Logical Hard Drive Failure Recovery
Not all data loss situations involve your hard drive physically failing. At Gillware, we often see perfectly healthy storage devices brought to us after a logical hard drive failure. In many cases, these drives may appear to have failed. They will spin up, and they won’t make horrible or unusual noises. But the user can’t boot up, and might be greeted by a black screen or blue screen. None of the startup repair techniques they’ve looked up online or system repair options they’ve tried have worked. Their local computer repair expert or IT department couldn’t pull the data off of them. And so the users brought their drives to us.
There are many different ways hard drives can sustain logical damage. Logical damage can be self-inflicted—the result of your hard drive inadvertently writing corrupted data to itself—or inflicted by the user, usually by accident. In these cases, the drive’s physical components are almost always totally healthy. The platters are unscratched. The motor spins fine. There aren’t any shorted-out spots on the controller board. The read/write heads work fine, but maybe they just had a little bit of a hiccup when your external hard drive was prematurely unplugged and wrote corrupted data.
Logical damage can also be the result of accidentally deleting your files or reformatting your drive, resetting your computer, or reinstalling your operating system. If any of these things have happened to you and you have lost critical data, contact our recovery client advisers without delay.
If the full version of the Logical Data Recovery video is too long for you, we have the different topics discussed in shorter videos below.
Logical Hard Drive Failure
Hard drives and other data storage devices need to be designed in a very specific way so that your computer can detect them. When you connect a hard drive via SATA or USB cable, or you plug your USB thumb drive into an open port, your computer looks for the device’s firmware first. When your computer can find it, that’s good. It will recognize that there actually is a device attached to it. The next thing your computer will look for is sector 0. At sector 0, your computer hopes to find a blueprint for the whole drive, known as a file system.
Sector 0 will tell the computer how many partitions are on the hard drive, and which sectors they start at. Sector 0 may say, for example, “I have a superblock at sector 2048.” The computer will look at that sector. It tells the computer that a NTFS partition starts there and spans the length of the entire drive. Or Sector 0 may say “I have a superblock at 63 and another at 404,640.” And the computer will check those sectors and find a small FAT32 partition at 63 and a larger HFS+ partition at 404,640.
These superblocks also point the computer toward the file definitions inside each partition. The file definitions tell the computer where all the files and folders live, how much space they take up and how to reach them. In a process that seems almost instantaneous, your computer has a complete picture of your device.
But if this picture is incomplete in any way, the whole process breaks down. This typically happens due to some sort of corruption of the partition table. As a result, the computer will see a “blank” drive and ask you for permission to format it. Computers are fast, but they’re not actually all that smart. They need a lot of hand-holding to find their way around a storage device.
Deleted Files, Reformatted Drives, Reinstalled OSes: Where Does Your Data Go?
Hard drives can also suffer logical damage when you delete files, reformat your hard drive, or factory reset your operating system. Unlike in cases of physical drive failure, you aren’t actually damaging the drive. What you are damaging is the data inside it.
When you delete data or reformat your hard drive, you are actually making a very small change (albeit with big consequences). That is why these processes can happen very quickly. Deleting a file doesn’t change every sector in it into zeroes. Instead, your hard drive goes to its bitmap file and looks up the clusters containing the file you want to delete. The bitmap keeps a record of all the clusters, with a flag marking the ones that are in use. The drive takes the deleted file’s clusters and marks them as unused. Voila—no more file! But it’s still there, if you know where to look and how to get there.
Reformatting your hard drive only changes the partition table and writes a new superblock, along with new file definitions and a new bitmap file. The new partition table points to the new superblock. And the new superblock points to the new file definitions and bitmap. Most, if not all of the old data will still be there. The new file definitions and new bitmap might overlap the old ones, but they are much smaller (since the new partition is empty).
Data recovery can be a little more difficult after a System Restore or O/S reinstall. When you delete files and reformat data, you’ve marked that data as available free space. And when you write more data to the drive, as is the case when you reinstall an operating system, you risk covering up the old data and destroying it—for good. In these cases, we can identify how much of the old data has been overwritten and corrupted, and how much is still viable.
How Gillware’s Logical Hard Drive Failure Recovery Tools Work
The same forensic imaging tool we use to create disk images of customer drives also helps us with logical analysis. HOMBRE is an intelligent, write-blocked imaging tool with extreme fault tolerance. With HOMBRE, we can control a hard drive’s performance in order to read it, even if no other computer can. And because HOMBRE is write-blocked, it is impossible for us to make any changes to the drive.
In logical hard drive failure cases, our engineers use HOMBRE to record every single sector on the hard drive. HOMBRE keeps a status map of how many sectors it has read and how many it hasn’t. Sometimes, if a drive is damaged or its platters are aging, it isn’t always possible to get a complete read. But we strive to get as close to 100% as possible. Hombre cross-references the status map with its relational database to help us figure out the drive’s partitioning geometry.
HOMBRE is a powerful logical data recovery tool when a hard drive has been reformatted. As long as the superblock (or the backup superblock) for the old partition still exists, HOMBRE can find it, even if the partition table no longer points toward it. From there, our engineers can figure out how much of the old file definitions still exist. When data has been deleted, our engineers can also search for old versions of the file definitions that can point to the deleted files. As a last resort, our engineers can use HOMBRE to scan the entire drive for common file headers. This technique can uncover thousands of different types of user-created files that no longer have any signs pointing to where they live.
Why Choose Gillware for Logical Hard Drive Failure Recovery?
At Gillware, our data recovery lab is staffed with world-class data recovery experts. The recovery tools like HOMBRE we use are some of the most powerful and robust logical data recovery tools in the industry. You can trust our experts to recover as much of your data as possible after your logical hard drive failure. Our logical hard drive failure recovery services are 100% secure and 100% financially risk-free. We even offer to cover the cost of inbound shipping. You only pay for our logical hard drive failure recovery efforts at the end, and only when we’ve recovered your critical data. To make absolutely sure your data is safe, we ship your data back to you on a new, password-protected hard drive. We delete your recovered data from our facility after you have received your new hard drive.
Want more information regarding logical data recovery? Click on the buttons below and check out some of our other pages related to logical data recovery: