Data Recovery from External USB Hard Drive

One of our customers brought a Western Digital portable external hard drive to us since their PC wasn’t recognising it.

Typically, with symptoms like this, the most likely cause is the that USB interface is broken or not working, rather than a fault with the drive itself. (This is the most common cause of failure with external USB hard drives). Fixing this used to be a quite straightforward, because most external hard drives were really just internal SATA ones (either 2.5″ or 3.5″) inside an enclosure- essentially just a case with a SATA-to-USB interface board. You could open the case, unplug the internal SATA drive from the faulty USB interface and put it in a new enclosure which can be bought for under £10.

However, most recent models have the USB interface directly built in to the hard drive’s own circuit board instead, and no separate SATA interface. This helps keep the size down and stops people selling the internal drive and enclosure separately (as happened previously). Unfortunately, it also makes recovering data from a drive with a faulty USB interface harder.

Data recovery should never be done via the USB interface- it requires direct access to the drive at as low a level as possible. This is virtually impossible with USB, since everything goes indirectly through multiple levels of USB and storage drivers that remove low-level control. Even connecting to the SATA interface on a regular PC isn’t ideal, since data still has to go through the SATA controller drivers that in turn speak to the BIOS and then the software.

The optimal solution is the one we use- a hardware-based controller that communicates directly with the drive at a much lower level. It’s far more reliable, and lets us send manufacturer-specific commands to the drive, such as cutting the power instead of trying to force a read if the drive is unresponsive. This avoids a lot of the timewasting and foot-dragging on what are often already failing drives.

Faulty external hard drive.

Drive after being taken out of external case.

Note the Micro USB 3.0 connector where you’d expect a normal drive to feature a SATA connection.

Swapping the ROM between boards.

Original hard drive after replacement SATA board fitted.

Imaging the raw data via our hardware-based controller.

Firstly, however, we have to convert the drive from USB to SATA. The best way to do this is to find a board from the equivalent SATA model of the same drive, then remove the board. However, we still have to transfer the ROM from the original drive to the new board, as it contains a lot of information required to access it. Thus, we have to desolder the ROM chips from each board and swap them over.

Once converted, we need to create an image of the original drive’s data onto a new (good) drive. This is because one should never work on a faulty drive more than needed- the longer it’s running, the more damage is likely to be done, and the closer it’s likely to get to failing completely. We often only have one chance to recover the data, so we need to get a copy of it as quickly as possible.

For this reason, we’re using the hardware based imaging device described above. This is far more effective than using a regular PC and recovery software for various reasons:-

• Low-level, direct control of the drive itself is much easier without drivers getting in the way.
• If the drive is struggling to be read, the power can be killed and restarted.
• Sectors with a high response time (bad or failing) can be postponed or skipped in favour of recovering data from the good sectors first. This is important, since there’s often a limited amount of time to get data off a failing drive, and we want to recover as much as possible before that happens.
• Individual heads can be enabled and disabled if there are problems with some of them not working.

Typically, we can recover the raw data from most hard drives in under 24 hours. In this case, the heads were particularly weak, and it took much longer- over two weeks(!) between the 28th of July and 12th of August. It might have been possible to speed this up significantly by swapping over the heads, but this would have substantially increased the cost for our customer.

Now we have a raw image of the faulty drive’s sector data on our shiny new drive. However, bad sectors, head problems and other issues reading the original drive mean that this image is still likely to be corrupt, and should be run through recovery software to fix or work around these faults and get back as many original files as is practical.

In this case, things turned out well- due not least to the skill of our technician- and we had a very high rate of success. Most of the data on the drive was able to be retrieved, and more importantly, the customer got the pictures they needed back.

Raw imaged copy of the original drive after data had been copied over.

Using recovery software on the imaged data to recover files.

Thumbnails of recovered images. (Censored for privacy reasons).