Did Wendell complete recovering his NAND (FusionIO) drive..?

I looked for a thread already to see where Wendell’s at.
IF such a thread (Wendell’s status) … exists, please move this.

I assume Wendell’s already ‘carving’ (via headers & footers).
Using something like - R-Studio or UFS recovery.
I do, however, anticipate a problem:

  1. He’s not recovering music or video he could just download or rip again. Given what Wendell does, I’d guess he’s recovering either .txt (text files) or script ( .SH) files…

I know members here are a cut above other techie people and likely already know much of this … but, just to show a concern:

If it’s not immediately obvious, the point is that not all files have headers and footers. That which does look like it could’ve been a footer is a product of the last letters in those files are all ‘rs’ …

To find files which have no header and footer, you’ll need to search for a pair of terms within those files. Otherwise, automatic carving won’t find it. Which you can add / specify that info in the search settings.

The infinitely easier option is locating the $MFT equivalent of the FS.

PS, spinning drives have always had ECC also, in the Sectors

Summary

This text will be hidden

I know this forum is VERY knowledgeable, but, for others who’d like some info about recovery, I’ve included some principles and free means (and low cost approaches) for DIY Recovery I which someone had explained to me many years ago:

$MFT - NTFS uses a Master File Table (table of contents).
$MFTmirr - NTFS BACKUP of the primary $MFT backup

(something I wish other FS used) …

Ext2-4 - Linux: uses Inode tables
HFS+ - MacOS: uses nodes also and a “catalog” …

Windows Boot Flag: (found in HEX editors: 55 AA

As Wendell mentioned, SSD drives are exceptions bc of:
(Garbage collection, encrypted Firmware, TRIM), however:
Expensive tools (PC3000 SSD) put SSDs in ‘Technology Mode’

RECOVERING SPINNING DRIVES WHICH:

  • Spontaneously Lose Partition Info
  • Accidentally Formatted
  • Damaged Partition info

DON’T BENEFIT FROM SOFTWARE nor HARDWARE IMAGERS:

Imaging should ALWAYS be done by SATA, PCIe (NVMe) or Thunderbolt

LIST OF (Software + Hardware) IMAGING TOOLS

SOFTWARE Imager (list of the better ones)

  • DDRescue CLI (Free)
  • DDRescue GUI ($5 to DL, but still free on Hirens, etc)
  • HDD Super Rescue (Free)
  • HDD Super Rescue Pro (60-days) $20
  • HDD Super Rescue Pro (LifeTime) $200

HARDWARE Imager (some do Logical, but it’s often extra)

  • DeepSpar DDI 4* ($2,500+)
  • Atola DiskSense * ($6,500+)
  • Ace Labs PC3000* Express + Nand, RAID + DE: $16,000
    (I own the above so I know the pricing better)
  • SalvationData* (not sure)
  • DFL SATA Imager* (not sure)
    (most of the above have add-ons for USB3.0, NVMe, forensics, etc.)

BOTH HARDWARE AND SW IMAGERS ENABLE:

  • customization of sector timeouts
  • multi-pass (requires a log file, etc)
  • TONS more features

ALL SOFTWARE / HARDWARE “IMAGERS” ONLY WILL STILL REQUIRE
LOGICAL PROCESSING AFTERWARDS: R-Studio / UFS Explorer, etc.

Features EXCLUSIVE to HARDWARE Imagers:

  • Each [Imaging Port] uses a ‘micro’ OS to ISOLATE Recovery Ports.
  • INDEMNIFIES the UI from patient device instability / crash, etc.
  • PC3000 Express (4x simultaneous DR ports) and 5 OS, total.
  • Each DR port has Hardware WriteBlocker (enable / disable)
  • Control DRIVE Timeouts (not possible via consumer OS).

Pass 1

  • Test R/W Speeds at various sector regions PER HEAD.
  • DISABLE heads (selectively) to read weak heads last.
  • Can perform passes to read JUST the Catalog (mac), $MFT, etc.
  • If a “Table of Contents” (catalog / $mft) exists, recover selectively.
  • Set first-pass “read timeout” = 10ms
  • Mix multiple rules: If 10x sequential sectors exceed 10ms, skip 5,000

Going in depth here could turn in to 10 pages.
This info is onerous / extensive & but a sample.

BOTH Hardware and Software Imagers:

  • Control sector read time
  • Multi-Pass Recovery (sector to sector)
  • Many other features I wouldn’t know (I own multiple HW imagers)

IMAGING SOFTWARE DOES MANY THINGS HARDWARE IMAGERS DO:

  • DDRescue CLI (Free)
  • DDRescue GUI ($5? but is still free on Hirens, etc)

DDRescue’s limit: OS’ Timeouts due to native SATA drivers

HDD Super Rescue may be superior for this reason alone:

  • HDD Super Rescue (Free)
  • HDD Super Rescue Pro (60-days) $20
  • HDD Super Rescue Pro (LifeTime) $200

The above “SOFTWARE IMAGERS” (& many Hardware imagers)…
Still REQUIRE LOGICAL RECOVERY AFTER IMAGING IN MOST CASES

REQUIRES ONLY LOGICAL RECOVERY:

  • Accidentally Formatted SPINNING drives.
  • Damaged partition table (good heads).

In no way benefit from ‘Imagers’ (hardware or software).

SOFTWARE IMAGER WITH INTEGRATED LOGICAL RECOVERY

DM DE or DM Disk Editor

  • Multi-pass imaging
  • Fix DELETED PARTITION INFO!!! (perhaps THE best at this)
  • Logical Recovery (“carving” or searching for Headers + Footers)
  • RAID Recovery

Applications which EXCLUSIVELY perform LOGICAL Recovery:

  • R-Studio by RTT - (at R-TT.com = outstanding app)
  • UFS Explorer - (SysDev labs = outstanding app)
  • Recovery Explorer - (SysDev labs = outstanding app)

All of which are outstanding Logical (carving) tools with RAID recovery

None of which can make multiple passes …

The first group of pictures are from DeepSpar DDI 4

What stanning looks like as it’s running:

Options available in DeepSpar

DeepSpar options per Pass:

Standard Settings (not the rules based settings):

The ANATOMY of a SATA Hard Drive Sector:

Some Drives will read better in older modes, etc.

Automating power-handling during unattended recovery period …

Loss of Readiness HD options …

There’s a ton of info on this page, some of which just isn’t obvious, such as, the ability to test the heads, then, in these settings, deselect heads (requires another section of the application called the “Utility” already be running for that drive, and the drive is in the DataBase).

This isn’t even 2% of the options available in PC3000

2 Likes

Thank you for this fantastic introduction to this really specialized area of tech.

1 Like