WD20NMVW Data Recovery

An Advanced Data Recovery Case Study

Case: DC2xxx4 – Advanced Data Recovery

Drive: WD20NMVW-11EDZS6

Case Notes: A Western Digital (WD) hard drive with platter damage containing 7 years’ work. The customer had already sent this hard drive away to Fxxxxx who declared it unrecoverable. A colleague had read about Data Clinic’s Advanced Data Recovery Service on a forum and so recommended us. 

Lab Notes: Drive arrived opened and had clearly been worked upon, internal inspection revealed a serious head crash had occurred on platter surface 7. The case was placed on our ADR (Advanced Data Recovery) service from the outset due to the severe damage and the amount of work required to attempt a recovery. 

Drive was taken into our clean room and all 4 platters were extracted from the chassis and all were found to have debris deposits, this was the result of the head crash on platter 7 – debris was thrown around and settled on all platter surfaces and chassis parts. I also identified that platter 6 and platter 3 had visible scratches but I was happy these were small enough not to cause too much of an issue. I proceeded to painstakingly clean each individual platter surface to remove the surface lubricant and deposits caused by the initial head crash. Once all the platters were cleaned along with the internals of the chassis the platters were reintroduced back to the chassis and vertically aligned. 

Our parts department found an HSA (Head Stack Assembly) match, and these were tested for reading and writing ability before being extracted. In order to prevent any further head crashes on platter 7 I physically removed head number 7 from the HSA, not doing this would have simply caused debris from the severely damaged platter to be thrown around the inside of the drive once again and would have quickly contaminated the donor read/write heads. Once the head was removed under, our stereo microscope the now modified HSA was installed into the customers drive ready for testing on our PC3000 equipment. Before power was applied it was important that the printed circuit board was swapped from the native USB to a SATA equivalent, this was completed by swapping the adaptive ROM to a PCB model our engineers have deemed suitable. This process allowed our engineers to access the drives SA (Service Area) and perform specialist tasks to ensure the drive functioned correctly and to fix any potential firmware problems.

The customers drive was powered on and after a few unnatural noises became ready and ID’d perfectly fine. The drive was unfortunately SED (Self Encrypting Drive) locked too – something we see regularly with WD Elements external drives and as a result of substituting the original PCB. The SED lock prevents our recovery hardware equipment from communicating with the service area (SA), this was overcome by using a technique to trick the drive into a kernel mode (safe mode) and modifying the SA addresses of the hard drive. Once complete we were able to upload donor modules into the hard drives RAM and access the modules stored upon the physical platters. At this point our engineers were able apply a few in-house fixes, perform some tests and remove the SED lock. After undoing our SA address manipulations, we were able to access the drive correctly and test the firmware. 

Firmware testing went well but did identify that the firmware located on H0 was not in viable condition and so our engineers reprogrammed the drive’s SA address to only use the firmware located on H1, this resulted in a much more stable hard drive. At this point a clone was initiated to allow the transfer of successfully read sectors from the damaged customers drive to a fully working clone drive. As with many WD devices this drive was also encrypted and decrypted through the original PCB, this required our engineers to read some critical firmware modules to allow our equipment to decrypt this data on the fly. Once the task was created, we built a head map, this is a map of all the sectors on the drive and which head they were located upon, this is a very important step because we no longer had access to head 7 and we needed to stop the drive attempting to read any of the sectors located on this now defunct platter. 

The cloning process was started and whilst slow I was able to read in a good amount of the filesystem and begin cloning files. Understandably some heads were reading faster than other but a speed of between 5mbps and 80mbps was a great result. 

Conclusion:

We were able to recover a substantial amount of the customers data (55,287 files totalling 124GB) that another well-known data recovery company deemed not possible.