Forensic recovery of hard disk data by using the spin-stand imaging technique

摘要

An ex-situ technique for the drive-independent forensic recovery of data from failed hard drives has been developed. For drives which have suffered damage from a head crash or other mechanical problems and cannot be resuscitated using standard software, firmware, or part-replacement techniques, there is currently no commercially available means to recover the data, even though the files are still stored on the magnetic disks. Here, we report on the results of a spin-stand imaging based technology, where the failed disk is removed from its native drive, placed on a spin-stand, and scanned with a giant magnetoresistive head. After track centering, track following, signal detection, data decoding, error correction, and sector mapping, the otherwise unrecoverable data can be retrieved to the computer operating system. Spin-stand based data imaging has the potential to provide recovery at data rates approaching those in the native drive and is a truly drive-independent method to recover hard disk data in a time-efficient manner.