Vantage Data Recovery

In Anatomy of a Hard Drive, we looked at how a hard drive works, and the mechanics of writing bits of data by magnetically encoding it onto rapidly spinning disks.  Consider this: Eight bits make a byte.  One million bytes makes a megabyte.  One thousand megabytes, or one billion bits, makes a gigabyte.  That 300 GB drive in your system?  Three hundred billion bytes, or 2.4 billion bits!  So how does the drive keep track of them all?  Through a system which provides for an operating system format, layered over a low-level or physical format.

Most drives are shipped from the manufacturer with the low-level format in place, “bare” or un-formatted drives are extremely rare.  The user only has to format the drive with the chosen operating system, and the drive is ready to hold data.  But what does a low-level format do?

Cylinders

Each disk surface holds data in a series of concentric rings or “tracks”.  If, for example you have a drive with two disks, the first track on each side of the disks would line up vertically over one another, to form a “cylinder”.  If a drive had one hundred tracks on each surface, it would have a total of one hundred cylinders.  These cylinders are numbered, beginning with the outermost set of tracks as cylinder 0, the next as cylinder 1, and so on.  Cylinder 0 is reserved by the drive for its partition table.  Here it stores the drive’s “geometry”, consisting of how many bytes of storage are available, and how many cylinders, heads and sectors are on the drive.

Heads

Simply, how many heads the drive has for reading and writing data.  This is the same as how many disk surfaces are available for data storage.  These are also numbered starting with 0.

Sectors

Imagine your disks as Mom’s apple pie.  Slice it into equal pieces.  Each piece along each individual track is a sector.  Sectors are numbered on each track starting with 1.  Following our pie example, if you cut it into 16 pieces, the sectors on the first track would be numbered from 1 through 16.  The sectors on each subsequent track would also be numbered 1 through 16.  Using our example drive with 100 cylinders, 4 heads and now 16 sectors, the drive’s geometry would be noted as 100×4x16.  This would give it a total of 22400 sectors.

Counting them out

To access data, or find an available space to write, the drive counts “addresses” or combinations of the numbered cylinders, heads, and sectors.  The very first position would be cylinder 0, head 0, sector 1 (0,0,1). The next position would be 0,0,2.  The count continues this way to the last sector for that cylinder and head, then it switches to the next head (0,1,1) and counts out all the sectors there.  When it is finished counting through all of the heads and sectors in cylinder 0, it moves to cylinder 1 and begins (1,0,1).

Translating

Not surprisingly, the system as originally developed has its limits.  The original scheme allowed for a maximum of 1024 cylinders, 16 heads and 63 sectors, or 528MB.  As drive capacities rapidly increased, drive manufacturers had to find ways to accommodate them within the physical addressing limits.  To achieve this, larger BIOS limits were introduced and various translation schemes were developed.  These involved mathematical translation through drive firmware of larger drive geometry recognized by the drive into smaller, acceptable parameters recognized by the PC.  In effect, a hard drive’s actual physical geometry is no longer represented in the system BIOS, but is translated into a “logical” geometry, with the hard drive firmware handling the mathematical translations.

Each sector is of equal size, holding 512 bytes of user data, along with other information to help the drive identify the sector and maintain data integrity.  Because the disks are smaller at the innermost cylinders, those cylinders can hold significantly fewer sectors.  To increase capacity, drive manufacturers developed “zone recording” which allowed for a more efficient use of space, with more sectors on the outer, larger cylinders.  This unequal distribution of sectors requires a translation scheme which “evens out” the sectors across the cylinders.

In logical block addressing (LBA) each sector is given a unique number and addressed through that number rather than the old cylinder, head, sector address.  Again, the drive “translates” this information for the system to geometry which falls within the BIOS limits.

Oh My!

This addressing scheme, while transparent to the user, allows data recovery experts to step through a damaged or corrupted drive independent of any operating system, and recover data on a block-by-block basis.  This allows for a mirror image of the media to be used for recovery.  File and folder structures can be determined and rebuilt as neded to return good, usable data to the client.

 �