 Hi, everybody. I did a speech last year here. Anybody see that? That's pretty good. Yeah, last year, after I did the speech here, and the material started flowing around, and some of it's on YouTube, on the internet, things you'll actually find the videos, I started getting some phone calls from data recovery companies and other data recovery people who were a little pissed off, to say the least. They're like, hey, dude, this is trade secrets. You're ruining our industry. And all the stuff that you're telling people to help them recover their discs is just going to hurt us as a whole. And I made it pretty clear to them that the whole point was that if your data is worth, say, more than anywhere between $600 and $1,000, and you wanted to do something with it, you should send that off to a professional company, because there's a good chance you're going to mess it up, especially if this is the first time that you're doing something. And then the second point that I tried to make to them is that most of the stuff that people are doing is they're not going to spend $2,000 to try to get their data back, so I want to try to help them do their own recoveries and actually get somewhere. And I've had a lot of people, I've had a lot of good response from people who've actually done this. So in response to their request for me not to ever do any more material, I'm here with bigger and better and more advanced stuff, and I'm actually going to follow a theme this time. So thank you. So let's make sure this is going to work. I can tell you I've heard this story way more than once. So this is the most common question that I get. So I'm going to try to take two of the most common questions that I've gotten since I did all the presentation stuff last year. I'm not really going to duplicate, but maybe 5% of what I did last year. So the videos are out there. If you go to myhardjob.com, they're actually published. I have a Torcon, Defconn one up there. They're a little bit different, and there's more material, and I'm only going to duplicate about 5% here, because it pertains to this particular problem. And then the second question that I had all the time was about multi-platters. Last year, I said you can't do a recovery with a single platter. I met you as a general audience just without any special tools, because my whole presentation is about not having to have special tools, except for this one thing, where it actually has to do with a multi-platter. So I'm going to go into that. But this is a common problem that I get a question for is what is that clicking noise? The problem with the clicking noise is that it's not a simple problem. It actually is based on four different types of problems that all have the same effect. So let's go through those. Basically, what we're going to be talking about here is going to be the area that says the actuator arm, where the head, the area of the head, actuator arm, and then down through the logic board. So we're going to be focusing on how that is affected and what happens, and there's an item on there that's called the preamp. So I'm going to go through those pieces. The very first thing that happens when you power on your hard drive is that the hard drive has to do like a self-check. It actually checks to make sure all of its electronics are there, that all the pieces are functioning properly before it actually proceeds to do anything else. Once that has successfully completed, it will go ahead and say, hey, I want to spin up the motor. And the spindle will start to spin. The motor spinning is a very important process for the heads, because the motor spinning is what's called an air bearing. The air bearing causes the head to float, and that's what actually allows you to move your head over the platter. But it does one other thing, which is on the left there blinking in red, you'll see that there's a locking pin there. It's actually just a little piece of plastic that just heaters out of the way when the airflow is strong enough to push it. So once the platter starts to spin up, it'll move that out of the way, which unlocks the arm so that it can move over the platter. So as soon as it starts to do that, it will start to unmount the head once the head has an OK, and then it causes it to fly over the platter. So this is what's going to keep that going. Then the head actually has to go and read what's called the servo timing. The servo timing is a mechanism on the drive that is like geographic information. It's going to tell the head where it is over the platter at any point in time. So it reads that information from the platter, and then it starts to read firmware on the platter. The platter will actually have contents on it. And each manufacturer can specify certain things that they want to do with this platter and store in content. So if there is some special test routine, they will write that content typically on the platter so that they don't have to make adjustments or change the board every time something changes. They can just make a change to the content on the platter. So the way they do this is with something that's called the system area. So every manufacturer has their own specific system area. And this is what makes it really difficult to do any kind of recoveries if you have damage here, because everything is specific to a manufacturer and sometimes to a model. So in order to repair this, you've got to imagine that it's kind of like getting a firmware update for your board. It's like they're all specific. They're all going to be individual, and they're all going to be even more specific by model. But most of you have heard that you have maintenance tracks or negative cylinders on your drive, and they typically are numbered negatively. So you will have a zero track. We'll start where your data is. And everything else before that is actually a negative number, and they can have a ton of negative tracks. But typically you're looking at something in the range of like 20 negative tracks. This is the type of content that's in the essay area. Now in the data recovery world, this is called a UBA block, and that's utility block addressing. And each one of the UBA blocks is a module. So smart data, most of you know what that is. There's actually a spot on the platter in that negative area where it can store the smart data. Some drives store the serial number there. Some of them actually still have them on the boards, the PCB boards. So if you're going to change something out, there's a specific reason why I'm telling you about these particular items though. And as I go through the recovery process, you'll see why these items are important. The P list and the G list. Some of the firmware overlay code is important if you've got special tools to recover the data. And then you have all your servo parameters and your test routines. This is what a UBA block looks like. Basically what they did is your drive has sectors on it, and each sector is 512 bytes. Well, when they decided that they wanted to have a utility block, they don't want to have to say, I have seven sectors for this block. So they came up with what they call the UBA block. And so the UBA block is where they define that now on a table, and they say, on this drive for your bad block list, maybe I have three sectors. And for this one, for the drive ID, I only have two sectors. And the manufacturer can change this at will, and then they don't have to change any of their code to read what is happening on the drive. They just change the size of the UBA block. So it makes it a little bit easier for them. And you can actually address the UBA blocks using certain special equipment that says, I want to go read what the bad block list table is, and pull that up. This is just an example. This doesn't mean that it's written in stone, and everybody's is different, and every drive is different. So the system area has this thing that's called the P list and the G list. Most people know that they have a bad block list. The thing is that you have more than one bad block list. You have two bad block lists. There's a really important reason that you need to know that you have these two bad block lists. And again, when I get to the data recovery section, I'll show you how to do what's called a live PCB swap. And if you have this loaded, you'll have to know that it has changed and what to do about it. So the P list is the primary list. When they manufactured the hard drive, they scanned it, formatted it, did a number of different things to the drive to test it. And everything that came up as a bad block, they went ahead and put in this list. So the primary list is a permanent list. It doesn't change. You don't normally erase it. There are special tools that you can use to erase it. And then the G list is the bad block list that you know of that's called the grown list. And that's where all the sectors that have problems while you're reading and writing to your drive are written to. And that can actually be cleared. You can do a number of different things with that or test and add to the list. The problem is that if a drive head has not read and written to a particular sector in a long time, the environmental aspects of that disk can change. And a sector can go bad. And it won't be added to the bad block list. You'll actually get like, my hard drive doesn't boot. It just dies. And you'll have a number of different problems. And those are the kind of things where with doing different ways of recovery, you can actually get those sectors back or rebuild those sectors. The cylinder structure is really, really important from the standpoint of how multiple platters work. Your data is written on the top of a platter and then the bottom of a platter and so on and so on down through the platters. So this makes it incredibly difficult to take more than one platter and move it to another drive to alleviate your problem. So if you had two drives and they were identical and you just wanted to pull out your platters, in this case, if you have one, you can move it. If you have more than one, you'll have a problem because the cylinder will not align itself. If the cylinder turns at all, even a minute amount, you will never get those disks to line up again and read your data from it because the bit that's on top won't match the bit that's on the next platter to work in parallel to actually get that content off. But one of the really important things here is the beginning of a partition structure. Standard formatting tools will basically make a partition structure start on cylinder boundaries. So the point is, is that if you know where the cylinder is that your partition structure started, you can go straight there and not have to go through every single bit on the drive to try to figure out where your beginning of your partition is. And there are certain tools, like Byteback, that will actually go directly to all of the cylinder boundaries and find out if that's where your partition structure starts. One of the important things here is that if you had to scan every byte on the hard drive, you have a really good chance that it's going to fail when it hits a bad block. So it's not going to continue on. But if you could just skip all the other content and just look for that partition, you might be able to get your MFT and actually do a recovery of just the file that you want because the MFT will tell you where your file is. So depending on how damaged the MFT is itself. Now the MR head, that's a magneto-resistive head. That is the head that you can think of as the head that we used on hard drives in the 90s. So if you remember today's when your hard drives were really reliable, it was because of this head. And most of the changes that have happened have been on the next head, which is the GMR head. And that has mostly occurred since late 1999 and up until about last year where they made some other changes. But this head was very stable. It was very simple. And you're really looking at hard drives that were really less than 20 gigs, but more likely 10 gigs and less. 16 gig hard drives started switching to the GMR head. It was designed by IBM. They started putting them in SCSI drives in 99. So this head is a fairly simple head. It basically has two pieces that know when something's changing. And so it's a magnetic head that can read the change that's underneath it. So assuming using my artistic license here, that that looks like a bit. And I would like to explain to you that most people seem to think that a hard drive has zeros and ones written on it. And it does not have zeros and ones. It is encoded and it's similar to an audio stream. So what happens is the electronics, as the content passes through them, they actually even have a preamp on the arm. And they encode the signal and put the signal on the drive. And then they decode it when it comes back off. And it looks a lot more like a sound wave when you're looking at it. You have your valleys and your peaks and ups and downs, and it tries to determine what that is. But it's encoded. It's not a zero and a one. So again, artistic license here. The MR head would detect, as the bit passed underneath it, that there was a change in magnetism. And that would cause a bit to flip basically so that you could actually read that there was a high and a low. And then you have a bit. But the GMR head is quite a bit different. This is actually an act of physics here. And I'm not a physicist, so I'm probably going to completely destroy what's going on here. But the whole point of the GMR head is that they figured out that if you took two magnets and you put a soft piece of material between them, that the two magnets would align themselves with each other. And then at the end, there's a ferrite bead to help shield content from getting destroyed on its way. But the two magnets, because they are aligned and there is the soft piece of material between them, as the bit passes under it, it can detect that the bit is coming. But it doesn't actually detect that the bit was there until it's already passed it. So it's gone past the heads. And it causes the electrons to bounce around in the second component here that causes something called a spin valve to change. And the spin valve is how they detect that a change has occurred as it passed underneath my head. And now I know that I have some change that is a bit. And the new heads are actually even more significant than that. Some of the new stuff that's coming out from Fujitsu and things are seven layer heads. So this complexity is part of our problem as to why we start seeing these degenerating drives. We've got an increase in density as time has occurred. And we've got a more complex head that's moving closer and closer to the platter and reading more and more dense material. So this is what most drives look like that are manufactured today. So as of the middle of last year, almost every manufacturer has switched to a perpendicular recording. Last year I gave, in my speech, a talk more about longitudinal and the other things that happened previous to last year. So if you go watch that speech, you can actually get into that stuff and see what that looks like. But the perpendicular recording mechanism is a way that they figured out to write a bit up and down instead of long ways across the platter. So they're basically squeezing a 2 to 1 ratio in here. So when you get a 200 gig hard drive, in some cases, it's 100 gig that now is recorded with perpendicular, and that makes it a 200 gig drive in your laptop. But so you have a lot higher density again. And we're really talking about a short span here. We don't really know what the effect is over time. I mean, it could be next year you start getting a whole pile of these hard drives in for recovery because perpendicular is failing or we don't really know what our issues are going to be at the moment. So far it seems to be fairly stable. I'm having about the same problems with perpendicular and longitudinal, except that our density has increased. So it makes our recovery a lot harder. But one thing that has changed is that for one thing, primarily, IBM used glass platters before last year. But most manufacturers now have all had to switch to a glass platter because the previous aluminum that they were using in their platter would affect how you can read and write to perpendicular. So most of the drives now are going to a ceramic glass platter. And that's one of the things where when you've actually got a scratch on your platter, it's pretty easy to see. In some cases, it digs a ditch. And you can see through the platter itself, especially if it's happened on both sides and you actually had some sort of a catastrophe where you dropped your laptop off the stairs, it'll dig a big ditch on both sides. And if you pull the platter out, you'll be able to see it clearly. If you have one of those, it's probably just going to destroy your heads if you put new heads on it and try to do something to repair it. So the substrate here is the main thing that has changed. And it will probably affect quite a bit of the drives that we have coming up. Now, if you're doing data recoveries, most of the tools, any of them that are kind of a high-end tools and not just like, I'm going to click one button, scan my hard drive, and try to do a recovery, most of the tools have decided to come up with a mediocre kind of technology to talk to you and tell you what kind of errors are happening on your platter. So most of that will look like this top line up there. The top line, basically, I'm not going to tell you what every single thing means and how to go through it, but as you start doing data recoveries and you start trying to do a scan to try to find out what's with your drive, you're going to start seeing terminology like this. And there are free programs that are high-end programs that can do this. There's one that's called MHDD, which is from a hard drive guru. And he basically wrote a tool that will scan a drive and it will give you feedback and tell you, I'm able to read a drive or I'm having an error. This is a 512-byte piece of data. And you will notice this 512-byte piece of data, I mean, it's got quite a bit in it. You'll see that the servo data is there, which is the geographic information, then you'll see 14 bytes of null. And the 14 bytes of null are there because as the drive encodes data and puts it onto the platter, if it doesn't have a break, it can't tell where something begins and something ends. It would just always be high because the bit that passes underneath it is going to always cause the hard drive's head to say, hey, I've got a bit and I don't know what to do with it. So they came up with a sequence of bytes that are going to be null, just to give it a break so that they can get through this process. And then you'll see in this particular error, the IDNF, and IDNF means ID not found. That is the address of your data. That is basically the part that says, hey, I got this LBA block, I have this content over here and it's at this cylinder and this head. And here it is. If you get that error, it can't find the data. It knows about where it is, but for summary, isn't it? Can't actually make it any further than that. Then you'll see that the next thing it'll move onto is the address marker not found. In that same 512 byte, if it finds the address and you don't get the ID not found error, it will continue on and try to get the data from that 512 byte block. So you'll see this error that will come up on the screen and it'll say AMNF. And that means I know where your data is, but I can't find the data. The address marker for that is not there. And so your 512 bytes that follows, it can't find. And then you'll get your standard stuff which is now I'm gonna try to compare my ECC. And the ECC is the error correction code that's in there in the block that says I read a block, but it's not correct and now I'm gonna flag it as an error. And it will typically try, you can, in each manufacturer's drive, they have a certain number of read, write times that they try to get that data back. And if it fails, say 10 times, then they'll actually say I got an ECC error. If it can correct the error using ECC and that the bytes are not so large that it cannot figure out what to do with it, it will not flag it at all. It will actually get an ECC error but it will never tell you it got one and it will move on. So if you get an ECC error, then that was beyond the scope of what it could actually correct and move. Every single hard drive is having bad errors all the time while it's reading and writing, but it's just correcting them on the fly and trying to fix that problem. And then you'll get the UNC which means it was uncorrectable. So any of the high end data recovery software you're gonna start seeing this kind of a problem and you're gonna have to start reading these things and then it will abort. But even the free ones like MHDD do a great job of explaining to you the errors but you have to know what the errors mean. This is the part where I'm talking about where the signal has to be encoded and decoded. On the actuator arm of the hard drive, there is a preamp. And this preamp goes bad quite often. The problem is is that when you start getting the clicking noise, it means that I can't interpret your data because I didn't get any data from the head but you don't know why it didn't get it. You actually have to kind of break this down piece by piece. And this preamp is one of the big problems. The preamp has two different kinds. One is soldered on and the other one is glued on. So if you have a piece of plastic and you put a drop of glue on a circuit board and you put the, and you put the, drop the chip into it, what do you think most of it's gonna happen if you get really, really hot? It's gonna pop off or something's gonna cause one of the connectors maybe not to connect correctly. So it's really difficult to replace this preamp. This preamp is not something that's, in the small confines that you're dealing with, it will be easier to actually replace the entire actuator arm than it will be this particular drop. So the ones that are soldered on that are physically there are gonna be much better off than the ones that are glued on. And then the voice coil. I talked about the voice coil quite a bit last year. The big thing with the voice coil is that to fix this particular problem when I go through the steps is that you have to be careful not to damage the voice coil because it's held in place by a magnet. And the magnet is very powerful and you can't just stick a screwdriver in there and pry this thing off because you'll actually damage the voice coil. There is a cheap tool that's actually a magnet. It's a very strong magnet and you can put it on top of the magnet here and pull it off. And it won't damage the voice coil so just leave it behind. So the cause of the click is gonna be one of four things that affects this. One is that your platter could be scratched. So when it got thrown off the stairs, the head hit the platter and dug a big hole in it. So this outside area where the head reads is in the three and a half inch hard drives, this is where the SA area is. This is where the negative cylinders on your hard drive are. On most laptop drives, it is in the center instead of on the outer rim. So if you have damage on the inside ring on a laptop drive, you're not probably gonna be able to read the SA area. And if you have a damage on the outside, you're not gonna be able to read it for a three and a half inch drive. The next thing would be this preamp that I just talked about. And then there's obviously possible failure with the PCB board on the bottom and that something fried or you walked across the carpet and touched it with static electricity and it fried a chip on the board and you'll have to try to find a board to replace it. So let's go through some of the things that you can do. The first thing is, is swapping a PCB board live. Now this is a data recovery technique that's probably not well published and that a lot of people talk about. It probably works 25, 30% of the time. But the thing is, is that if you have a duplicate hard drive that's exactly the same as the hard drive that you have damage on without opening the hard drive or doing anything, what you can do is plug your hard drive in, you set the timing say in Windows or using a utility to spin down and put your drive to sleep say for three minutes, something like that. Windows has that standard, you know I'm gonna try to put my drive to sleep whenever I can. Those are the things that you wanna set so that the drive will spin down and go to sleep. So you plug it in, you turn it on, it initializes the good drive, the one that actually works, not the one that's the bad drive. After it initializes and it puts it to sleep, you can actually unscrew the board and you gotta be really, really careful here not to get these screws rolling around on your board. If you take a screw out and it rolls around, you're probably gonna get a little bit of a smoke coming from it, but it does happen. And after you take the screws out, you can physically just move the board. It's four screws in most boards and you can just physically pull it up, put it on the other drive, the bad drive and go ahead and try to do a recovery. Now here's the thing that will happen. The system will think the drive went to sleep. So the system is gonna think it's the other drive. That means the serial number, the sectors, everything is the exact same as the other drive except for the data. Because it didn't do anything with the data, it hasn't read the data yet, but it has initialized the drive. So what will happen is, is your bad block list, your bad block table, both of them, the P list and the G list will be loaded right now and the SA area itself as a whole, which is what you want. You want your SA area to be loaded because the other drive is bad and if it had a scratch on it, you may not actually be able to ever read that SA area. So when you move it over to this drive, you can start doing a data recovery. If it ever powers off or anything ever happens while the drive's in use, you basically gotta start the process over again. But if you can get your files back and you can get it to work that one time, you may actually just be able to copy your file off without having to open the drive or do any other special techniques. And like I said, it works a good 25, 30% of the time. You've just gotta have an exact duplicate drive as close as possible to this. On my website, I have a section under myharddrive.com and presentations that has serial numbers in it and how to match serial numbers on drives and what to look for specifically if you're gonna try to find a drive to match your drive. I've also got, on the DVD, you've got a white paper, it's about 22 pages long and it describes every technique that I'm talking about here and I've also published it on my website with these graphics as stills and the animations on your disc as well. So you can try this yourself and go through each step of the way but you're gonna have to have a duplicate drive to try to repeat that process and so you're gonna have to find one. The second thing that you can do in a lot of cases where you have a bad drive and this doesn't require you to have a duplicate that's exactly the same. You just need a second drive that's larger than the first drive to copy your data onto and this would be to image your drive in reverse. Now, why this works is you have a drive that has cash on it. So it has two meg, eight meg, 16 meg, whatever size cash you have on your drive. And a drive reads forward. Everything's a pre-cash. So it's trying to read content ahead of time that it thinks you're gonna go ask for. So if you have say a 16 meg cash and you're reading content doing a data recovery and it's on the current sector it's looking 16 megs ahead. So if 16 megs ahead of where you're at right now fails it's gonna cause your drive to fail now. So you're not gonna get that next 16 megs. You're not gonna get what you're on. But if you do your drive copy in reverse you actually image a hard drive in reverse. There is no cash. It basically is looking at the current sector and it's not doing a pre-cash because it's not ahead of itself. It's going in reverse. So it's a good technique. Now, here's the tools that you can use to do that. There's only three tools that I know of that do it. There may be more so I apologize if I missed anybody but DD Rescue actually has a specific tag in it that actually makes it run in reverse. And so DD Rescue being a free Linux tool is your best first option. And there is a script that someone wrote that's called DDR Help. And those two together can actually image the drive in reverse. If it can't get a sector it can go back and try to pick up a sector. But other than the fact that you've got to make sure that you know how to use Linux and actually get that done, it's a free tool. Everything else besides that is not free. So you get to something like Media Tools Pro which is around $400 and it's a Windows package. It can read a drive in reverse as well. There may be a setting for that and bite back as well. And then the next one would be a piece of hardware that's about $4,000. It's called the DeepSpar Disk Imager. It does a lot more other things that might be really useful but you're probably not gonna spend $4,000 on an imager if you're not gonna spend $600 on your drive. So anyway, you guys that are already using Linux you probably already know how to use most of the stuff that you'll find in DD Rescue. And it's a quick, easy way but it may take days. I'm just warning you that once you start doing an image that has errors it may take days for it to actually pick up and in some really long cases may take a month. But you've got to keep an eye on it and you'll know what it's doing. The next one is a head replacement. This is one that you can actually do without any real fancy tools. Basically you're gonna get a torque wrench, a torque screwdriver, and you're gonna disassemble your drive and you're gonna move it. Now, if you have multiple platters you can do a head replacement and move all the electronics and all the pieces at the same time without having to buy any fancy tools at all. But if it has a multi-platter you can do it. But a single platter it's easier to actually move the platter than it is to try to move the heads. So this is, again, if you don't wanna spend any money on a tool to move a platter you could actually move your heads. And the heads you basically are going to take paper. You're gonna take post-it notes, you're gonna fold them and you're gonna stick them between the heads to try to keep the heads apart. Now it makes better sense for you to fold it in a V shape so that the V shape is facing the platter. Because when you put the heads and you align them back on the new drive you can push the V shape up onto the platter on both sides and then move the head into both sides. Kinda like what this ramp is doing you'll see this ramp right here on the right it keeps the heads aligned when it's physically on the outside. Now some drives actually have the heads parked in the middle. And so what you wanna do is you wanna turn the platter in reverse from the head so that it's passing underneath the arm and move the heads to the outside and then put your paper in there and move the heads off and pull them off of the assembly. And then I would suggest before you take the assembly, there's two ways to do this which is I disassemble the good drive and then I have my piece and I'm gonna move it to the bad drive. I would say you disassemble your bad drive first and get the arm and stuff out of the way because if there's damage you're probably gonna see it then. You're gonna see I got a big scratch on my platter and I don't wanna ruin this other disc that I already have. So it's good to take a look at it before you go ahead and disassemble your good drive or you'll be just trashing two drives. And again, if you take your time and you use this and I'm not gonna tell you it's gonna take five minutes, this is probably gonna take you about an hour to two hours to do minimum to actually get everything lined up but you've gotta pay really good attention to how you line back up the physical platter itself, the heads on the platter to get that to work. But now the platter swap you can easily do a single platter swap just by disassembling this, you don't wanna touch it, you don't wanna do anything and you move it to a new drive and you do the same thing that you'll do with the heads where you actually have put the paper in the edge of the heads so that you can use a V-shape to try to push the heads back up onto the platter when you've actually moved it in and assembled it. So then the next thing we're gonna talk about is the multi-platter swap. Now the multi-platter swap is a special tool that you're gonna have to use. Now this tool costs in the neighborhood of $250, it may cost a little bit more depending on where you get it from and where it shipped from. It comes with a stand, it comes with a special stand to hold the two caddies in place so that you can actually move the platters, pull the platters up and move them to another drive without having to sit there and try to hold it yourself and keep it steady. And it's cut in a special way too so that you can take the screws off of the bottom of the drive while it's sitting there. This thing looks a lot like a coffee can. No, and it's not made a whole lot better actually either. It's a, the top ring is a solid piece of metal and they have basically cut a slit in the side here where you can see where there's a piece of metal that's folded around it. The whole point of the slit is that you can take that and you can push down on the slit and it will cause the item to squeeze around the platters holding the platters together at the same time. So I have moved three and four platters with this before at the same time and it has successfully held them all in place and I've been able to do a recovery after I realigned the heads and get everything the way it's supposed to be. The other thing that this tool does that's a little bit different than just using a coffee can, if we can cut a coffee can, I have heard that you can possibly use a piston removal tool that might cost in the neighborhood of five, $20, something in that neighborhood and make it work the same way and so we're kind of practicing with it trying to figure out if there's a piston removal tool that's the right size because when you buy this tool, you get two. You get one that's a two and a half inch and you get one that's a three and a half inch. Well on the piston tools, well they're different sizes for every single thing that you have if you have a motorcycle or BMW or something, they're all different sizes but I have heard that people have accomplished it. The only thing is a piston tool is not gonna give you this little plate that's hanging down in the middle. This little plate that's hanging performs one cool option which is when you've put this on your drive and you remove the screws from it, this holds the screws so they don't roll around on your platter. So other than taking a nice little magnet and trying to catch the screw as you get it undone, some of these drives have eight or 10 screws in them. Some of them only have three but other than trying to grab them or catch them when it happens, you're gonna be pressing your luck trying to keep the screws from rolling around. So this particular device, I would say it's pretty necessary but again, like I said, you have an option of not doing a platter if you can do the heads. So this is how this works. Basically you disassemble the section where your heads are and you're gonna get it out of the way and now you'll just have this gap, this space where you can actually push something down and it tends to work better if you do it a little bit to the right where the heads are parked. That way when you put it in the new drive you're not gonna be hitting the head assembly. So you take this and you put it over your platters and then you push this little locking mechanism down and that will hold them in place and you need to make sure you have it firmly. So once you actually get this tool in place you wanna make sure you push it down enough before you lock it so that you're actually hitting the bottom of the casing of the hard drive and then when you push this down it'll tighten around them and then you can stick your screwdriver in here and undo these screws. And as you can see this particular one, I just let them kind of sit in the tray and I go ahead and move the drive and then I try to line them back up again but if you're gonna use our piston tool you're gonna have to catch them yourself. And then when you put it down in the assembly typically this head assembly I don't necessarily have already taken out. There's one screw on the bottom of the head assembly that you can loosen after you've taken off the magnet and the other items and when you loosen it you'll be able to kind of teeter the head out of the way a little bit but you already wanna have your paper and stuff in place so that it's not physically gonna scratch anything or the two heads aren't gonna hit each other. If the two heads hit in most cases they might be okay as long as it was like a very small hit and just the paper was in between or something in that neighborhood but if you slide them right off of the platter they're probably gonna hit each other and destroy each other and you just don't wanna take any more chances than you have to. So if it's still in place you can actually put this in there screw all your screws back in pull this off and unlock it and then the platters will stay aligned they will not move, they will not turn and you'll be able to repair your drive get it running, hook it up to a machine and then you'll be able to use standard data recovery software to do a number of different things there's plenty of specific software for each operating system for each item I highly suggest trying to image a drive or do something with it before you actually try to do the logical recovery sometimes you only get one chance and one shot at getting that drive back and getting the data off of it. Anybody have any questions? One more time? Wipe off the platters, is that what you said? Can somebody repeat that for me? One more time? No, I have never seen that successfully he asked if you could buff out defects from a disc if there's a scratch or something on it I have never successfully seen a buffed out scratch in a disc actually work what happens in that case if you actually have something that's imperative that you get it back you're gonna have to deal with what the head's gonna hit and the fact that you're probably gonna destroy one or two heads in the process of repairing it so if you can, you can start imaging you can image from the beginning of the disc to the error and then try to image from the end of the disc to the error and that may take you two sets to get it right but I have been able to piece two pieces of a drive together that way and actually do a recovery while it was actually hitting and scratching the platter but it is very touchy and it's gonna take a little bit of time in two drives Green? I get this a lot too and this ends up being one of those conversations I have with data recovery companies is about dust about what about a clean room and what you're gonna do well the very first thing is that for a very short term actually trying to do a data recovery if you can do it in the cleanest place possible you'll be able to get your data back I mean we're talking about a situation where you're not gonna spend the $2,000 or something to actually do a data recovery so you're gonna take the best possible effort you can but when the drive starts to spin up the air bearing that it creates actually pushes any content that's on the platters off of the platters as long as it's not stuck there so I mean literally if you had a piece of dust it would actually blow off of the drive once it started to spin up and they actually knew this manufacturers actually knew that even while the drive was enclosed and it was running that it would create its own particles as little pieces and fragments might come off of it and blab blocks or something and they have little trays in the edge of your disk that you'll see there where little pieces of fragments will actually blow off and get caught in these little tray areas on the disk to keep them from floating around inside the platters and inside the disk so you're not trying to repair a disk to keep it running the drive is not gonna be nearly as important as the data that's on it so the whole point is just to get the data off and I think you can cleanly do that in a nice clean environment without having to have a clean room obviously if it's mission critical it's best to do it in a clean room I have a clean room and I use that all the time so from that standpoint but I have done other drives that were not as important on the fly or at a remote location Yes sir, Red? What brands of drives I think you really want to know what the best brand of drive is I would have to say that they're all gonna die they all are not great they all are bad I will tell you that the content I've had more problems and I get more drives in that are western digital drives than anything that are desktop drives and then laptop drives I get more IBM drives in than anything else, IBM Hitachi but the question again is what's the market? I mean if like every laptop has OEM, an IBM drive well then those are probably gonna be the largest quantity I'm gonna get I mean there's some western digital laptop drives I haven't had any of those in but I typically use Seagate and for only one reason you got a five year warranty so back up, back up often back up quick and if it dies at least in five years I get a replacement drive so yes sir? The platter swap thing and I'm thinking again you know a lot of this stuff is like reverse engineer kind of people make things to work so they're not great names but this one is called a head stack platter extractor so they call it an HPE now if you look in the white paper or you look on the webpage that I have all this posted on I have a link to a company called Salvation Data that makes a product that you can buy overseas and they ship it here I haven't found one in the US that actually makes one and sends it here but they have a couple of things in this toolkit for the you know 250 bucks that you can buy this thing for I you know there's just a number of ways to try to get around this problem but that one's probably gonna be the best one yes sir? RAID 0 is bad for recovery it's bad you have to repair whichever drive possibly failed in RAID 0 and then image both of them and then use a piece of software to re-interlace the two back into a new image so you're gonna have to figure out a way to repair that drive and you have to have an image you won't be able to do it like a file recovery or a logical recovery that way till you have the solid image so my suggestion would be to use DD Rescue or something and make an image of both drives before you actually find a tool that says now I'm gonna take you know two dumps and actually put them back together and weave them back together but you also have to know what the interleave was you have to know if it's done in 64Ks or you know what the block size was that's it thank you