should be clear
                     that part-replacement for data recovery is
difficult now and likely to get more
                     difficult in the future. Part-replacement fails
for a variety of reasons, but most of
                     them reflect the hyper-tuning drives undergo to
achieve high manufacturing
                     yields combined with high data density.
                     The drives optimize the particular
head/media/electronics combination they have
                     as well as adapt to the precise physical
relationships between the positions of the
                     read element, write element, spindle center, and
head stack pivot point. Because
                     of hyper-tuning, the range of parameters over
which a drive can operate is very
                     small and likely to get even smaller.
Part-replacement, by its nature, succeeds
                     most often in drives that work over a wider range
of parameter values.
"""

The second PDF has a nice abstract, if you are lazy, so I will not
summarize here...
-- 
Kristian Erik Hermansen
"Know something about everything and everything about something."
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists





More information about the Legacy mailing list