[GRLUG] Disk scrubber

[Tim Schmidt]

On 7/25/06, Michael Mol <mikemol at gmail.com> wrote:
> Depends on the device.  The ability for a read/write head to read
> faint and overwritten signals is limited by the drive's circuitry and
> the drive's firmware.
>
> I know it's possible to access reallocated sectors on some drives,
> with the right instructions sent to the drive.  However, accessing
> overwritten data using the original read/write head and the drive's
> built-in circuitry would require a firmware upgrade, if it's possible
> at all.  The software Tim saw likely had access to the correct ioctls
> to read reallocated sectors.  It's less likely, but still possible,
> that it had the ability of changing the drive's firmware.
>
> I asked because I was curious as to the nature of the software.

I have no idea guys...  It was expensive (more than $500, license tied
to number of uses) commercial software purchased specifically for a
single client.  For all I know the software company producing it could
have agreements with the drive manufacturers to disclose special
registers or whatever to access extra drive features.

It didn't work 100%, but I was amazed at the time at just how much
information was recovered.

That said, modern drives are small embedded computers, with megabytes
of ram, high-performance DSPs, and plenty of programmable hardware.
In theory at least, there's nothing stopping WD or Seagate from
including a backdoor of sorts that allows analogue access to the drive
platter.  Given the cooperation of color laser printer manufacturers
with the US Gov, as well as the telecoms, and the banks...  why not
the drive OEMs?

--tim