Data recovery of an improperly opened Western Digital hard disk

The forcibly opened 2,5" hard disk was handled as an extended diagnosis in our Economy Service. Even though the hard disk was in a terrible condition, Attingo was able to recover most of the specified data.

30. 5 2018 - Sebastian Evers

Initial data loss situation:

Storage medium with data loss:

• WD hard disk (Western Digital WD5000BPVT-00HXZT3)

Data specified for recovery:

• Pictures and images

The customer stated that the hard disk was never dropped but is clicking in regular intervals. Additionally, the hard disk has already been opened but no further manipulations were made.

Analysis and conduction of the data rescue:

The technician immediately confirmed, that the hard disk was already opened. Given the condition of the screws, no Torx-Screwdriver was used. The hard drive cover was visibly bent and forcibly opened. The hard drive contained two platters with three write-/read heads.

Parts of one of the the heads were already torn off and stuck to the inner side of the cover. The other heads were bent. The magnetic surfaces were contaminated and coated with grease of fingerprints. Also there were severe surface damages, caused by Based on the severe damages and low chances of a successful recovery, we offered the customer an extended diagnosis. With special procedures, multiple exactly matching spare parts and several weeks the engineers were able to temporarily access the hard disk at least partly. In the course of the arduous readout process, less than half of the raw data was extracted.

The raw data was further examined in the next step. The prevoious NTFS file system was predominantly not recoverable. Nevertheless, several thousands of pictures - with and without file system structure - could be reconstructed.