Data recovery, whether for forensic or other purposes has been around since man was herding bits. It has just got harder and harder as time has gone on. There was a time when you could literally see the bits on a disk or a tape. If you have seen magnetic imaging film, that stuff laid over tape or a disk could image the individual bits. A disk drive was as large as a top loading washing machine, and held a disk pack with 11 platters, giving 21 surfaces (the bottom surface of the bottom platter was usually formatted for timing and servo control and didn't hold data.) Such a disk held maybe 300Mbyes. The disk drive had no smarts in at at all. It held the head amplifiers and servo system to position the heads. Actual operation of the dive was managed by the main computer processor (or in the case of really big machines, by dedicated IO processors that lived in separate cabinets.) The point is that given a disk pack, everything was on a very agricultural scale. The disk format was simple - there were a fixed number of sectors per track, and the format was as simple as one could wish for. A damaged disk could be cleaned and mounted and analysed. You could dump the bits, and reassemble the data. The file system format were simple.
As time progressed disks got smaller, but the technology got smarter. It used to be that the operating system managed bad blocks. So you could find the bad block mapping tables on the disk in a known place. The as disks got dedicated controllers that information disappeared into the controller. Same with information controlling operational parameters. There was a big change in the move to SCSI disks. Disks used to be managed by the OS, and the file system in the OS would know exactly where on the disk pack every file system block, as a triple: surface, track, sector. SCSI only let you have a block number. This freed the disk manufacturer allowing them to lay out the disk however they felt. From here on in, disks became a black box. There were jealously guarded proprietary algorithms for optimising disk operation, and these could include layout of data on the disk. So it was only possible to read data of the disk with the manufacturers own code. It was no longer possible to treat the platter as a big recording surface and read it with your won specialised equpiment. Worse, things could change between revisions, so it became impossible to even move a disk platter from one drive to another - you had to have the same software revision. Then as more operational data was held in the drive controller, it became necessary to move the eeprom from a failed drive to a new controller.
But nothing is impossible. Throw enough money at the problem and it is solvable. I once had a disk recovered in the 90's. Only the controller had failed, but it cost $8,000 (after discount) to get the data back. Speaking to the guy at the recovery company, he said that was a cheap and easy recovery. They had multi-hundred thousand dollar jobs. And jobs where an armed guard stood at the door 7x24 until the data was recovered. Fires were the hardest. But it was possible to recover submerged disks. What mattered was whether the disk was active or not when things went bad. A head crash was always bad. But even then, a lot of data could be recovered. Where things got grim was reconstructing the data from the fractured mess.
But, tl;dr - data recovery and forensic has simply gotten ever harder, from reasonably simple beginnings to one where heroic measures are needed if the problem is not fixable with a simple transplant.
The disk Dave did a teardown on was in the middle of development of disks. It had its own controller, but still delivered a platter, track, sector, interface to the computer OS. It would have been a trivial forensic subject. (I think it was a Fujitsu Eagle. I have one in my garage somewhere.)
Home
Help
Search
Login
Register
