The Data Extractor UDMA is a specialized software product functioning in tandem with the PC-3000 UDMA hardware-software product. It is intended for recovering data from SATA (Serial ATA) and PATA (IDE) HDD 3.5", 2.5", 1.8", 1.0", USB HDD, SSHD (Solid State Hybrid Drive) etc. Together with the PC-3000 UDMA it forms a comprehensive professional solution for your data recovery business.
- Works with all of the most popular file systems: FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS
- VMDK (VMWare) images are supported
- Data Extractor UDMA has modes used in forensic investigations
Data Extractor UDMA is capable of working with 2 HDD drives simultaneously. Drives can be connected to PC-3000 UDMA ports (1xSATA, 1xSATA/PATA), motherboard ports (xSATA, xUSB etc) or represented as HDD images.
PC-3000 UDMA allows you to repair physically damaged HDD drives in technological mode. SATA drives use UDMA133 reading mode while PATA drives use UDMA100 reading mode.
Using the Data Extractor UDMA you can create full (sector-by-sector) or partial data copies from the damaged drive to a good one connected to the port of the PC-3000 UDMA board, motherboard or in image-files.
"Explorer" mode
Recovering data with Data Extractor UDMA
There are three types of HDD malfunction: physically damaged HDD, logically damaged HDD and HDDs with a combination of physical and logical damage.
Physically damaged HDDs:
Physically damaged HDDs are hard drives with damaged surface or magnetic-head assembly and defective "service information" that leads to unstable reading and multiple errors, corrupted translation system between logical block addressing (LBA) and physical geometry of HDD (translator). This can be caused by:
- BAD sectors caused by damaged surfaces or malfunction of the magnetic head assembly (MHA)
- "knocking" sounds, which may be caused by corruption of servo labels or an MHA malfunction
- Service information destruction
- System violation of LBA - PCHS translation
- unstable reading caused by reinstalling of MHA or disk pack
- data recovery after HOT-SWAP procedure
Logically damaged HDDs:
Logically damaged HDDs are hard drives with damaged logical structures which prevents access to the user information via OS instruments.
This can be caused by:
- damaged information about partitions (MBR, GPT, APS, etc.)
- slight damage to file system metadata caused by HDD or OS failures
- deleted folders and files
- significant damage to data and metadata caused by formatting
- logical damage caused by viruses
Combination of physical and logical damage:
You may use the wide possibilities of the Data Extractor UDMA product to handle various types of data recovery cases, including those that are connected with both physical and logical damage.
Data recovery from physically damaged HDD
It is very important to read the maximum data volume in the shortest period of time as a damaged HDD can stop functioning at any time. Data Extractor UDMA has integrated functionality for logical analysis of file systems which allows reading only necessary data. This technology greatly reduces the volume of read data, the duty cycle of damaged HDDs and the time required for data recovery.
The Data Extractor UDMA has extended functionality for HDD reading:
- HDD reading in technological mode
- reading by head map
- choosing the reading mode (UDMA 133/100/66/33, PIO 4/3/2/1/0)
- read forward and backward
- read ahead (cash function) disabling
- autorelocation disabling
- reading with hardware and software retries
- reading with ignoring ECC
- reading on used/unused sectors map
- power supply control
- software and hardware resets
"Create virtual translator" option enables recovery of data from an HDD with a corrupted dynamic translator. File system meta data and user data are used in this mode.
Partition map
Data recovery from logically damaged HDDs
There are some special modes for recovering data from logically damaged HDDs:
- "Explorer" mode – to get access to the damaged partitions, folders and files
- "Raw recovery" mode – to recover data when file system structures are catastrophically damaged
- "Object map" mode – to work with fragmented structures (reading, copy creation etc)
- "Quick disk analysis" mode – to solve cases with damaged information about partitions
- "Partition data analysis" and other special modes for each file system – to recover data from specific damaged file system (including data deleted by users)
- Modes for viewing and editing metadata in various file systems
- Building maps of used/unused sectors, metadata and file system data
Quick disk analysis
Using Data Extractor UDMA for forensic purposes
Data Extractor UDMA has special modes used by forensic investigators:
- hash sum calculation for MD5 and SHA1
- exporting catalogs list and files into csv format
- building various maps: disk maps, used/unused sectors maps, file system metadata maps etc
- unlocking the HDD
- changing/resetting to factory value of MaxLBA HDD
- HDD mounting in "read-only" mode
- HDD data copy creation
SEE ALSO:
