Article report from the company R.LAB about testing "samurai"
Hello!
We decided to publish a report of R.LAB - one of the leading data recovery companies. They help us test our data destruction systems on new modern drives.
The video was filmed after the experiment, but still the hard disks were bouncing just as fun during the testing itself.
As experimental subjects, it was decided to use hard disks, the design features of which would complicate the destruction as much as possible, and simplify data recovery. Western Digital 500GB (3.5 ") have a standard-thickness case and contain three metal plates each, which makes the data on the bottom plate as immune as possible from the electromagnetic pulse when the magnetic coil is placed on the cover of the HDA cover (iron top hard drive cover). On these disks, our equipment ( PC-3000 ) allows for the subtraction of information on each surface separately (in general, this is not always possible.) Ie if the upper surfaces are demagnetized and the lower ones are not, we can read it regardless of the state of the upper ones, to further simplify the data recovery process and to ensure that everything possible has been done, we have previously saved the contents of the service area from each drive.
Before testing, the surfaces of the drives were overwritten using a template containing the HDDScan signature and sector number.
A total of two test series were conducted.
')
In addition to Western Digital, 2 Raptor 150 GB (2.5 ") hard drives participated in the test. They came to us after they tested the equipment they had purchased to destroy data in one large company and gave it to us for testing. We recovered data from them in full. These 2.5 "inch drives have massive 3.5" inch radiators that affect the configuration of electromagnetic fields and can complicate the destruction process. Therefore, we also considered them worthy of participation in tests.
For the destruction of data used serial equipment company LLC "Ranteh" Samurai 2U on 4 disks
The hard drives were placed on a rectangular wooden table inblack with four legs and fixed with clamps. Clamping is necessary due to the fact that during the passage of an impulse the coil with the disk bounces and can even fall off the table, and the mechanical effects violate the purity of the experiment.
In the presence of R.LAB and Softline, the drives were prepared for the test and the red button was pressed so much.
All electrical appliances burned in the building, for a few days there were short-term interruptions in radio communications and auroras in the upper atmosphere.
After the test, it turned out that the coil installed on disk 3 was incorrectly connected to the infernal machine, so we do not consider the result of this test.
Then the drives were transferred to R.LAB specialists to study their condition and recover data.
The results of a preliminary visual inspection of the state of the containment:
Disk No. 1 - heads are physically broken;
Disk 2 - heads are physically broken;
Disc number 3 - heads look good;
Disk 4 - heads are physically broken;
Disc number 5 - heads look good;
Disk number 6 - heads look good.
Management boards on all hard drives that have undergone the data destruction procedure were diagnosed and recognized as working. Then the following work was done:
With drives number 1, 2, 4
The following operations were performed with each disc:
1) Blocks of magnetic heads were replaced with serviceable ones.
2) The check showed that the drive cannot read the information from the service area it needs for initialization.
3) After which the operation “hot swap” was performed. It consists of initializing the control board on a working drive, where the service information from the corresponding damaged disk (which we saved in advance) was previously recorded, and then installed on the failed disk.
4) Then attempts were made to read on each surface separately. No reading was possible on any surface.
5) Permutation of the head unit into a serviceable drive and check - donor heads are working.
Taking into account our knowledge of the compatibility of the head units, as well as a great deal of experience in performing the “hot swap” operations on these models, it can be concluded that the servo-marking is seriously damaged on all surfaces. With this state of servo information, it is impossible to count the contents of the sectors. In addition, based on the nature of damage to the servo mark, it can be concluded that the data has been destroyed.
With drives number 5, 6
1) Functional check showed that the drive is faulty.
2) Replacing the head blocks to serviceable.
3) Reading on our equipment cannot be done, the drive is not initialized.
4) Checking the installed head blocks on a working drive showed that they were out of order.
As a rule, heads fail in the presence of physical surface defects. But:
1) A visual inspection using various optical media did not reveal any surface defects.
2) Pre-testing performed prior to the experiment showed satisfactory surface conditions.
3) At the time of the test, the heads were in parking zones and could not damage the surface.
The reason why the heads fail when installed on these disks is not clear to us. Perhaps some influence on the state of the disks had a previous attempt to destroy data. At the moment there are several assumptions, and we cannot yet confirm or refute them in any way. But if you take any of them, the data can be considered destroyed.
Judging by the information we have, none of the specialists has ever come across a similar phenomenon. The issue needs further study.
Initially, we also planned to try to destroy the data, placing the coil from the end of the disk. This experiment does not bear much practical sense, as in the case of coil arrangement on the side of the control board. Just curious to see what will happen. But in the process of preparing the test, it turned out that this experiment had already been carried out, and showed that in such cases the drive remains in good condition. Therefore, as violations of the recommendations of the manufacturer, we decided to limit the location of the coil from the side of the control board on one of the disks.
Coil Location and Used Equipment
Disk No. 7 - the coil of the radiator is located on the reverse side, the data is destroyed by the SAMURAI 2U device.
Disk number 8 - in the PC case, fixed on a standard mount SAMURAI X-Lite .
Disk number 9 - in the PC case, fixed on a standard mount SAMURAI ATX .
In the presence of R.LAB, three destroyers were activated in succession.
Then the hard drives were transferred to recovery.
The results of a preliminary visual inspection of the state of the containment:
7 - everything is fine
8 - heads torn off.
9 - heads torn off.
After inspection, the hard disk number 7, was connected to the PC-3000 . It was correctly initialized, the study of the state of the surface showed that a small part of the servo information is damaged, but most of the data can be recovered.
Further, with disks No. 8 and 9 worked as follows:
1) Due to the fact that one of the severed heads was found stuck to the top plate, it was assumed that the other heads were also stuck to the pancakes. Therefore, we disassembled the plate packs, and actually found the remaining heads. After removal of the remains of the heads, the packages were assembled, mounted on spindles and ostustirovani.
2) Blocks of magnetic heads were replaced with serviceable ones.
3) The check showed that the drive cannot read the information from the service area it needs for initialization.
4) Hot swap has been executed.
5) Then attempts were made to read on each surface separately. No reading was possible on any surface.
6) Permutation of the head unit in a serviceable drive and check - donor heads are in good order.
Conclusion - the data is destroyed.
Tests can be considered successful. Drives number 3 and 7 do not count, because when placing the coils on them were not followed the recommendations of the manufacturer.
PS: General Director R.lab Nicholas Hostainov received an invite from us and may be able to answer any technical questions about recovery.
Since we can only break disks, but how to recover ... it is not for us.
We decided to publish a report of R.LAB - one of the leading data recovery companies. They help us test our data destruction systems on new modern drives.
The video was filmed after the experiment, but still the hard disks were bouncing just as fun during the testing itself.
Preparing for the experiment
As experimental subjects, it was decided to use hard disks, the design features of which would complicate the destruction as much as possible, and simplify data recovery. Western Digital 500GB (3.5 ") have a standard-thickness case and contain three metal plates each, which makes the data on the bottom plate as immune as possible from the electromagnetic pulse when the magnetic coil is placed on the cover of the HDA cover (iron top hard drive cover). On these disks, our equipment ( PC-3000 ) allows for the subtraction of information on each surface separately (in general, this is not always possible.) Ie if the upper surfaces are demagnetized and the lower ones are not, we can read it regardless of the state of the upper ones, to further simplify the data recovery process and to ensure that everything possible has been done, we have previously saved the contents of the service area from each drive.
Before testing, the surfaces of the drives were overwritten using a template containing the HDDScan signature and sector number.
A total of two test series were conducted.
- The purpose of the first series of tests was to test the effectiveness of the SAMURAI 2U with different locations of the emitter coil relative to the hard disk.
- We decided to conduct the second series to test the operation of SAMURAI X-Lite and SAMURAI ATX . In addition, the unsuccessful test No. 3 of the first series was redone and the assumption of a possible decrease in the efficiency of destruction due to a change in the pulse configuration by the system unit casing was checked (the first series was conducted in air).
')
First episode
In addition to Western Digital, 2 Raptor 150 GB (2.5 ") hard drives participated in the test. They came to us after they tested the equipment they had purchased to destroy data in one large company and gave it to us for testing. We recovered data from them in full. These 2.5 "inch drives have massive 3.5" inch radiators that affect the configuration of electromagnetic fields and can complicate the destruction process. Therefore, we also considered them worthy of participation in tests.
For the destruction of data used serial equipment company LLC "Ranteh" Samurai 2U on 4 disks
Location of drives and coils
The hard drives were placed on a rectangular wooden table in
- Disk No. 1 - the coil is shifted and is located on the side of the cover above the head; it covers half of the disk.
- Disk 2 - the coil is placed on the side of the cover exactly above the pancake disc.
- Disk No. 3 - the coil is placed on the controller side, the disk is reversed.
- Disk 4 - the coil is shifted, covers only half of the disk, the drive is powered, the spindle rotates.
- Disk number 5 - in the design of this disk radiator is used to remove heat, which
does not allow to place a radiator close by. Radiator disassembled coil
as close as possible to the disk. - Disk No. 6: - the design of this disk also uses a radiator to remove heat.
For the purity of the experiment, the radiator is left in place, the emitter is installed
above the radiator at a distance of about a centimeter from the cover of the drive.
Test
In the presence of R.LAB and Softline, the drives were prepared for the test and the red button was pressed so much.
After the test, it turned out that the coil installed on disk 3 was incorrectly connected to the infernal machine, so we do not consider the result of this test.
Then the drives were transferred to R.LAB specialists to study their condition and recover data.
Data recovery
The results of a preliminary visual inspection of the state of the containment:
Disk No. 1 - heads are physically broken;
Disk 2 - heads are physically broken;
Disc number 3 - heads look good;
Disk 4 - heads are physically broken;
Disc number 5 - heads look good;
Disk number 6 - heads look good.
Management boards on all hard drives that have undergone the data destruction procedure were diagnosed and recognized as working. Then the following work was done:
With drives number 1, 2, 4
The following operations were performed with each disc:
1) Blocks of magnetic heads were replaced with serviceable ones.
2) The check showed that the drive cannot read the information from the service area it needs for initialization.
3) After which the operation “hot swap” was performed. It consists of initializing the control board on a working drive, where the service information from the corresponding damaged disk (which we saved in advance) was previously recorded, and then installed on the failed disk.
4) Then attempts were made to read on each surface separately. No reading was possible on any surface.
5) Permutation of the head unit into a serviceable drive and check - donor heads are working.
Taking into account our knowledge of the compatibility of the head units, as well as a great deal of experience in performing the “hot swap” operations on these models, it can be concluded that the servo-marking is seriously damaged on all surfaces. With this state of servo information, it is impossible to count the contents of the sectors. In addition, based on the nature of damage to the servo mark, it can be concluded that the data has been destroyed.
With drives number 5, 6
1) Functional check showed that the drive is faulty.
2) Replacing the head blocks to serviceable.
3) Reading on our equipment cannot be done, the drive is not initialized.
4) Checking the installed head blocks on a working drive showed that they were out of order.
As a rule, heads fail in the presence of physical surface defects. But:
1) A visual inspection using various optical media did not reveal any surface defects.
2) Pre-testing performed prior to the experiment showed satisfactory surface conditions.
3) At the time of the test, the heads were in parking zones and could not damage the surface.
The reason why the heads fail when installed on these disks is not clear to us. Perhaps some influence on the state of the disks had a previous attempt to destroy data. At the moment there are several assumptions, and we cannot yet confirm or refute them in any way. But if you take any of them, the data can be considered destroyed.
Judging by the information we have, none of the specialists has ever come across a similar phenomenon. The issue needs further study.
Second series
Initially, we also planned to try to destroy the data, placing the coil from the end of the disk. This experiment does not bear much practical sense, as in the case of coil arrangement on the side of the control board. Just curious to see what will happen. But in the process of preparing the test, it turned out that this experiment had already been carried out, and showed that in such cases the drive remains in good condition. Therefore, as violations of the recommendations of the manufacturer, we decided to limit the location of the coil from the side of the control board on one of the disks.
Coil Location and Used Equipment
Disk No. 7 - the coil of the radiator is located on the reverse side, the data is destroyed by the SAMURAI 2U device.
Disk number 8 - in the PC case, fixed on a standard mount SAMURAI X-Lite .
Disk number 9 - in the PC case, fixed on a standard mount SAMURAI ATX .
Test
In the presence of R.LAB, three destroyers were activated in succession.
Then the hard drives were transferred to recovery.
Data recovery
The results of a preliminary visual inspection of the state of the containment:
7 - everything is fine
8 - heads torn off.
9 - heads torn off.
After inspection, the hard disk number 7, was connected to the PC-3000 . It was correctly initialized, the study of the state of the surface showed that a small part of the servo information is damaged, but most of the data can be recovered.
Further, with disks No. 8 and 9 worked as follows:
1) Due to the fact that one of the severed heads was found stuck to the top plate, it was assumed that the other heads were also stuck to the pancakes. Therefore, we disassembled the plate packs, and actually found the remaining heads. After removal of the remains of the heads, the packages were assembled, mounted on spindles and ostustirovani.
2) Blocks of magnetic heads were replaced with serviceable ones.
3) The check showed that the drive cannot read the information from the service area it needs for initialization.
4) Hot swap has been executed.
5) Then attempts were made to read on each surface separately. No reading was possible on any surface.
6) Permutation of the head unit in a serviceable drive and check - donor heads are in good order.
Conclusion - the data is destroyed.
Conclusion
Tests can be considered successful. Drives number 3 and 7 do not count, because when placing the coils on them were not followed the recommendations of the manufacturer.
PS: General Director R.lab Nicholas Hostainov received an invite from us and may be able to answer any technical questions about recovery.
Since we can only break disks, but how to recover ... it is not for us.
Source: https://habr.com/ru/post/176987/
All Articles