Undiscovered Crime of Flipped Platters

On a daily basis, we recover data from hard drives that have been damaged by poor handling, whether accidentally or intentionally. Those are the circumstances that sometimes completely prevent professional data recovery. This time, we’ve decided to disclose one such case.

If the owner left fingerprints or signs of a screwdriver use on any of the hdd platters, it represents a technical but not an ethical problem. The situation gets worse if such errors were caused by an expert. This leads to an increase in the number of data recovery jobs requiring detailed analysis and long-term “special” methods for data recovery. However, despite the effort, it is usually impossible to achieve positive results due to data carrier damage.

The latest in a series of suspicious cases is a hard disk that was in a “professional” data recovery service before our company, which, like the client, is based outside of Serbia. The client sent us the device for standard recovery, unaware of the bad situation in which his device was after the previous failed data recovery attempt. The device in question is WD10TMVW – 11ZSMS5, from Western Digital, from the “Helios” family, in which three platters contain six data storage surfaces and the same number of read/write heads. Upon starting the standard procedure, this patient hard disk showed unusual symptoms.

The Mystery of Flipped Platters

During the initial review, the disk surfaces did not show significant damage, and the device heads did not signal irregularities. However, access to the Service Area (SA) on the disk was not possible. After a deeper analysis, we assumed that the platters on which the firmware is located had been previously manipulated. Our assumption was that someone, maybe clumsily, had flipped that platters. It turned out to be correct, revealing the “crime” of disrespect towards the client and his data.

When we accessed the firmware and data from one platters, the other platters were still inaccessible. We then switched to analyzing the other surfaces. By visual inspection, we found minor damage and scratches on two surfaces, while one of the surfaces had a noticeable circular scratch. Analyzing this situation, our engineers assumed that the previous service worker had flipped the most damaged platters. His intention was to hide the damage on the upper surface, replacing it with another platters which was “visibly” in better condition.

Our assumption again proved to be correct and soon we had access to all the data. Procedurally, the data was first read without access to damaged surfaces, and after a “special treatment” of damaged surfaces, we started reading from them as well. Through effort and dedication, and using a “special method” – our engineers saved 164 GB of valuable data for the client. 1866 out of a total of 20459 files were damaged by bad sectors, which we determined using a beta version of our new software for checking the integrity of saved data.

Any intervention on a hard drive, especially on its mechanical parts, requires specialized knowledge and tools. Data manipulation is not a game and an amateur approach to recovery often leads to further damage and can irreversibly destroy data. Such attempts not only fail to produce results but create bigger problems, increasing the time and costs required for data recovery.

Therefore, we urge our colleagues in the data recovery field, if they find themselves unable to resolve an issue, to avoid hiding their mistakes. That only deepens the problem and makes data recovery impossible. Or maybe not…”

Written by:

Aleksandar Dunjić

HelpDisc d.o.o

Do you need
data recovery?

Many years of experience in the field of data recovery and more than 11,000 satisfied clients guarantee the quality of our services. HelpDisc data engineers use modern software and tools that we have developed ourselves within the HDDSurgery brand. If you have a problem with lost data, write to us or fill out online request.

+381 (0)11 361 43 43

+381 (0)65 361 43 43