Data Extractor PCI
Data Extractor is a specialized software product functioning in tandem with the PC-3000 hardware complex and intended for recovery of data from any media (IDE HDD, SCSI HDD, flash memory readers, etc).
What is Data Extractor PCI?
Data Extractor PCI is a new version of our recognized Data Extractor product. It works with our new PCI controller card PC-3000 PCI using all state-of-the-art solutions based on the research performed by our partnered company in the data recovery field.
Click on the thumbnail to see full sized picture.
Supported models
The complex is designed for work with HDDs (ATA, Serial ATA) connected to the ports of PCI controller card PC-3000 PCI and with all drives that can be normally connected to standard computer ports and identified by its operating system (except for CD and DVD drives).
The complex functionality is not restricted to a limited list of models.
At the same time, while working with HDDs connected to the ports of PCI controller card PC-3000 PCI, the product allows operations, which are nonstandard for the ATA (SATA) interface using peculiarities of specific drive families and models. E.g., for many drives it can create a map of sector distribution according to physical heads and use it for data recovery.
The complex can work together with the currently active utility of the PC-3000 complex for Windows and employ the latter to create a map of sector distribution among physical heads, to read data using methods that differ from the ATA standard (e.g., read data from a HDD using its physical parameters), etc. Taking into account that peculiarity we can say that Data Extractor supports individual features of drive families and models supported in the PC-3000 complex for Windows.
Basic principles of operation
Data Extractor PCI software is integrated into the environment of the PC-3000 complex for Windows.
Work with each individual drive is performed as a separate data recovery task, which should be created in task manager of Data Extractor PCI. Several tasks may be running simultaneously.
During task creation the user has to specify the target device and the actions, which must be performed to accomplish the task.
Users can enable the "Create data image" option to force creation of data copy (image) from the device being inspected; the said image will contain a sector-by-sector map of results. The data recovered with errors will be statistically processed, the program will add to the copy most reliable data only.
Users can employ the "Create virtual translator" option to gain access to modes, which allow recovery of data from HDDs with corrupted dynamic translator. That malfunction manifests itself in the form of skipped portions or shifted data.
Selection of a HDD connected to PC3000PCI board ports provides to users extended opportunities for drive control while working with it, which may prove valuable in case of malfunctioning HDDs:
- an opportunity to control power supply and switch it off in critical situations
- an opportunity to reinitialize a drive online in case of failures in its operation
- an opportunity to select a specific command for reading (with hardware retries, with software retries, without attempts to retry, etc.)
- an opportunity to use currently active utility of the PC-3000 complex for Windows for accessing data; such method allows factory mode (techno on, super on) access to data of a damaged drive.
The list of such opportunities is rather long.
Availability of convenient modes for viewing, analysis, search and editing of data from within the software considerably decreases the time required for data recovery.
Click on the thumbnail to see full sized picture.
Problems, which can be solved using Data Extractor PCI
The main purpose of the complex is data recovery from physically defective HDDs. Users have the following opportunities, which can be used to that end:
Data recovery from HDDs with multiple BAD sectors, which appear because of damaged surfaces or malfunction of the magnetic head assembly (MHA).
Data recovery from HDDs that start to produce "knocking" sounds, which may be caused by corruption of servo labels or a MHA malfunction.
In case of individual damaged heads or surfaces it is possible (before installation of a replacement MHA) to create a copy of data using the remaining good surfaces or drive heads.
Data recovery from HDDs with corrupted portions in the dynamic system of LBA - PCHS translation.
Data recovery using physical drive parameters (PCHS) from some HDD models unable to read data using logical addressing (LBA) - in case of joint operation with PC-3000 for Windows.
Availability of tools for logical analysis of FAT, NTFS and EXT2(3) file systems in the software complex allows data recovery in cases, when a drive is functional and only logical data structure is corrupted.
When used with malfunctioning drives, those tools often allow selective extraction of data necessary to your customers without reading of all data from a drive (without creation of a complete disk image) saving a lot of time. In some cases, when drive malfunctions cause constant self-damage (scratches on disks) these are the only means to accomplish the task altogether.
Click on the thumbnail to see full sized picture.
What are the basic differences of Data Extractor PCI compared with numerous data recovery programs of other companies?
There are some:
The main difference is determined by the notion very of hardware and software complex.
Work with malfunctioning HDDs through the ports of the PC3000PCI tester board and via the board driver allows operations even with drives causing computer or OS failures when connected to standard IDE ports. Besides, the complex allows lots of additional opportunities to control a malfunctioning drive and the process of data recovery.
Interaction and joint operation with PC-3000 for Windows allow data recovery from a HDD, which cannot be restored completely but may be temporarily made accessible so that Data Extractor PCI (alone or in combination with PC-3000 for Windows) could read data from it.
The complex may be able to assist in data recovery in such specific cases of physical damage as corruption of the PCHS-LBA dynamic translation system. Such malfunction makes a drive act as though it is seemingly functional and its data can be seen. However, an attempt to read anything would result in reading random garbage. That happens because such drives translate incorrectly OS requests to data LBA into its physical notation: Physical Zone Cylinder Head and Sector.
The system of logical analysis and restoration is a tool intended for qualified users. It features a reasonable combination of modes for completely automatic and manually controlled analysis and data recovery. Users can participate in the analysis process by modifying its parameters and conditions of its performance instead of just waiting for the results of the automatic procedure.
The Explorer mode allows users to understand data allocation, verify the validity of important structures, correct necessary data and quickly check the consequences of such corrections. Furthermore, if a copy of the data is created, all changes are made to that copy; so users do not have to worry about the original data while experimenting.
The opportunity of using logical restoration modes with a copy of original data is one more fundamental difference, which is especially valuable in situations, when a HDD has problems because of serious physical damage. In fact, while the said modes are employed, the software reads data from a malfunctioning drive just once, all subsequent attempts to access the data (when necessary) are redirected to the copy. In addition, the program reads just the data necessary for a specific action decreasing the overall load on a damaged drive and the time required for recovery. Sometimes that approach proves to be the only method, which helps recover data from a malfunctioning drive.
Click on the thumbnail to see full sized picture.
Can users add their own custom modes?
The software environment of the PC-3000 complex for Windows including Data Extractor PCI as its integral part allows creation and use of programs in Visual Basic, which can address all COM objects within the software complex as well as custom objects. The feature extends considerably the range of opportunities provided by the complex to qualified users.
Examples of application
A drive with lots of defective sectors (UNC, AMNF, IDNF errors), which however does not produce knocking sounds while working.
Identification of location and volume of required data (with customer participation) must be the first action, which should precede complete disk copying.
If a customer needs all drive data irrespectively of the degree of physical damage or cost then there would be sense in creating a full copy on another drive and only then proceed to the analysis of damage to the logical structure, if necessary.
If a specific partition has to be recovered, its position should be checked precisely using the Explorer mode (map of MBR or a respective partition). Even when MBR is corrupted and the location of necessary partition cannot be identified in it, you should try searching for boot records to obtain necessary information from them. However, one should avoid searching through the whole disk, one record would be enough to find information about partition size, then proceed searching for the next one; such procedure would save a lot of time (especially on a remarkably corrupted disks).
If a disk is really seriously damaged or if you suspect that it may stop working soon then you should define the most important data before making a full copy and use the Explorer mode to save that data first if the damage allows that. Then proceed to copying all the disk contents.
If the data volume is relatively small the Explorer mode will be preferable.
If you have decided to copy a clearly defined area, there would be more sense in doing so in two or more passes:
Quick pass without stops to retry reading of sectors copied with errors. The number of reading attempts should be minimal. You can use the "Skip sectors causing errors" option and specify jump size for reading of sectors that produce errors. That initial pass is intended for copying of the main easily accessible data portion from a drive, which may stop working. A variety of commands used for reading is available.
Refining pass with a higher number of reading retries on defective sectors (depending upon drive condition), the "Skip sectors causing errors" option is disabled, jump size in case of an error while reading is 1 sector. Please note that a serious increase of reading retries would be useful only for drives demonstrating unstable reading. It does not make sense when a drive reads invalid information from defective sectors. Sometimes it may be helpful to set the "Read, ignore CRC" option for time saving.
All subsequent passes might be useful for specific areas only (tables, files, folders...).
A drive that hangs at an attempt to read defective sectors.
Recommendations for work with such drives would be the same as in the previous situation.
One exception - you can use a script to define program actions while reading defective sectors. Script contents would depend on drive behaviour. As a rule, a software reset or a combination of software and hardware reset should be sufficient. Sometimes it may be necessary to switch off the power supply.
A drive producing knocking sounds at an attempt to read defective sectors (seriously damaged surfaces, scratches or reading head malfunction).
Recommendations are identical to the first case, but the script of program behaviour at readiness loss must include the "Power off the drive" action. Set the size of jumps to be used while reading defective sectors equal (or slightly larger) than the number of sectors per physical track of the drive. Possibly the value will have to be adjusted during the process of data recovery in the middle and in the end of disk surface. The option will allow reading all accessible data from the remaining undamaged surfaces before MHA replacement. If the required data can be found within that area, MHA replacement may even become unnecessary.
Imitation of readiness loss.
Sometimes a lot of time is wasted trying to read defective sectors. That may be unacceptable when such sectors are rather numerous. Besides, the damaged areas do not invariably match the necessary data.
Of course, you can set a jump size for reading sectors containing errors and "jump over" the corrupted areas, but the time necessary for a single attempt of reading a defective sector may be too long anyway. In that case you can simulate loss of readiness by the drive by setting the latency period so that normal sectors would be read without hassles but even a smallest slow-down would trigger loss of readiness and consequently a jump. The specified latency period can be set to 0.5-1 second. You should remove all unnecessary actions from the script to be used at readiness loss (especially commands to switch power off). A software reset would be generally sufficient.
As soon as the data accessible without problems are copied, disable the "Skip sectors with loss of readiness" option and return the latency interval to the initial value.
Then proceed as the situation may demand: use the Explorer mode to copy data or perform the second pass for recovery of more information from damaged areas.
A drive with MHA problems
The problem manifests itself as follows: long areas of successfully copied data (marked light green on the map) are regularly alternated with areas, which either cannot be read at all or can be read with errors.
For drives with such problems you will have to make a complete copy of a disk or a required partition. If you can create a heads map then perform the procedure and first copy the data from functional heads and only then proceed with reading information from the remaining ones (possibly, after MHA replacement).
If you cannot create a heads map (the algorithm does not work out), use jumps at HDD readiness loss (maybe you will not even have to simulate it, but the latency period can be reduced) or jumps at sector copying with errors to bypass zones corresponding to faulty heads. Select jump size so that it takes 1-2 jumps to cross a zone matching a faulty head.
As soon as a copy is created, proceed with the restoration of logical structure, but those operations should be performed on a virtual copy instead of the actual damaged drive.
An IBM HDD with numerous soft BAD sectors.
Soft BAD sectors are errors, which are not related to the defects of magnetic surfaces or heads. They appear as a result of software failure in drive operation, which may occur while recording. Consequently, CRC code written to parity field does not match the value calculated using the sector data producing thus a UNC error. Such malfunction is very frequent in IBM/HGST drives.
The situation has three typical peculiar indicators:
The time used for an attempt to read a defective sector is very large (about 8 seconds).
Those sectors usually occupy sequential areas consisting of several dozens in a row.
Usually there is no sense in multiple attempts of reading the defective sectors. They are always read with errors and their content is so damaged that statistical processing yields little results (still, an increased number of retries does make sense for areas of FAT tables and directories).
In such cases it is usually expedient to employ the above-described method of simulated readiness loss for creation of a full data copy. Then switch to the Explorer mode and use the "Read, ignore CRC" command, it will save you a lot of time.
A drive with damaged logical structure
Such situations may appear, when a drive is physically functional, but its data cannot be accessed because of corrupted logical data structure or when a drive was damaged and data image creation has been successful but the share of successfully copied sectors in the resulting image is less than 100%.
When you are creating a copy of a drive with physical malfunctions causing damage to logical structures, the use of the additional Explorer, GREP search, View and edit sector modes to speed up access to drive data would be really expedient.
E.g., if physical problems resulted in damage to MBR, the most efficient method would be its reconstruction (by filling in the partition information) to gain access to data quickly. The same holds true for boot sectors of partitions. When you are dealing with NTFS partitions and the situation is complicated by problems both with 4 initial records in MFT table and with MFT Mirror it may be helpful to use the partition map to assemble one full copy of 4 initial records from two original copies.
If you can scan the MFT table, do that. It is the fastest method to build a virtual file system (unless you can see it in Explorer at once) and gain access to necessary data. An MFT table may occupy up to 10% of partition size, so you will not have to copy everything (the task may be difficult or even impossible) to extract, e.g., 1 Gb of data.
As a rule, it is recommended to perform serious logical structure analysis after creation of data copy on a functional drive connected to a standard port (UDMA100 or faster). |
