Multi-core processors

Hardware keeps developing very quickly, and Moore's law which states that the number of transistors in a processor will double every two years is still valid. The speed of operation though has hit a kind of ceiling and 3GHz processors has been fast for about 6 years now. The method of adding more punch to a processor has been with multi processors, and hyperthreading. The problem is that software has not always kept up.

With a lot of data recovery, many processes are sequential. ie read the problem disk, analyse the data, and then write the data somewhere. With multiple processors, probably the best we can manage is 3 parallel tasks. At each end is a bottle neck of a disk drive. The fastest way to read a disk drive is as a sequential stream. If you try and recover from two parts of a disk at the same time, then the drive will spend a lot of time 'thrashing', just moving the head to the new area, and then back to the original area. Overall, the process will be slower. Multiple processors may assist and enable two recoveries at the same time on the PC, but there are always dangers that the USB interface or similar may then end up saturated.

Very few recovery processes naturally make use of parallel processing so normally on a nice 8 core processor, 7 cores remain rather sleepy. CnW are looking at ways to wake a few of the cores up to help with the ever increasing size of disks, but ultimately, the big bottleneck is the speed of reading a disk. eSATA and USB-3 are all helpful parts of the equation, but at the moment, USB-2 just churns along.

Deleted XFS files

XFS is a popular file structure for NAS devices, both single disk and RAID. A RAID device may be resilient against disk failure (with the exception of RAID 0), but there is nothing to prevent operator error deleting files. With a NTFS disk, a deleted file is marked as deleted, and much of the meta data remains, although the area of the disk that the file used, could be reused.

XFS is less friendly in that the main data within the critical iNode is blanked. Thus flags indicating if it is a directory or file are blanked, along with the file length. Also, the table that stores the locations of all iNodes is also blanked, or filled with irrelevant values. Recovery is therefore deemed as all but impossible.

My challenge this week is to try and disprove this. iNodes still exist, as do cluster runs and resident data within the iNode. Watch this space to see if progress is made. I doubt a solution will be perfect, and there will always be the danger of producng files with a corrupted file structure, but I am curre ntly convinced that something will be possible.

Multiple Partitions on a drive

To most users the hard disk has a single partition, or just the C: drive. When it comes to recovery, it is very common to see three partitions. A typical pattern is

• FAT16 (hidden)
• NTFS
• FAT32 (hidden)

The FAT partitions are actually hidden and are configured for system recovery purposes. ie, they will often keep a copy of the operating system and so allow a complete reload of the drive in the event of failure. This saves the manufacturer about 50 cents on not providing a boot DVD with the system and assumes that a disk will fail, but these partitions will remain. Users are actually asked to make their own recovery DVDs.

As far as recovering user data, the only partition to be concerned about is the big NTFS partition. This is where holiday photos, wedding photos and MP3 music will be found.

Forensically though, it is possible to store data in these hidden partitions. Suspicions would be raised if the partitions are bigger than expected. On standard example I have looked at the FAT16 partition is about 60MB, and the FAT32 is about 3GB. The disk was a 250GB. A significantly larger FAT32, or a hidden NTFS must raise questions, and so these partitions would need careful investigation for possible hidden files.

On NAS (Network attached storage) systems, there are often multiple partitions (sometimes more than 4). They are normally all Linux and most of the partitions are Ext2/3. The final partition is the location that data is stored in. This final partition could be XFS, ReiserFS or Ext2/3. In this type of configuration one would expect the final partition to be large, and the rest fairly small. The warning sign would be a second large partition.

Seagate 7200.11 drives

There was a firmware bug a few years ago with Seagate 7200.11 drives. It typically affected 500GB drives and the symptoms were that the drive span, by could not be detected by the BIOS. It only affects a certain firmware, and is generally known as 'bricking' the drive.

Fortunately CnW Recovery do have a fix for this problem, and has had a high success rate, with complete data recovery. Contact CnW for more details if you think your drive has been affected.

The above problem is not be confused with another common Seagate failure of bearing seizure. The disks spin at 7200 rpm (ie fast) and sometimes the bearing sieze. The solution is a skilled replacement of the platters into a different drive case, only to be undertaken in a clean room with qualified operators. A drive has several platters and the radial alignment between the platters has zero tolerance. ie if the platter moves a micro degree out, all the data will be lost. CnW does not have a solution for this problem, but can recommend companies who can help.

Windows 7 64 bit

64 bit operating systems have been about for several years now and the hardware probably even longer. In the 1980s, it was a very slow move from 8 bit to 16 bit, and then from 16 bit to 32 bit. At last, with Windows 7, 64 bit operating systems are now becoming common, even on laptops, and the key selling point is that the once enourmous 4GB memory limit is now lifted. At a 1980 Intel seminar, it was suggested that 1MB of RAM was all one would ever need! In the course of my programming I now sometimes request 200MB buffers to help with sorting.

Although the operating system is 64 bit, the majority of applications are still 32 bit. The biggest nightmare has been critical support for drivers and other base level drive type programs. I have have been using Windows 7-64 since November 2009 and it is still a pain that the 64 bit Windows Explorer is not supported by Adobe Flash. I also have a nice standard HP printer that does not have a 64 bit driver, and has be used with a fiddle to make it look like a different PCL printer. For CnW Recovery software, support for the hardware dongle has only just been launched.

I like Windows 7, partly because it is on a fast Quad core PC, with 6GB or RAM, and much better than Vista. Whether the 64 bit apsect is worth anything, I am not sure, but I am convinced that this is the way forward., I just wish device drivers for old hardware kept pace.

For recovery purposes, I am looking forward to exploring the multi-tasking features that Visual Studio 2010 has. Disks are getting bigger and bigger, speed is becoming more critical.

A fun tip, you may not be aware of on Windows 7 is the 'Window Key and Tab'. Try it, it is more fun that Alt Tab.

Apple Drives

I am often asked which make of drive is good and which is bad. The answer is like trying to recommend which type of car to buy, but there are two drives which should be replaced today if you have one.

The two problem Apple drives are both Segate Momentus (2.5"). The models are

• Momentus 5400.2 Firmware 7.01
• Momentus 5400.3 Firmware 3.CAE

If you have either of these two drives, then backup up all data today, and have the drive replaced. If the drive dies (this afternoon) physical recovery is all but impossible.

All makes and models of drive fail, but these are currently possibly the worst.

Video thumbnails on recovery

When evaluating a demo recovery program it is often very difficult to know if the data you require will be recovered by the licenced copy. Recovering DVDs has an added complication as many DVDs fail in a way that they can not be read by standard DVD readers.

The latest version of CnW Recovery has a wizard to recover Mini DVDs from video cameras. The wizard will first examine the disk to see if readable, and then will extract the video chapters, as MPEGs. For commercial reasons, the demo will not save these files to the hard drive, but will display th first few seconds of each chapter to give confidence that data will be recoverable. The licenced version will continue with a routine to recreate all the IFO files and merge the chapters into a standard VOB all within the stanard VIDEO_TS directory structure.

Decimal or Hex

I have a personal pet hate of people who use decimal numbers when Hex number make far more sense. On an NTFS disk, the first MFT sector is very often 6,291,519. I cannot remember this number, but 0x60003F is actually very easy. It is made up of a disk partition starting sector of 0x3F, and a cluster size of 8 times the starting cluster of 0xc0000.

When analysing a disk many times sector number make far more sense in Hex than in decimal. Another example can be to determine the cluster size based on file start locations. with a series of start locations such as 512, 640, 1824, 2368 there is no clear patter, but the same numbers in hex are 0x200, 0x280, 0x720, 0x940 it will be a good guess that clusters are probably 0x20 sectors in length.

CnW Recovery software allows for both decinmal and hex to be used, and many menus have an option box to switch between the two. Although it may be easy at first, it is well worth getting used to thinking in Hex when working on disk contents and this helps even more when a complex number is actually made up of several sections. An example maybe a date which has 5 bits for seconds, 6 bits for minutes etc. A decimal number is pretty meaningless, but a hex number is much clearer - though ultimately it is best viewed as a binary number.

Think Hex. Many numbers make far more sense in hex when investigating a disk and computer data. Windows comes with a nice calculator that will flip between decimal and hex when required.

Old joke - There are only 10 types of people in the world, those who understand binary, and those who don't.

Slack space in NTFS

Slack space on a file system is data that is within allocated clusters, but not actually used. When a file is allocated space on NTFS is normally allocates a number of clusters, and a cluster is often 16 sectors in length. Thus, if a file is say 5K long, then there will be 3K of the cluster which is allocated, but does not contain file information. Also, no user will ever see the contents of this 3K of slack space.

Forensically, slack can be useful as it may contain data from previously deleted files. The data will not be complete but it could conatin between 1 and 8191 bytes of useful (for an 8K cluster). CnW actually has an option to collect these fragments and storfe then in a big file with a header for each length of slack data from each incomplete cluster. It should be noted that slack space will only be found in the final cluster of a file. Thus for a 31K file, there will be 3 complete clusters, and the final cluster will have 1K of slack.

For NTFS, slack space does not stop here. To optimise disk usage, small files are stored after the MFT entry in the 1024 MFT block. The maximum size of file maybe about in the region of 5-600 bytes. Thus when analysing a disk for data in the slack area it is essential to examine each MFT for possible data after the MFT, maybe from previous uses of the block. Again, CnW Recovery has a feature so that all MFTs can store the slack in a specific file, again separating each entry with a header. For more details www.cnwrecovery.com/html/ntfs_forensic.html

Reiser FS

Linux is still a niche operating systems but has many very keen fans. With Windows, there are two file systems that may be used, NTFS and FAT, but with Linux (and Ubuntu) it is possible to install several file systems and so there have been many developments each trying to be better, or faster. The most common file systems as Ext2/3, XFS and ReiserFS (version 3).

The most significant feature of ReiserFS is the way it stores the data on the disk. With FAT, each file always takes at least a cluster (maybe 16K). With NTFS each file over about 500 bytes always takes a cluster, while small files may be stored with the directory entry in the MFT block of 1024 bytes. ReiserFS will use blocks to full capacity. Thus with a 4K block, it may actually contain 5 to 20 files, or the start of a long file. This can mean that the disk can be used with virtually no slack or wasted space.

From the recovery view point this makes data carving a nightmare. For most file systems, data carving always examines just the first bytes of a sector to determine if the sector contains a file start. For the same to be true with ReiserFS, it may have to check every byte, or if the data is 64 bit aligned, every eigth byte in order to detect all possible file starts. Fortunately though, long files normally start on block starts, so normal carving will work, but in order to find all short files, a lot more care has to be taken.