The dark art of resurrection: how to recover data from damaged media
( c )
Restoring data is not only returning a hard drive to life. In a broad sense, data can be presented on any medium, and die - in all possible ways.
Data recovery is a science. She has no names yet, but perhaps it can be called computer archeology, the subject of interest of which is the restoration by digital methods of any damaged or erased information.
For example, computer archaeologists can recover family photos from a damaged smartphone or data from a hard drive destroyed by a criminal in an attempt to get rid of evidence, as well as help recreate the details of the mechanism that was destroyed thousands of years ago.
Disk Vitality
( c )
On 1 February 2003, the Columbia shuttle collapsed upon entering the dense atmosphere due to damage to the wing by a piece of insulating foam. In the cargo bay, the ship carried a 340-megabyte hard disk on which information about the CVX-2 experiment (Critical Viscosity of Xenon) was recorded, during which the behavior of xenon under microgravity was studied.
The CVX-2 project lasted a total of 20 years, and the results of the final space experiment were of great scientific value. By a lucky coincidence, the hard drive was not destroyed in the crash - it fell into the lake, from where the search team extracted it. NASA sent the drive to Kroll Ontrack, which specializes in computer data recovery.
The disk suffered a lot: not only metal and plastic elements melted, but also a cover protecting it from dirt and dust. However, aluminum plates, where, in fact, information is stored, have not collapsed. They were cleaned with a chemical solution, and then placed in another hard disk - an exact copy of the damaged model. In just two days, 99% of the data was recovered .
Chemical reagents are very helpful when working with damaged media. Before you try to recover something, you need to get as close as possible to the source of information. Reagents are also used to recover physically erased information, for example, when it comes to working with serial numbers. Chemical etching is The most common and successful method of recovering serial numbers on a metal surface.
Cleaning and recovery
Sometimes for access to data it is enough to carefully cut off the damaged parts without resorting to reagents. It is interesting to consider the process on the example of machining a reflex camera burned out during a fire. She was sent to data recovery specialists.
A damaged family photo memory card was inside the camera.
Card slot completely burned out.
To carefully open the camera and get to the SD card, engineers used a special drill bit.
The damage from the fire was not limited to the camera body, the shell of the SD card also melted and merged with the chip.
The map had to be cut with surgical precision. Of course, it was impossible to insert it into another card reader. The engineers had to separate the memory chip from the plastic shell.
Only clearing access to the chip, managed to read the data. Source .
Fire or grinding media are not always sufficient conditions for the complete annihilation of information. A deformed hard disk may not work, but the data on it will still remain intact, although it will be very difficult to extract it.
Ideally, you still have a disk that can rotate. One of the data recovery methods is known as “disk replacement”, when a magnetic disk is removed from a damaged hard drive and placed in a hard disk case of the same model. In rare cases, having a specific HDD model with the correct firmware version is the only available way to recover data. For these purposes, for example, in the company Ontrack 150 thousand spare parts of “donor disks” are stored, the oldest of which is already more than 25 years old.
A guaranteed way to destroy information
Advanced laboratories can even work with damaged disks, independently scanning individual blocks of records. All parts of the disk gently glue and carefully align . Then comes the stage of visual removal of information or analysis of the residual magnetization of the tracks. This is a very hard work that requires a lot of financial and time costs. The whole question is motivation. If you really need to recover data, you probably can.
There are several ways to deform the data so that no laboratory gets it. Among them:
- complete mechanical destruction - the destruction of the disk to the smallest particles;
- the impact of a powerful magnetic field;
- acid.
The latter method is the most spectacular.
In this video, the hard drive is dissolved in hydrochloric and nitric acids. The acid dissolves the boards and enclosures, and the disk itself remains intact, but wipes a thin “film” of data from the surface.
Work with extensive damage
On December 14, 2012, Adam Lanza carried out a massacre at Sandy Hook Elementary School, killing 27 people. He committed suicide by not leaving a suicide note. Some information about the motive that pushed Adam to the slaughter probably could be on the computer that the 20-year-old reclusive used as one of the main ways of contacting the outside world.
Lanza tried to destroy the hard drive of the computer with a hammer and screwdriver - in the photo above you can assess the state of the disk. The FBI investigated the 500-gigabyte Seagate Barracuda for several months, but received no information.
Does this mean that the "paranoid mode" is turned on in vain? Some studies show that, if desired, even critically damaged data can be recovered. The FBI found in the house Lanzs many photos of dead bodies, videos of suicides. An extensive digital trail of the criminal was also studied, which led to forums discussing pedophilia. Psychologists were able to make a full and vivid portrait. Spending resources on extracting additional information no longer made sense.
Plate hard disk coated with magnetic suspension at a 30-fold increase
But imagine that the disk is top-secret information, access to which is a matter of life and death. It is known that having spread a colloidal suspension of Fe 2 O 3 particles on a hard disk surfaceIn the reflected light, we will see a magnetic contrast, with which you can assess the presence or absence of information.
Plot of a hard disk in the region of servos at 800-fold magnification
At 800-fold magnification using an optical microscope, separate servo marks clearly differ, the tracks with data recorded by a weaker field stand out somewhat worse.
Despite the damage to the fragments of the recording tracks, making it impossible to read with the help of the drive, the information was physically preserved, which makes it possible to restore it. On HDD disks, we can use the method of reading the residual magnetization.
Thus, the question of data recovery is the question of the availability of the necessary equipment (and a great desire). With a magnetic force microscope, you can examine the hard drive at the submicron level. Modern science knows examples of much more specific studies, including those using atomic force microscopy, which is used to determine the surface topography with a resolution from tens of angstroms down to atomic.
Challenges of maximum complexity
If you think that it is difficult to recover data from a damaged screwdriver, then how about reading information from a mechanism created before our era?
In 1901, from a ship sunk near the Greek island of Antikythera, a mechanical device of indeterminate purpose was lifted. Research that lasted 117 years showed that the Antikythera Mechanism was created between 100 and 205 years. BC. and was used for astronomical and astrological calculations. To recreate the complete model of the mechanism, of which only a quarter of the original details survived, several methods allowed.
Antikythera mechanism, radiographic research.
To restore the position of the gears inside the mineral-coated fragments, computed tomography was used, which created three-dimensional maps of hidden content using X-rays. It was possible to determine the relationship of individual components and calculate their functional affiliation. X-ray tomography with phase contrast is also used to read ancient manuscripts, determining the height of the text with a thickness of 100 microns relative to the paper.
The archaeologists were helped by the “instruction” - a description of various parts made on the surface of the mechanism itself. However, the overwhelming majority of the text was eliminated by erosion. Moreover, the text itself was made with symbols of a little more than 1 mm in size - scientists had previously encountered similar filigree only on coins.
Scientists were able to see and read about 3.4 thousand characters (500 words) with the help of the Bladerunner heavy-duty eight-ton tomograph from X-Tek Systems (now Nikon Metrology), which is used to detect microcracks in turbines. In two weeks, the scanner has created over 600 GB of X-ray image data of inscriptions, which have been hidden from view for more than 2 thousand years.
Fragment of the text after treatment with RTM.
For the study of texts on the internal and external surfaces of the mechanism used technology PTM ( Polynomial Texture Mapping, polynomial texture mapping), which helps archaeologists also read nearly erased cuneiform on Babylonian clay tablets. The essence of the technology is as follows: the object is photographed from different angles of incidence of light, and then the program recreates the most probable three-dimensional image of the surface on the basis of two-dimensional images. Even an inexpensive digital camera provides enough resolution to create good PTM images, while virtually any light source, such as a flash, can be used.
Images and sounds of the last century
Since the middle of the XIX century. many samples of audio recordings were created that today cannot be reproduced due to the lack of the necessary devices for this, or due to the fact that the recording media themselves - wax cylinders and plates - are in such a deplorable state that they cannot be used.
Optical scanners are used today to restore the oldest audio recordings. First, the disks are scanned in the optical range with a resolution of 10-100 nm to create a full-fledged three-dimensional model. Then, the resulting models of cylinders and plates are processed using algorithms that convert images into sound.
In this way, it was possible to restore the sounds, recorded on tin foil in the Edison laboratory in 1878, and also to process the data of the recording made in 1860 on smoked paper sheet.
( c )
Another important forgotten art of the past - the first photos. In an early photographic process based on the photosensitivity of silver iodide, we obtained not the usual photos, but daguerreotypes consisting of alloys formed by the interaction of silver and mercury, which were also used for the production of mirrors (therefore, daguerreotypes were called “memory mirrors”).
It should be noted that the reproductions of daguerreotypes give only a general idea of the image, without conveying its true look. The plate with the image needed to be moved in the hands in order to catch the dark surface, which, reflected in the mirror of the daguerreotype, would give the image.
Photos created in the middle of the XIX century. With the help of this technology, are no longer available to us due to tarnishing and other damage. However, scientists were able to restore the original images from the plates using a scanning X-ray fluorescence microscope, which determined the distribution of mercury on the plates.
With an x-ray beam of 10x10 microns in size (for comparison: the average thickness of a human hair is 75 microns) and with the energy most sensitive to mercury absorption, scanning of each daguerreotype took about eight hours. Analyzing the location of the particles of mercury, the researchers were able to obtain an image in excellent quality.
The faster the technology develops, the more difficult it is to use outdated devices and storage media. We still remember how to “rejuvenate” the magnetic film (it needs to be “ baked ”), but to work with older mechanisms you need to connect scientific institutions and launch multi-year research programs. With difficulty we managed to restore Charles Babbage’s car and return to operation the oldestacting computer. Sometime in many years, our descendants will try to read data from a CD using other technologies unknown to us.