Post Thu May 01, 2014 10:47 pm

Click of Death - Head Stack Replacement / Swap How-to

Data Recovery 101...

Good morning. Welcome to another episode of Cyber Secrets. In this episode, we will cover the basics of a head stack replacement after a hard drive has crashed.

What you need before attempting this on a mission critical system is practice, a clean room, and more practice.

Data recovery has been needed since man started to write things down. Why? Because what ever medium they tried to store the data on, it has always been susceptible to destruction. From earthquakes versus wall paintings to fire versus the library of Alexandria to head crashes versus your corporate file server. There has always been a weakness in how we have stored our information. While the risk mitigation to that sounds easy (back it up), the reality of the matter is that data loss happens all the time. When it does, there are 2 methods of data recovery.

1.)Physical recovery -- Make sure the physical medium is functional
2.)Logical Recovery -- Once the physical works, get the data

The data recovery process has 4 basic steps.

1.)Physical repair
2.)Image the device
3.)Recover the data
4.)Fix the data

Now to put this in perspective, the first method and the first step go together hand in hand. The second method is more of a software recovery that takes steps 2-4. Most people can do logical recovery with relatively inexpensive tools such as getdataback, rstudios, or even most of the forensic suites out there today. Physical recovery is an entirely different issue. It takes time, patience, a steady hand, practice, a clean room, the proper equipment, and an almost identical donor to use as a parts replacement cadaver. It is just like surgery and the donor needs to be compatible with the recipient if there needs to be an organ transplant. Just like the human body, the internals or organs of a hard drive are very fragile when not in the most ideal of environments. Platter based hard drives have more moving parts than a Solid State Drive (SSD), but the difficulty is still there. Just as in a normal transplant example, you need to understand that there is never a 100% guarantee that the recipient will come out of the surgery and recover. You can just hope and pray that the hard drive comes out and lives long enough to transfer the data to a secondary host so you can perform a logical recovery.

What causes the Click-o-Death? It is because the SA cannot be read. You can have 4 main reasons (and a possible combination of them) for this to happen:

1.) Heads are dead
2.) Preamp is dead
3.) SA corrupted or scratched
4.) Firmware on the PCB

This is a video of a head stack replacement. There is a donor drive and a recipient drive. As luck would have it, there is only half a head, so the replacement was very fast with minimal risk to the donor head stack. Enjoy the video!

As for the logical recovery, here are a couple more videos:
Data Carving:


If you have any questions or comments, please feel free to fire away.