How to completely destroy the hard disk data: data recovery experts tell you

On December 2, a shooting at Lake Secom was reported, killing 14 people and injuring 22 others. The FBI carried out a search of the lake after it learned that the suspect’s discarded laptop in the lake might contain email and other evidence related to the case. Data forensics experts said that if the hard drive just soaked in water, data recovery is actually not difficult. In fact, there is a more efficient way to destroy a hard drive.

Destroy the hard disk
Destroy the hard disk

The data on the hard disk is stored in 0 and 1 on a platter made of aluminum block, ceramic or glass and looks like a CD. The center of the disk is a spindle that controls rotation. The head uses current to read and write data. The actuators and other electronics control the entire operation.

Water may short-circuit the electronics of the hard disk, but the data is not lost, whether the disk is wet or dry. Russell Chozick, vice president at Flashback Data, explains: “Forensic experts are able to recover data very easily as long as the disks do not dry out, as it leaves some hard-to-clean traces.”

Russell Chozick said modern SSDs and flash memories are actually more likely to “drown,” most of which come with on-board encryption, meaning that the drive’s circuit board must decode anything stored on the memory chips. However, SSDs currently account for only one-third of the PC hard drive market, so traditional rotary drives remain the areas of greatest concern.

So, what is more effective than water damage? Some professional IT people tell us that the magnets close to the hard disk may not be effective in destroying the data. Gleb Budman, chief executive and co-founder of Backblaze, a cloud-storage company, said: “The first thing to do is to fix the steel case in the hard drive and then place a strong magnet close to the disc so that it can effectively disrupt the data. It is the safest way to break the disc. ”

In fact, we can easily open a hard drive in a few minutes with a screwdriver and a hammer, and using brute force is the best way to destroy it in a short time. Russell Chozick said: “The laptop hard drive usually uses a glass disk, if you hit hard, the glass will be crushed, and no one can recover.” Of course, in some cases, to restore the glass disc The data is not impossible, but it is a lengthy process, and the cost of recovery is prohibitively expensive.

Desktop hard drives are mostly aluminum disk, we need to spend more effort to destroy the data. For example, a large scratch prevents the driver from being initialized and can hinder traditional data recovery efforts. Of course, the aluminum disc or large cracks on the same effect.

However, Gleb Budman said advanced labs are perfectly capable of reading data from less than complete disks, and they do not even need hard disk rotation, and experts can recover enough data in the disk to read 0s and 1s take.

In addition, the heat generated by drilling the disk can easily lead to large-scale destruction. This may distort the disc itself and result in subtle changes in all the discs. To completely invalidate the data in the hard disk, in fact, do not need to change too much, a little bit is enough.

If you think there are several ways above are not enough insurance, you can consider using acid to completely peel off all the information on the disc. Of course, we can also erase the data on the hard drive in a less aggressive way. For example, on Windows and Mac OS X, we have a similar erasing tool that can overwrite existing ones with random zeros and ones data. Gleb Budman suggested that the new hard drive need to be wiped twice, the best old hard drive to wipe seven times, otherwise, some advanced laboratories can still find “clues” in the covered data.

The principle and method of recovering data

The principle and method of recovering data
Found that the hard disk failure, the need to restore data, the first step is to do is to detect and determine the disk failure and data damage
Only to clear the extent of the damage and failure of the disk in order to take the correct steps to restore the data:

Hard drive internal failure, the form of performance is generally CMOS can not identify the hard disk, hard disk abnormal sound, then the possible causes of failure of the physical track damage, the internal circuit chip breakdown, head damage, etc., can be used to repair means: Clean room to open the disk repair, this situation can only be sent to the professional data recovery company.

Hard disk circuit failure, if the CMOS can not identify the hard disk, the hard disk no abnormal sound, then the possible causes of failure is the external circuit board damage, chip breakdown, voltage instability burned, etc., can take the means of external circuit repair, or replace the same Model of the hard disk of the circuit board, the general need to send a professional data recovery company.

Soft fault, if the CMOS can identify the hard disk, usually hard disk failure, the cause of the damage is generally caused by system errors caused by data loss, misclassification, accidentally deleted, mistaken cloning, software conflicts, virus damage, etc., can be used to restore data Software or manual mode.

The following specific explanation of the soft fault data recovery method
1. Confirm the cause of the data loss
1. The hard disk data is missing, the cause of the malfunction includes:

Virus can not read the data, hard disk zero track damage), the hard disk error partition, disk logic bad area, the disk is not bad, Hard disk there is a physical bad area.

2. Document data corruption, such as Office series data files damaged, Zip, MPEG, asf, RM and other file data is damaged.

2. According to the cause of the failure, the use of appropriate means and steps

1. Backup data, according to the importance of the data, decide whether the need to back up data, the general steps to backup data

1. Remove the damaged hard drive, received another intact machine, pay attention to the new machine has enough hard disk space backup

2. Use ghost’s raw mode (raw), a sector of a sector of the damaged disk backup to a mirror file. If the hard disk on the physical bad sectors, it is best to use ghost way to make a disk image, and then all the * are on the disk image, so that the maximum protection of the original disk can not be further damaged, you can maximize recovery data. – I guess the author is saying that the disk content to another disk to do the resumption of the work to avoid writing in the original disk.

3. Repair the hard disk data. There are two types of hard disk data repair, one directly in the original hard disk changes, one is to read out the data stored on the other hard disk. The basic idea is to maximize the information based on the disk to infer the loss of the partition and file system system information, the damaged files and systems to restore, so if the information is too much loss, it is impossible to restore the data. Such as the wrong to delete a file, then copy the larger file over, then most of the deleted files are overwritten by the new copy of the file, almost can not be restored.

One common sense is that if you want to restore the data, then do not run the problem disk on the scandisk or Norton Disk Doctor and other direct repair file system error software, remember.

Data Recovery Fundamentals: Introduction to hard disks, partitions, and file systems

Data Recovery Fundamentals: Introduction to hard disks, partitions, and file systems

Hard disk internal structure

On the hard disk structure of the article has been very much, but really want to say clearly, even if the book is also out of a book, so here is no longer elaborate from the beginning.
The most basic part of the hard disk is made of hard metal material coated with magnetic media discs, different capacity hard disk disc number. Each disc has two sides, can record information. The disc is divided into a number of sectors, each area is called a sector, each sector can store 128 × 2 N power (N = 0.1.2.3) byte information. In DOS, each sector is 128 × 2 of the second power = 512 bytes, the disc surface to the center of the disc as the center, different radius of the concentric circle called the track. Hard disk, different discs of the same radius of the composition of the cylinder is called the cylinder. Tracks and cylinders are circles with different radii. In many cases, tracks and cylinders can be used interchangeably. We know that each disk has two faces, each with a head, which is used to distinguish it from the head The Sector, track (or cylinder) and the number of heads constitute the basic parameters of the hard disk structure. In the old hard drive, are used in this relatively old CHS (Cylinder / Head / Sector) structure system. Because a long time ago, the capacity of the hard disk is still very small, people use a similar structure with the floppy disk to produce hard drives. That is, each track of the hard disk has the same number of sectors, resulting in the so-called 3D parameters (Disk Geometry), that is, the number of heads (Heads), the number of cylinders (Cylinders), the number of sectors (Sectors ) And the corresponding 3D addressing mode. For now the new hard drive, all have not used this structure, but the use of a more scientific structure, the current hard disk is a linear addressing that is directly used to access the hard disk sector, 137G the following hard disk 32-bit integer as the sector number, and 137G or more hard disk using 48-bit integer as the sector number.

CHS structural system

Which: the number of heads that the hard disk has a total of several heads, that is, there are several face discs, up to 255 (with 8 binary bit storage); cylinder number that the hard disk each side of the disc has several tracks, With 10 binary bits); the number of sectors indicates that there are several sectors on each track, with a maximum of 63 (stored with 6 binary bits); each sector is typically 512 bytes, and in theory you can Take any one you like the value, but it seems that has not yet found the value of the other. So the maximum capacity of the disk is:
255×1023×63×512/1048576=8024MB(1M=1048576Bytes)
Or hard drive manufacturers commonly used units:
Because the number of sectors per track is equal to the number of sectors per track in the CHS structure of the old hard drive, the recording density of the track is much lower than that of the internal track, so it will waste a lot of disk space (the same is the floppy disk). In order to further improve the hard disk capacity, and now hard drive manufacturers have to use equal density structure to produce hard drives. That is to say, the length of the tracks per sector is equal and the sectors of the outer ring tracks are larger than the inner track. With this structure, the hard disk no longer has the actual 3D parameters, addressing mode is also changed to linear addressing, that is, the sector as a unit for addressing. In order to be compatible with older software using 3D addressing (such as software that uses the BIOSInt13H interface), vendors typically install an address translator inside the hard disk controller, which is responsible for translating old 3D parameters into new linear parameters. This is why the 3D parameters of the hard disk can now have a variety of reasons for the selection (different working modes can correspond to different 3D parameters such as LBA, LARGE, NORMAL). With the increase in the density of the disk, the organization’s further complex, functional and speed improvement, and now the hard disk will be inside the disk to separate a larger capacity, known as the “system reserved area” area for storage hard disk All kinds of information, parameters and control procedures, and some even the hard disk Fireware also made the system to retain the area inside (the original information is stored in the hard disk control circuit board chip). Although this can further simplify the production process, speed up production and reduce production costs, but on the other hand, but greatly increased the chance of fatal damage to the hard disk and shorten the life of the hard disk.

U disk 7 maintenance tips and U disk data recovery methods

U disk is one of the most common storage data files mobile devices, compact and easy to carry, and storage capacity, we can put a lot of important information into the U disk, anytime, anywhere to bring, to bring our lives great The convenience. But when the U disk to bring us convenience, but also brought us a lot of trouble, such as U disk data for no reason lost, U disk accidental damage caused by data read and write does not come out and so on. Therefore, to master some U disk maintenance techniques and the use of methods is essential, this article will introduce you to the U disk seven maintenance methods, and U disk in the use of the process of attention.

u-disk-data-recovery1
u-disk-data-recovery1

A writing purpose
By writing an article, we can master some of the U disk maintenance skills, and the use of U disk have a more in-depth understanding, which can make better use of U disk to reduce the U disk data loss.

Two U disk some maintenance skills
1 Put the USB stick into the box and save
To U disk into the box, to prevent dust at the U disk interface, if there is no matching box, you can buy a U disk storage box. Because if you do not put the U disk into the box, U disk above will gradually accumulate a lot of dust, thus greatly reducing the sensitivity of U disk interface, affecting the data transmission effect.

u-disk-data-recovery
u-disk-data-recovery

2 Keep the USB disk clean
U disk in the use of the process, U disk cleaning is particularly important to maintain, if the U disk contact with the accumulation of a large number of dust and dirt, will seriously affect the data transmission results. What is more serious is that if the card reader or more sophisticated internal parts accumulate dust, it can cause a circuit failure. Therefore, in daily life, be sure to develop a habit of cleaning U disk regularly, when the U disk contact with dirt, with a soft cotton cloth or glasses cloth gently wipe, but do not use water directly wipe (U disk can not enter water).
3 Keep away from moisture
These days, Xiao Bian received a lot of users complained that the U disk file read and write does not come out, asked the reason, the original is due to accidentally put the U disk to the water. In this, Xiao Bian to remind everyone to see many of the U disk will be broken, so the U disk should be placed in a dry environment to prevent the U disk short circuit and rust damage. In daily life, do not put the U disk directly in the pocket, to prevent the sweat inside the body to wet the U disk.
4 to prevent the U disk broken, broken
Note that, even if the U disk is a metal shell, but can not beat, so the use of U disk in the process, do not heavy fall, to gently. Otherwise, once the U disk core damage, will result in data can not read the consequences. In addition, U disk compact, easy to carry, so in our daily lives, we can find most people will U disk and key linked to the key ring, in fact, it is easy to scratch U disk, so, most Good to U disk and key linked to the different key chain to carry.
5 Do not plug the USB stick into the computer for a long time
Not a long time will U-disk has been inserted in the USB interface, because if a long time to U disk inserted in the computer, especially inserted in the front panel of the host, it will easily lead to U disk interface, aging, greatly shorten the U disk usage time. Therefore, when not using U disk, U disk should be promptly safe exit.
6 to prevent the U disk is corroded
As we all know, metal is easily corroded, so the use of U disk in the process, be sure to avoid direct contact with the U disk containing chemical composition of the items, such as perfume, soapy water, etc., to avoid containing chemical composition on the U disk metal corrosion. In addition, do not expose the interface of the U disk to air for a long time, in order to avoid oxidation of the metal surface, reduce the interface sensitivity.
7 install U disk anti-virus monitoring software and firewall
In order to achieve real-time monitoring of U disk and improve the killing of the virus, you can install a number of specialized anti-virus software, regular U disk antivirus. In daily life, do not be lazy, we must develop regular U disk antivirus habits.

Three U disk when using the precautions
1 in the case of non-toxic use U disk
Now the virus is everywhere, so before using the U disk, be sure to make sure your computer is not a virus, once the U disk was a virus invasion, U disk will lead to a large number of data loss, and even make you Of the U disk scrapped.
2 Do not unplug the USB stick during data transfer
In the data transmission, U disk must not pull out directly, if you force exit, ranging from U disk will lead to data loss, serious, will lead to U-chip internal burn, then your U disk Also scrapped. In addition, when the system prompts that “can not exit”, do not directly pull out the U disk, U disk should be closed all open the file, then its safe exit.
3 After the data transfer is complete, immediately exit the USB flash drive safely
If the U disk has been inserted in the computer, even do not use U disk, U disk is also working state, the heat will be more and more, it will easily lead to U disk interface, aging, reduce U disk usage time. Therefore, when not using the U disk, U disk to pull out in a timely manner.
4 U disk should be safe to withdraw and then pull out
In the use of U disk transfer data, some people in order to save trouble, will directly pull out the U disk, does not know, this will make the U disk file is lost, but also reduce the U disk life. Therefore, the correct approach is the first U disk in the computer and then pull out the safe exit, to avoid data loss.

 

Hard disk firmware to repair the symptoms and causes

Firmware (Firmware) is simply the hard disk operating system, solidified in the hard disk outside the user data area (negative track). Firmware area stores the most basic parameters of the hard disk, providing the most low-level, the most direct hardware control. After the hard disk power, first by loading the firmware to complete the initialization of the hard drive, the system can correctly identify the hard disk, and other software to provide the most accurate basis for the operation. In the hard drive throughout the work process, the system needs to constantly read and write back firmware parameters, if this time outside the hard drive power failure or read and write errors, it may lead to damage to the firmware area.

Symptom:
1, the hard disk can not be properly identified
2, the hard disk can be identified, but can not read and write
3, the hard disk can be properly identified, but can not identify the model and capacity
4, the system tray, the system starts slowly or blue screen, suggesting that the hard disk error

cause of issue:
1, bad sectors destroy the firmware area
2, accidental power failure caused by the firmware area
3, the firmware area defects table Chaos lead to a large number of bad sectors