shredding files on a flash drive
Kristian Erik Hermansen
kristian.hermansen-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org
Fri Jan 25 20:19:06 UTC 2008
On Jan 25, 2008 11:50 AM, James Knott <james.knott-bJEeYj9oJeDQT0dZR+AlfA at public.gmane.org> wrote:
> They work with more than just deleted files. They recover data from
> drives with severe hardware damage. Sometimes, such as after a fire,
> the only recourse is to pull the platters out and mount them in a
> similar drive. IIRC, this was mentioned by the presenter at the TLUG
> meeting a few years back.
What you are perhaps referring to is a spin-stand. However, you
*cannot* separate the platters and recover the data. The reason is
that the tracking/data are written to multiple platters, and if minute
misalignment occurs, you cannot determine what bit is what bit. You
just have garbage bits. You also need to know the coding the drive
uses. This varies widely among manufacturers. The most elegant hack
would be to somehow replace the parts that were damaged and somehow
keep the platters perfectly aligned when you swap them into a similar
drive. Then, data recovery may perhaps be possible, but not if the
platters become misaligned (and still it is very difficult to perfect
-- yes it is possible). I think it is wise that you invest in reading
the following two PDF documents this weekend from the site below.
Still note, misaligned platters spell doom!
http://www.actionfront.com/ts_whitepaper.aspx
http://www.actionfront.com/whitepaper/Drive-Independent%20Data%20Recovery%20Ver14Alrs.pdf
http://www.actionfront.com/whitepaper/Drive%20Independent%20Data%20Recovery%20TMRC2005%20Preprint.pdf
I encourage you to read the entire articles, but if you are not
inclined, here is a short summary. This does not substitute for the
wealth of information contained in those two entire documents however!
""'
4.1.4 Move the Disks to Another Drive
If the base casting is badly damaged, or the
spindle motor is burned out, or the
spindle bearings have seized, it is necessary
to remove the disks from the failed
drive. These disks must be re-mounted on the
spindle motor of a good drive.
This procedure
requires all the skill of head
replacement with the
additional skill of remounting
disks without
further damaging them.
It is very important
to preserve the spacing between the
disks and their
rotational alignment to each other. This
makes the
possibility of servoing on the remounted
disks much more
likely. Furthermore, if two highly
polished surfaces,
such as those on disks or heads,
touch they can
become bonded together. This is usually
called stiction. If
two disk surfaces become bonded in
this manner, it is
usually impossible to separate them
without causing
excessive, but microscopic, damage.
Once the good heads are loaded onto the
remounted disks, the power-on
procedure can begin.
4.2 "Magic Machines" and "Proprietary Processes"
Reading some data recovery websites can lead
one to believe that they have
"Magic Machines" that routinely recover data
from failed drives. I saw no
evidence or independent verification that such
devices exist for commercially
viable data recovery. If they do have a magic
machine it may have been created
for a high-value job in the past, and probably
only worked marginally.
Drive-Independent Data Recovery www.ChannelScience.com
Page 18
ChannelScience
It is very telling that the US Department of
Defense's Combating Terrorism
Technology Support Office recently placed a
"Broad Agency Announcement"
seeking just such a magic machine for damaged,
erased, or overwritten media
[8].
Any "Proprietary Processes" cited by data
recovery companies are likely to be
custom fixtures, such as combs, and handling
procedures for replacing failed
parts without causing additional damage.
Companies may also have written their
own proprietary software tools for
re-assembling recovered sectors into useful
files.
However, there are very special machines used
by drive manufacturers for the
design and analysis of drive components. It is
often suggested that these
precision instruments, spin-stand testers and
magnetic force microscopes
(MFMs), can be used for data recovery.
4.2.1 Spin-Stand Testers
Hard disk drive manufacturers and their head,
media, preamplifier, and read
channel suppliers do have very accurate, very
expensive "magic machines,"
called spin-stands [9]. These are used for
testing and experimenting with heads
and disks. They are used mostly by research
and development departments and
by incoming inspection, production testing,
and quality control personnel.
Spin-stands are very accurate and flexible –
for analyzing raw disks. Virtually
any data pattern can be written and the
positioning accuracy and repeatability
Spin-stand are in the nanometer range. However, this
typically requires that the tester write
testers are its own servo pattern. Reading a disk that has
been written by a drive is more
accurate, flexible problematic.
instruments that
First the disk and head must be aligned as
close to their relationship in the disk
illustrate the
drive as possible. Then the electronics and
software must be programmed to
benefits of drive- utilize the servo pattern written on the disk.
If the servo can be followed, the
independent test parameters for the head and channel still need
to be optimized. Assuming that is
equipment. possible, the data written to the disk should
be readable.
However, unless the exact read channel and its
coding options are available for
the tester, all that will be delivered is
scrambled, RLL encoded, ECC code words
at best. These must still be decoded and then
assembled into useful files. Note
also that the head will be flying over the
disk surface, so the disk must not be
significantly damaged.
In reality, the scenario above is very
difficult to successfully implement even for
a drive manufacturer. It takes a great deal of
trial-and-error investigation by a
very knowledgeable operator. It would be much
more difficult for a data
recovery company to implement this technique
successfully across virtually all
manufacturer's drives cost-effectively.
However, the drive-independent nature of the
spin-stand is a very appealing and
necessary feature for a general data recovery
tool. What is needed is a device
that offers similar flexibility, can detect
and decode the user's data, is much less
costly, ideally works for every drive made,
and will continue to work (with
modifications) for future drives.
Drive-Independent Data Recovery www.ChannelScience.com
Page 19
ChannelScience
4.2.2 Magnetic Force Microscopes (MFM)
The ultimate tool for analyzing the
magnetic data on disks is the MFM. It is
related to the atomic force
microscope (AFM), except it responds to the
Track Motion,
magnetic force of the disk's data
and servo patterns [10]. Typically the
Relative to Head
instrument offers both AFM and MFM
capabilities. It provides phenomenal
guardbands
images of the topology and
magnetization of the disk.
The figure to the left is an MFM
image of a portion of a track of data. The dark
and light horizontal lines are the
individual transitions. Assuming the transitions
are 1s, the spaces in between the
transitions are the 0s. The detail clearly reveals
the guardbands between tracks and
even the curl at the edges of the written track
1/bpi
due to the shape of the write field.
The MFM probe must be very close to
the disk surface in order to get these
1/tpi images. Therefore it cannot easily
follow a badly damaged (e.g., bent) disk. The
biggest drawback, however, is its
speed. The MFM scans about a 100 micron by
100 micron area at a time, then the
sample must be moved and the next area
scanned.
As a very rough approximation, if a
3 1/2" disk is to be imaged and the MFM
can scan and move to the next area
in one minute (quite fast!). It would take
about 60 weeks of 24 hour/day
operation to scan one surface. If the disk surface
holds 50GB of data, for example, the
image files that would be generated from
the MFM would be many times this
amount – perhaps generating tens of
terabytes of image information to
analyze. For example, all of these individual
images would need to be stitched
together into a complete disk image and a
software image processing algorithm
would need to be used to 1) servo on each
track and 2) generate the read gate
to indicate the beginning and ending of each
sector. Finally a signal from the
center of the track image would need to be
generated as a readback signal,
detected, decoded and assembled into useful
files.
The most intriguing possibility for
magnetic force microscopy as a data recovery
tool is
reading overwritten data [11]. As shown in the
Track N Track N+1 image to the
left, when a track is overwritten there is often
a portion of
the previously written data remaining. This is
due to small
variations in the servo's placement of the
write
element as well as the effects of spindle runout. It is
theoretically possible to take all the steps listed above but
generate the
readback signal from in between tracks rather
than from
track center. This procedure will have about the
same level
of difficulty, but the error rate of the readback
signal will
be much worse. Also the overwritten signal
will be
slowly fading in and out due to non-repeatable
Previously written
spindle
runout that occurs during writing. Such an effort
(partially overwritten)
could only
be afforded for a small amount of the most
data in guardband
important
data for national security.
4.2.3 The Spin-Stand MFM?
To over come the time of image
acquisition with an MFM, it has been
demonstrated [12] that magnetic
recording heads can be used on a spin-stand
tester to create an image of the
magnetic pattern on the disk. That is, a flying
Drive-Independent Data Recovery www.ChannelScience.com
Page 20
ChannelScience
GMR head is used in place of an MFM probe. This
has the advantage of being
able to image a disk in a few hours, depending on
the resolution desired.
However, it still leaves all the problems of
analyzing (quickly) the many
terabytes of image data generated. The images
must be arranged in the correct
spatial pattern and the tracks followed by some
image processing servo routine.
The readback signal from the track center (or
guardband) must be generated.
And finally the data must be detected, decoded,
and assembled into useful files.
An improvement on this system would be to servo
the imaging head during the
scan by using the magnetic patterns written on the disk.
4.2.4 Exotic Recovery
Although such exotic methods of data recovery are
theoretically possible, and
It is theoretically
have even been discussed in the peer-reviewed
literature [11, 12], I have found
possible to read no evidence of commercially viable recoveries
being performed with them.
some overwritten Furthermore, I have seen no public demonstrations
of any of these methods that
data. show the recovery of files or even user data –
only images or raw encoded data.
5. The Frontiers of What's Possible: What Makes Data
Unrecoverable?
From the preceding descriptions of hard disk
drive technology it should be clear
that part-replacement for data recovery is
difficult now and likely to get more
difficult in the future. Part-replacement fails
for a variety of reasons, but most of
them reflect the hyper-tuning drives undergo to
achieve high manufacturing
yields combined with high data density.
The drives optimize the particular
head/media/electronics combination they have
as well as adapt to the precise physical
relationships between the positions of the
read element, write element, spindle center, and
head stack pivot point. Because
of hyper-tuning, the range of parameters over
which a drive can operate is very
small and likely to get even smaller.
Part-replacement, by its nature, succeeds
most often in drives that work over a wider range
of parameter values.
"""
The second PDF has a nice abstract, if you are lazy, so I will not
summarize here...
--
Kristian Erik Hermansen
"Know something about everything and everything about something."
--
The Toronto Linux Users Group. Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists
More information about the Legacy
mailing list