Atola Technology

This is something new to the data recovery software/equipment industry, so I have a feeling that it needs to be explained.

Basically, case management allows tracking everything that is being done to a particular hard drive. I will give a couple real world examples:

More than one person works on a particular hard drive
When a company has more than one data recovery engineer, several people may work on a single hard drive. In this case keeping track on what has been already done to a hard drive as well as proper communication between engineers can become a real challenge.

One data recovery engineer works on several hard drives at a time
Obviously, there has to be a convenient way of keeping proper records for each hard drive. Also, since most recoveries take more than just a couple of hours, the process of making notes becomes even more important.

Atola Insight solves the above mentioned issues once and for all.

Proper Case Management

Everything you do in Atola Insight gets logged into the database. Diagnostic results, SMART data, firmware modifications, even spin-up power consumption graphs are saved. Every action taken by an engineer and its result goes into the database; custom notes are supported.

Later on, when a data recovery engineer returns to that drive, Atola Insight automatically loads up the history and displays it on the main form of the application (dashboard). Database can be shared between numerous Atola Insight users; dedicated database server configuration is also supported.

Case Management finally allows data recovery engineers to concentrate on data recoveries instead of making notes.

We receive this question again and again: what hard drives (model numbers) are supported by Atola Insight?

I completely realize the importance of this question, but unfortunately, there is no simple answer. When we were designing Atola Insight, we’ve faced a dilemma: whether we add support for new hard drives on a per-model basis or use a different approach. We have chosen a different approach, and I will try to explain what it is.

Per-model basis means that we start working on new hard drive models as soon as we have them in our lab, which means that there is always 3-12 months delay before the software can work with these hard drives. In other words, we would be always 3-12 months “behind” the hard drive market. Maintaining the software this way is good for marketing reasons, it also simplifies research and development to a degree.

In Atola Insight, we use a better approach. When implementing firmware recovery and password removal algorithms, we try to make them as universal and intellectual as reasonably possible, thus making them able to recover and unlock all hard drives, including those that did not come out yet.

How is that possible?

Hard drive manufacturers do not change their vendor-specific command sets and firmware structures too often. On average, major changes are made once per 3-5 years, and minor changes occur once per 1-2 years. It just does not make sense for HDD manufacturers to make major changes frequently (it is an expensive and in some sense dangerous process). This allows us to create algorithms that “adapt” themselves to new hard drives as they come out, without the need for us to make any changes to Atola Insight. So, instead of “adding” new model numbers every now and then, we will be spending that precious time on improving a lot of other important things.

What does all this mean to the happy Atola Insight users? It means that Atola Insight supports all hard drives made within the last 5 years with exception of certain models. Basically, we will be publishing “unsupported yet” models rather than “supported models” (and that “unsupported yet” list will be very short). Also, in most cases, “Unsupported” hard drives can still be diagnosed and imaged with Atola Insight, so it won’t be “totally useless” until we release an update. We believe that our customers will gain maximum benefits from this approach.

SCSI/SAS/Fiber Channel hard drives

At this moment we do not have any firm plan regarding these hard drives. When we finish up all IDE, SATA and SSD hard drives, then we will think about these.

I am happy to provide everyone with the a new screenshot that we’ve got today: Accessing firmware files (system area modules):

Manual firmware recovery: downloading firmware

This is an old-fashion way of accessing firmware files (modules): you can perform the recovery yourself. But wait, Atola Insight can do much more than that. It can automatically repair most kinds of firmware damage for you; all you have to do is to click a single button.

Automatic firmware recovery in progress

In automatic mode, the program first creates full firmware backup, diagnoses the problem, and then takes all necessary steps to recover the drive. Automatic mode saves tremendous amount of time since most firmware issues can be recovered automatically.

If you want to see Atola Insight in action, then you are welcome to visit us at CES 2008.

Project presentation at CES 2008 (January 7-10) in Las Vegas
Floor plan of the show | booth number: 73539 (Look for YEC booth and ask for Dmitry Postrigan) in the Sands Convention Center.

By the way, YEC also presents Shinobi, an HDD Unlocking tool powered by Atola Unlocker module. They also have all kinds of HDD duplicators. You have an opportunity to see all hi-tech HDD tools in one place, so do not miss the chance!

We’ve got it working today. There will be two kinds of current monitors in Atola Insight: full-sized monitor and tiny monitor. Tiny monitor can stay on the screen allowing to always keep an eye on hard drive’s power consumption.

Current Monitor (click to see in full size)

The image above shows normal spin-up and initialization currents (5V and 12V) for a desktop hard drive.

It’s been quiet in our blog last months, and for a good reason. We are currently developing Atola Insight, a data recovery solution. What’s good about it is that it covers all four phases of a data recovery process: diagnostics, firmware recovery, duplication/imaging, and file recovery.

The Fourth Element

Every data recovery specialist knows about the firmware recovery tools, disk duplication (or imaging) tools, and file recovery (data extraction) tools. But there is one more important thing that often gets overlooked: diagnostics. When a hard drive arrives to the lab, the very first thing a specialist has to do is to find out the current state of the hard drive. You cannot effectively repair a hard drive if you are not sure about what is the issue. If the diagnostics is not done properly, you risk doing more damage to the drive or rendering it irrecoverable.

I have never heard of a doctor beginning a surgery without having read the precise diagnosis first. The diagnostics is done earlier by people who had the knowledge and tools needed to perform such task. I do not see why this should be any different in the data recovery process, and I believe that currently the initial diagnostics is getting much less attention than it deserves.

There are some tools that help diagnosing surface and heads (for example MHDD); firmware can be diagnosed to some extent with the firmware recovery tools; electronics can be tested with a multimeter or oscilloscope. But there is no single tool that would allow to diagnose a hard drive and determine the exact issue.

Introducing Proper Diagnostics

For the last year we have been working on diagnostics algorithms that would allow to diagnose any hard drive and determine the exact issue, whether it is an electronic damage, mechanical damage, firmware damage, or a file system damage. We developed Atola DiskSense, a USB unit that works with IDE and SATA hard drives. One of the most important uses of Atola DiskSense is HDD diagnostics.

Atola Insight suite — diagnosing HDD circuit board

Atola DiskSense is a small silver box that attaches to any PC with a single USB cable. It contains:

• IDE/SATA interface that supports UDMA transfers
• 2 separate current monitors for 5V and 12V lines with short-circuit protection
• HDD power switch
• Emergency button that allows to stop the current operation immediately
• RS-232C (serial) port for Seagate hard drives
• Buzzer that informs when something is done or there is a critical error
• LEDs that indicate status (HDD power, IDE/SATA busy, Operation, Error)

Atola DiskSense unit — working prototype

Using Atola DiskSense you can get the most precise diagnostics results. Upon completion, Atola Insight suite reports the exact problem with the hard drive; it also suggests what steps have to be done to recover the drive.

Firmware

The biggest problem with the most firmware recovery tools is that all they do is just provide access to the hard drive’s firmware (modules, ROM, configuration NVRAM, etc); therefore the firmware recovery process looks more like using a disk editor to recover a file system. To recover something with such tools, you would either need to use a 500+ page manual, or you would have to be one of those who perform the research and development (in this case you don’t really need third-party tools since you can create the best tools by yourself).

Introducing Proper Firmware Recovery

In Atola Insight, the firmware (system area) recovery algorithms are automated to the maximum possible extent. The program automatically creates full backups of the hard drive’s firmware before any recovery attempt. All controls have clear descriptions, so that there is little or no need to use the manual. Of course, old-fashioned manual recovery is still available.

We will be revealing more information about Atola Insight soon.

This article is a complete guide on recovering your hard drive’s factory capacity. At the end of this article there is a link to our program that recovers factory capacity of any hard drive.

“My hard drive has mysteriously became smaller! How can I restore its full capacity?”

There are several common reasons of why your hard drive might lose some megabytes or even gigabytes:

• Your Operating System does not support LBA48 addressing mode
• You are mixing binary and decimal gigabytes
• Your motherboard has created a hidden area on your hard drive to store a backup of the BIOS binaries
• Your PC/Laptop manufacturer has created a hidden area on your hard drive to store a backup of the Operating System installation files (needed for automatic restore functionality)
• You have used some software that sets HPA (Host Protected Area), messes with DCO (Device Configuration Overlay), or switches off LBA48 support
• You have misplaced a jumper on the drive
• There was Magic involved

Now I will go through these things one-by-one and provide some more details.

Operating System does not support LBA-48 addressing mode

Windows 95, Windows 98 and Windows ME will not support big drives (>137GB) even if you install all hotfixes. There are ways to get around this problem, but since these Operating Systems are rather rare nowadays, I do not see the point of writing about them.

Windows 2000, 2003 and XP do not support big drives by default; you will have to install the latest service pack in order to get big drives working properly on these OS.

Windows Vista does not have any issue with big drives.

Binary and decimal gigabytes

Hard drive manufacturers use decimal gigabytes while operating systems use binary gigabytes. One decimal gigabyte contains 1 000 000 000 bytes (1000 x 1000 x 1000), whereas one binary gigabyte contains 1 073 741 824 bytes (1024 x 1024 x 1024) — that’s more than a 7% difference! So, your 300 GB hard drive will show up in Windows as a 279 GB hard drive.

Motherboard creates HPA

Motherboard can create a so-called “Host protected area” on your hard drive to store its data. Usually this area is not bigger than 10 megabytes, so there is nothing to worry about.

PC/Laptop manufacturer creates HPA

Manufacturer of your PC can create a “Host protected area” on your hard drive to store an image of the original operating system and programs. This area is used when you want to restore the original state of your desktop PC or laptop without using CD/DVD disks. Usually this area is quite large (8-20 GB).

In this case, to restore the original capacity of the hard drive with the HDD Capacity Restore tool that we include in this article, you may need to remove the hard drive out of its original PC/laptop and temporary attach it to another PC. This is needed because most BIOSes will disable HPA/DCO operations to ensure that nothing can reset or damage that hidden area.

Software that has the ability to control HPA and DCO

For example, MHDD. This software allows you to set a Host protected area on your hard drive, so the hard drive will report less capacity to both BIOS and Operating System. MHDD can also access DCO (Device Configuration Overlay), and that allows you to not only change hard drive’s capacity, but also switch some hard drive functions, such as LBA48 support, Security commands support and others.

Some manufacturers (for example, Dell and HP) use DCO to reduce capacity for marketing needs. Example: they need to ship 1000000 computers with 40GB hard drives, but they only have 80GB drives in stock. They will use their own DCO tools to lock capacity to 40GB.

Jumper settings that limit hard drive capacity

Most hard drives have a special jumper setting that allows you to limit their capacity to either 32 or 128 (137) gigabytes.

Magic cases

These include things like HDD firmware bugs (believe me, there are plenty of them).

Also, sometimes a damaged Master Boot Record may cause the BIOS and/or the Operating System to misdetect the true hard drive capacity. In this case you would need to use a zero-fill tool.

Sometimes a very broken hard drive may report wrong capacity. In this case there is nothing you can do about that.

Solutions. Restoring factory capacity

1. Check jumpers. Consult with manufacturer’s instructions and set jumpers to the proper position.

2. Check your OS, does it have all updates installed?

3. Check disk partitions. Run Windows Disk Management console and see if there is any free space that is not used by any partition.

4. If steps 1—3 did not help, then we have a very cool tool that analyzes your hard drive’s LBA48, HPA and DCO status and recovers factory settings (see below).

HDD Capacity Restore Tool

We’ve came up with a freeware tool that handles LBA48 mode setting as well as HPA and DCO features. It does everything automatically: it extracts the factory capacity; then it restores the factory LBA48, HPA and DCO settings.

Download HDD Capacity Restore Tool.

All you have to do is to run it and click “Restore Capacity”. The program will do the rest.

Update May 24, 2008: Many people ask if this this tool formats the hard drive and/or erases the data. No, it does not perform any kind of formatting; furthermore it does not read from or write to the user data area at all (including partition tables, boot records, etc). It only alters HDD firmware (HPA and DCO settings).

I strongly recommend to re-power your computer before running this tool. That means, completely power off your computer; then power on, start Windows and run the tool.

If the tool fails to restore the original capacity, then the most common reason is that your motherboard is blocking HPA and DCO commands. You can check that by running BIOS Setup and looking for things like “DCO” or “HPA”. If nothing helps, try on another computer. If you are brave enough, you can also try the following: run the program, select your hard drive, and then when you see the “Restore Capacity” button, re-power your hard drive by detaching and re-attaching its power cable. Warning: you are doing this at your own risk!

After the program finishes working (3—20 seconds), you will need to power off your PC, then wait 10—20 seconds and then power on.

I believe I’ve covered everything. If I am missing anything, you are very welcome to leave a comment :)

Good luck!

In most partition recovery software, to locate all partitions on a damaged hard drive, you have to scan the entire surface. The process, which is often pretty much useless, may take up to several hours of your precious time, and it may even take days if the hard drive is filled with bad blocks. In the worst case scenario, it can make significant damage to the hard drive, thus making the data recovery process much more complicated and expensive.

While the need of scanning the entire hard drive might look reasonable, in vast majority of cases it is not needed. Furthermore, there’s no need to scan more than 1% of the HDD surface to locate all partitions! This is because of a simple fact that there are not too many places where a partition can start and end.

First of all, Windows Disk Manager (and almost every other partitioning software) creates partitions in 8 MB increments. This means that to locate all Boot Records of all partitions, you need to read one sector, and then jump over 16064 sectors, read one sector and so on. Yes, that is 16065 times less data to read than when you scan the entire drive. Fascinating!

Second, when a partition has been found, it is often easy to find out how big it is (by parsing its Boot Record, if it is looks intact). This information allows you to just jump over that partition and continue looking for other partitions.

Finally, it turns out that in most cases a good partition recovery software needs to read just a few sectors! There are exceptions, of course, but they are rather rare and can be dealt with.

I am not trying to say that partition recovery is a simple process because it is not. My point is: partition recovery software can be much faster, efficient, and user-friendly.

Hey, we’ve just released nice tool — Partition Find and Mount. This tool allows everyone to easily recover files from lost or accidentally deleted partitions in the very convenient way.

So, what are the differences between our software and other tools like R-Studio or similar? I will number three of them.

1. Partition Find and Mount works extremely fast. Scanning your hard drive may take only 0.1 second.
2. All found partitions can be mounted into the system. Mounting will make them available to the operating systems and standard tools like Windows Explorer can be used to access files.
3. Software is extremely easy to use.

I know, I know that we probably won’t get rich by selling this software, but the concept of recovering partitions this way was so good that we couldn’t resist.

My colleague from our lab is working on damaged NTFS file system analysis. This is needed for our new project currently in development.

Recently, we thought it would be nice to release some free utility based on the developing library. And so we did.

A couple of weeks for GUI development and an hour for a web site and here it is — a free NTFS Undelete utility.

It should work on any NTFS file system from Windows NT/2000/2003/XP/Vista, and as far as I know it is the only free undelete software that is distributed in a different bundles — in ready for burning ISO image, ZIP archive and windows installer.

Hope people will enjoy it.