Chapter 8 — Exercises
A mix of concept checks, hands-on labs (diagnose by sound, image with
ddrescue, parse a mapfile, calculate and verify a hash), and judgment calls where the right answer is sometimes "stop." Work them in order: the early groups train your diagnosis, the middle groups your hands, and the last groups the harder skill — deciding whether to touch a drive at all. (answer in Appendix) marks problems with a worked solution in Answers. ⭐ marks a stretch problem. Labs that say "use a practice image" point to the datasets in Appendix J — never practice on a client's only copy, and never on irreplaceable data you cannot afford to lose.
Group A — Reading the symptoms (diagnosis by sound and behavior)
These train the skill that comes before any tool: telling, from a few seconds of sound and a single power-on, which kind of trouble you are in.
8.1 A bench tech jots down the following intake notes from five different drives. For each, state the most likely failure family and whether the correct first move is "power off and stop" or "keep observing." (answer in Appendix)
Drive 1: repeating "click ... click ... click-click ... pause ... click"
Drive 2: single high-pitched beep, platters never spin
Drive 3: continuous grinding/scraping the moment it spins up
Drive 4: dead silent — no spin, no LED, no vibration at all
Drive 5: spins up smoothly, quiet seeks, sounds perfect — host never detects it
8.2 Grinding is called the single worst sound a drive can make. Explain, in physical terms, what is happening to the platter surface while a drive grinds, where the machined-off material goes (and why that creates a second problem for the rest of the drive), and why every additional second converts recoverable data into permanent loss. State the one correct action and how quickly it must be taken. Finally, contrast grinding with clicking: both demand "power off," but explain why clicking offers a slightly larger margin of error than grinding does.
8.3 Counterintuitively, total silence — no spin, no LED — is frequently the best news a dead drive can give you. Explain why. Name the failure family it usually points to, why that family leaves the head-disk assembly typically intact, and why it is the cheapest and most DIY-friendly family to address. What is the one thing silence does not guarantee?
8.4 ⭐ The "click of death" is described as both the most famous symptom and the most misunderstood. List the three physically distinct underlying faults that can all produce identical clicking, describe what the actuator is actually doing while it clicks (what is it trying and failing to read?), and explain why this ambiguity is precisely the reason a clicking drive needs professional diagnosis rather than a confident DIY quote.
Group B — The fork in the road: logical vs. physical, and the four families
Naming the family is most of the battle — each has a distinct fix, cost, and DIY-vs-lab answer. These check that you can place a fault before you reach for a tool.
8.5 State the single most consequential question in any drive-recovery job, and explain why the two branches it creates "demand opposite reflexes." Then give one concrete example of a correct reflex on each branch that would be actively wrong on the other branch — for instance, something you would happily do to a logically-failed drive that would help kill a physically-failing one. (answer in Appendix)
8.6 Sort each fault below into exactly one of the four physical-failure families — electronics/PCB, firmware/service area, mechanical, or media/surface — and add a one-word note on whether the user data is typically intact-but-locked-out or physically-at-risk: (a) a shorted TVS diode; (b) a read/write head that has electrically failed; (c) a translator that can no longer map LBAs to physical sectors; (d) a platter with a visible circular gouge; (e) a seized fluid-dynamic bearing; (f) a drive that still reads but shows climbing pending-sector counts in SMART; (g) a corrupt firmware module in the service area; (h) head stiction on an old CSS-design drive.
8.7 A drive spins up smoothly, runs quiet, and makes no clicking — and yet the BIOS reports a capacity of 0 ("LBA0"), or detects it under a garbage model string, or simply hangs with the drive in a busy state. (a) Which failure family is this, and why is it described as "invisible to your ears"? (b) Why is it, despite seeming dire, often one of the cheapest and most complete recoveries of all? (c) What single mistake does this family most strongly warn you against making before you have diagnosed?
8.8 ⭐ A drive is reported to a client as a "head crash" after a failing wall adapter delivered a power surge. Explain how a single event could plausibly produce a multi-family failure (for example, frying the PCB and damaging a head at once), why a head crash that gouges a platter can in turn damage the donor heads you later install, and why multi-failure cases are exactly why labs exist and why quotes for "the same symptom" vary so widely between drives.
Group C — Rule out the cheap stuff (hands-on triage)
An astonishing fraction of "failed drives" are failed cables, ports, enclosures, or power supplies. These build the change-one-variable-at-a-time humility that saves clients thousands.
8.9 Write out, in order from free to invasive, the triage checklist you run before ever declaring a drive a clean-room job. For each step, name the specific cheap failure it is designed to catch (e.g., what does "swap the data cable" rule out, versus "test in a known-good enclosure"?). End the list at the correct stopping point — the moment where the next step would mean opening the HDA. (answer in Appendix)
8.10 Hands-on. A client brings in an external USB drive that "is completely dead — another shop already quoted $1,900 for a clean-room head replacement." Describe the single highest-yield five-minute test in the business, step by step. State exactly what result would point to the enclosure (cheap, DIY) versus the bare drive (escalate), explain the failure mode in a typical USB external that this test exposes, and connect your answer to the chapter's War Story about the law firm's 4 TB drive.
8.11 Lab — interpret tool output. You connect a suspect "degrader" through a known-good adapter and watch the kernel log and SMART as it enumerates:
$ sudo dmesg --follow
sd 6:0:0:0: [sdb] 1953525168 512-byte logical blocks: (1.00 TB)
sd 6:0:0:0: [sdb] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=...
sd 6:0:0:0: [sdb] tag#0 Sense Key : Medium Error [current]
$ sudo smartctl -a /dev/sdb | grep -Ei 'Reallocated|Pending|Uncorrect'
5 Reallocated_Sector_Ct ... 812
197 Current_Pending_Sector ... 144
198 Offline_Uncorrectable ... 96
(a) Are the electronics and service area alive? How do you know from this output alone? (b) Is the drive healthy or degrading, and which specific attributes prove it — and what does the combination of pending + reallocated tell you about the drive's spare-sector budget? (c) Should you mount it normally and browse for the important files, or go straight to sequential image-mode? Justify the choice in terms of head motion.
8.12 ⭐ You are standing at a client's Windows machine; no third-party tools may be installed. Write the PowerShell to pull (1) each attached disk's physical health and operational status, and (2) its SMART-style reliability counters. Then interpret this returned output and say exactly what you tell the client to do before you touch anything else:
DeviceId FriendlyName MediaType HealthStatus OperationalStatus
-------- ------------ --------- ------------ -----------------
1 ST1000DM010-... HDD Warning Degraded
DeviceId Wear Temperature ReadErrorsTotal ReadErrorsUncorrected PowerOnHours
-------- ---- ----------- --------------- --------------------- ------------
1 - 41 15234 211 41020
Group D — Imaging a failing drive (ddrescue, mapfiles, hashes)
This is the technique that most directly unites recovery and forensics: capture every readable byte, once, in a controlled sequence, before the drive gets worse — then prove what you captured.
8.13 Explain why a naive dd (or dcfldd) is dangerous on an unstable drive — describe precisely what dd does when it hits a bad area and why that behavior can kill the drive before it ever reaches the readable majority. Then state the two things ddrescue does differently that make it the correct first tool, define what the mapfile is, and explain why it lets you stop and resume across power cycles without ever re-reading good data. (answer in Appendix)
8.14 Lab — write the commands. Write the full three-pass ddrescue sequence for a degrading /dev/sdb imaged to recovery.img with the mapfile recovery.map: (1) a fast first pass that grabs only the easy data, (2) a bounded-retry pass for the hard areas, and (3) an optional reverse pass. Include the key flags for each pass, one sentence on what each pass accomplishes, and — the heart of the exercise — explain why this order is mandatory rather than optional. What would go wrong if you ran the aggressive scraping pass first?
8.15 ⭐ Lab — calculate. A 1 TB drive (1,000,204,886,016 bytes) was imaged with ddrescue, producing this mapfile excerpt:
# pos size status
0x0000000000 0x3A2B4C0000 + <- recovered
0x3A2B4C0000 0x0000500000 - <- bad
0x3A2B5C0000 0x........... + <- recovered (bulk)
0x???????????? 0x0000100000 / <- non-scraped
Given that the only non-recovered regions are the 5,242,880 bytes (0x500000) marked bad and the 1,048,576 bytes (0x100000) marked non-scraped: (a) what percentage of the drive was recovered? (b) The first bad region begins at byte offset 0x3A2B4C0000. Express that as a 512-byte sector number, showing the Chapter 2 arithmetic (offset ÷ bytes-per-sector). (c) Write the one-sentence statement about the unreadable regions you would give to a recovery client, and the one-sentence version you would put in a forensic report. (answer in Appendix)
8.16 Lab — calculate and verify the hash. After imaging a (practice) failing drive to recovery.img, compute its SHA-256 with sha256sum recovery.img (or hashdeep -c sha256), record the value in your notes, copy the image to your analysis workstation, and re-hash to confirm a clean transfer. Now answer the conceptual core that the chapter's "Recovery vs. Forensics" callout turns on: this hash certifies what, exactly — the image, or the original failing drive? Explain why, on a degrading drive, you cannot make the hash meaningfully certify the original, and why this makes your first complete image the best evidence rather than a weaker substitute for it.
8.17 Lab — recover from this image. Using the "failing-drive" practice image from Appendix J: (a) run the chapter's mapfile parser (or your own) and report total bytes recovered, the recovered percentage, and the list of unreadable byte ranges with their starting sector numbers; (b) load the image read-only and attempt a normal logical recovery (Chapter 6) — note which files come back cleanly; (c) identify at least one file whose directory/MFT entry fell inside an unreadable region, recover the file body by carving — cross-reference Chapter 7: File Carving — and explain in two sentences why carving succeeds where the directory walk failed. Report your results in the format a client would understand: files fully recovered, partially recovered, and lost.
8.18 Judgment. Your ddrescue job is 40% complete when the drive begins dropping off the USB bus every few minutes — each disconnect accompanied by an audible spin-down/spin-up — and the OS keeps re-enumerating it as a brand-new device while the seeks grow louder. (a) What is physically happening? (b) What do you do right now? (c) What category of tool does this situation actually call for, and name two specific examples. (d) Quantify the cost of the tempting option, "just let ddrescue keep trying" — what are you spending, and on what?
Group E — Electronics, ROM, and the service area
The two families where the data is usually intact-but-locked-out — and where the gap between an amateur and a professional is the difference between a complete recovery and a bricked drive.
8.19 Explain why, on a modern drive, you cannot simply bolt on a "matching" donor PCB and expect it to work. Define adaptives, say where they physically live, and describe the two correct methods for moving them onto the donor board (one with a soldering/rework station, one with a programmer). What three symptoms does a board-swap-without-ROM-transfer typically produce, and — the subtle part — why do amateurs then go on to misdiagnose a perfectly healthy HDA as a head failure? (answer in Appendix)
8.20 A drive is silent, draws no current (or trips the power supply's over-current protection), and carries a faint burnt smell. (a) Which family is this, and what does the chapter call "the happiest diagnosis"? (b) Using the multimeter behavior below, identify which diode is the culprit and why a TVS diode is designed to fail this way:
Multimeter, diode/continuity mode, across each TVS diode:
TVS @ 12V rail: OPEN one way, ~0.52 V drop the other -> ?
TVS @ 5V rail: BEEPS / ~0 ohms BOTH directions -> ?
(c) Give the two fix options, easiest first, and state the trade-off of the easy one (what protection do you give up, and is that acceptable for a one-time imaging?).
8.21 Describe the Seagate 7200.11 "BSY" failure end to end: the symptom the user actually saw, the true cause inside the service area, and the fix — including the interface used, the voltage level, the typical baud rate, and what the issued commands accomplished. Then explain, in a sentence or two, why this single case is the chapter's strongest argument for the rule "never quote a clean-room price on a drive you have not actually diagnosed," and estimate how the cost of this repair compares to the head-swap a hasty tech might have quoted.
8.22 ⭐ List the structures that live in the service area — translator, P-list, G-list, firmware modules, SMART logs, adaptives — and say in one line what each does. Then defend the chapter's claim that service-area repair, despite its difficulty, has some of the highest success rates in the business. Use the phrase "repairing the index, not the medium," tie it explicitly to the book's first theme (deleted ≠ destroyed; the data is there, the pointer/translator is the problem), and explain why "high success rate" and "requires expert tools" are not contradictions here.
Group F — Clean rooms, mechanical work, and the DIY-vs-lab line
The family that requires opening the sealed HDA — and the bright line that, more than any other, separates a competent technician from a clean-room lab.
8.23 Put head fly-height in perspective: state the approximate fly-height of a modern head and the approximate sizes of a smoke particle, ordinary dust, and a human hair. Using those numbers, explain in one paragraph why the popular "open it in a steamy bathroom because humidity settles dust" advice is dangerous nonsense — address both the dust the bathroom fails to remove and the new problem the steam introduces. Name the ISO standard and class real labs work to, the older Federal Standard equivalent, and the practical piece of equipment that creates that clean zone over the open drive. (answer in Appendix)
8.24 What is a head comb, and why is it the essential tool of a head swap — what specific disaster does it prevent during head-stack removal and reinstallation? Explain why multi-platter and helium drives make head swaps "exponentially harder," referencing platter count, head-insertion geometry between tightly spaced platters, and what is released when a helium drive is opened. Finally, explain why "same model number" is necessary but not sufficient when selecting a donor, and name two things that must also match.
8.25 ⭐ Judgment — apply the framework. For each mini-scenario, decide DIY-reasonable or send to a lab, and give a one-line justification anchored on the chapter's two bright lines (the sealed-HDA line, and value × uncertainty): (a) a 4 TB external that is dead, untested outside its enclosure; (b) a clicking 2 TB drive holding a startup's only copy of its codebase; (c) a 500 GB drive with a confirmed shorted TVS diode and no other symptoms; (d) a healthy-sounding 1 TB Seagate detected as 0 capacity, where you own a serial adapter and have personally done this exact firmware fix before; (e) a degrading but still-imaging drive that you discover, mid-job, is BitLocker-encrypted with no recovery key on hand. For (e), explain why encryption changes the calculus even if the physical recovery would otherwise succeed.
8.26 Ethics. A sympathetic client cannot afford an $1,800 lab quote and asks you to "just try" a head swap on their only copy of irreplaceable data, explicitly accepting "whatever happens." Write the response you would give. Address (1) why this is not yours to gamble with even with their permission, (2) what you can honestly offer instead (referring out, imaging only the safe part, a payment-plan conversation with the lab), and (3) how theme six — the human cost — actually argues against attempting the swap rather than for it.
Group G — Economics, reporting, and the Progressive Project
The hardest skills in the chapter are not technical: deciding whether a recovery is worth it, defending that decision in writing, and telling a person the truth about their data.
8.27 Apply the chapter's recovery_decision logic to three cases. For each, compute the expected value where relevant and give the verdict (PROCEED / DON'T / MARGINAL / STOP) with the reasoning: (a) data_value $20,000, success_prob 0.85, quote $2,200, no backup; (b) the same numbers, but IT now confirms a 3-week-old offsite backup exists; (c) data_value $900, success_prob 0.6, quote $1,400, no backup. Then state the question that should always be asked first, before any of these numbers matter, and explain why an existing backup short-circuits the entire calculation. (answer in Appendix)
8.28 Write the report. For a civil eDiscovery matter, draft the two-to-three-sentence proportionality paragraph you would put in a declaration when responsive data sits on a mechanically failed drive that a qualified lab estimates at $2,500 to recover with uncertain success. Make it concrete and defensible: name the standard you are invoking (FRCP proportionality — see Chapter 25: The Legal Framework), cite the specific failure and the lab's assessment, and be explicit about what a party may not do — declare data "lost" without showing it made reasonable recovery efforts. Note where the supporting documentation would live in your case file.
8.29 ⭐ Progressive Project — the failed-media contingency memo. Write the one-page memo for your Forensic Case File that answers, in advance, the question every examiner eventually faces: what will I do if an evidence drive arrives physically failing? Cover all four required elements: (1) how you would diagnose the failure family without risking the data; (2) your decision criteria for in-house imaging (ddrescue / hardware imager) versus escalation to a forensic recovery lab; (3) the exact chain-of-custody steps for transferring evidence to and from that lab — sealing, forms, tracked transit, and the pre-agreed hashing and reporting protocol (cross-reference Appendix F: Chain-of-Custody and Report Templates); and (4) the exact report language you would use to document a PCB or head swap as a justified, necessary exception to "work only on a copy." File it alongside your acquisition notes.
8.30 Judgment and the human cost. A client's drive has confirmed scored platters; the lab's honest estimate is near-zero odds, and the drive holds the only photographs of a recently deceased parent, with no other copy anywhere. Script the conversation you would have. How do you state the odds without inflating false hope or implying the loss is trivial? What is the actual service you are providing when you advise them to stop spending money? And how do you pivot — gently, without being glib — to prevention (the 3-2-1 rule) so the next irreplaceable thing they own is never in this position?
Self-check. You have mastered this chapter when you can hear a drive and name its failure family, when your first instinct on a physical fault is to stop rather than retry, when you can image a degrader safely and account for every unreadable byte, and when you can tell a client honestly whether recovery is worth it — including when the answer is no. Hold onto the dual lens — the recovery engineer racing the hardware's remaining life, and the examiner preserving admissibility — because Chapter 9 carries it onto a medium with no heads to crash and no motor to seize, and a far stranger way of making deleted data truly gone.