Imaging Hard Drives with USB Interface
The data recovery industry is seeing more and more drives with a USB interface. As a result, imaging processes for unstable/degraded USB drives (especially those that have an onboard USB connector) are becoming a concern for many data recovery companies. Let’s look at all the factors that need to be taken into consideration from a data recovery perspective when dealing with such drives.
Why USB?
Hard drive vendors are moving more toward USB drives mainly because USB 3.0 provides a high data-transfer speed (in practice up to 400MB/s), which is sufficient to cover the maximum access speed of any modern hard drive (100-150MB/s range).
At the same time, USB offers many advantages over ATA for system builders:
It connects universally with any peripheral device (not just mass storage devices).
Power and data are provided in one connector.
Ports can be multiplied with hubs.
The same interface can be used in internal and external devices.
The device and its drivers are auto-identified by system software.
As of now (fall 2012), the market already offers a number of hard drive models with onboard USB 2.0/3.0 interface from Western Digital, Seagate, Samsung, and Toshiba. These drives are in fact SATA drives with a built-in USB-SATA bridge chip.
Current DR imaging processes for USB drives
While the number of USB drives on the market is increasing, the data recovery industry has rather limited control over imaging USB drives with media damage and/or read instability issues. The market of DR tools only offers imaging software, which clearly cannot handle these issues, because it relies on system software (BIOS/OS) to access the drive.
Lack of USB hardware imaging products forces DR companies to image USB drives by soldering a SATA interface onto the drive’s board (bypassing the USB-SATA bridge chip) and then imaging the drive using a SATA imager. The problem with this approach is that most drives that come for recovery, such as My Passport from Western Digital, have a USB-SATA bridge that encrypts data in real time, which means that data accessed and imaged on a SATA level is encrypted.
To decrypt data, the recovery process requires a second imaging/copying run, where the image acquired on the SATA level is accessed back through the original USB-SATA bridge chip. Clearly, such an imaging process is very time-consuming, requires imaging of the entire drive (does not allow imaging by files) and involves extra soldering work.
Also, this current approach is only a temporary solution, because it relies on the fact that the drive has a built-in USB-SATA bridge chip. Sooner or later, though, hard drive vendors will implement a native USB interface deployed within the MCU, therefore voiding SATA wires on the drive’s board at all. Such an onboard interface bridge design was always deployed during a transitional period while vendors moved from one interface to another. For example, early SATA drives were actually IDE drives with a built-in SATA-IDE bridge chip; all modern drives now have a native SATA interface implemented in the MCU.
Why imaging solutions for USB drives are more complex compared to SATA/IDE drives
Getting more data in a safer and faster way when imaging unstable/degraded drives can only be done when a hardware imager has a native support of the interface, which gives you the full advantage of its extra functionality and performance. In practice, an imaging product should work with the interface on a hardware level, bypassing system software, which usually requires building a proprietary hardware deploying this interface.
We have already touched on this subject for SATA drives in 4 Reasons Why Your Data Recovery Device Should Support SATA Native Functions. As with SATA drives, the most critical functionality for imaging USB drives is as follows:
To have full control of communication with the device starting from the Physical (PHY) layer up to the Application layer
To perform effective and timely device resets at any time so you can keep imaging the drive when it stops responding occasionally or when a read operation takes longer than expected
To achieve a drive’s maximum data transfer speed using smaller read blocks so that you localize bad areas on the drive as precisely as possible without losing good data in skipped areas and/or making extra wear to the drive
Unfortunately, implementing this functionality for USB drives is much more complex than for ATA drives. The major reason is the multi-layer stateful nature of the USB Mass Storage Device protocol, compared to one-layer stateless SATA/IDE protocols. In fact, full native communication to a USB Mass Storage Device, such as any USB hard drive, involves the following protocol layers: a) ATA over b) SCSI over c) Mass Storage Device Bulk-Only Transport Protocol over d) USB 2.0 or USB 3.0. Implementation of native support for a USB imager requires implementation of each of these protocols.
The situation is complicated by the fact that each USB connection is stateful. USB protocol incorporates multiple initialization stages – initializing a USB port, discovering and setting appropriate properties of a USB device, configuring endpoints, and so on. So almost any type of device reset (from a software reset to a drive repower) requires a lot of re-initialization to move the connection to an appropriate state on each protocol layer. All of this re-initialization work was not necessary for SATA/IDE drives.
The complexity of synchronizing communication states is actually the reason why system software (BIOS/OS) usually loses connection to a USB drive as soon as it encounters any temporary desynchronization of the state between the host and the device. In most of these cases, the only option to regain access to the device is to disconnect a USB drive from the system and reconnect it back so that the system software reinitializes the state of the connection. Obviously, this step is simply not an option for data recovery imaging processes, and therefore imaging software or any non-native USB hardware becomes much weaker in handling USB drives compared to ATA drives.
We would also like to add that because communication to USB drives incorporates so many protocol layers, it becomes practically impossible to implement a USB bridge, such as USB-to-IDE or USB-to-SATA adapter, that could work in data recovery imaging applications. In fact, you can find a number of such adapters on the market offered by different vendors, and none of them will actually work if you try connecting a USB hard drive to your ATA imager using such a USB-to-ATA adapter.
Another requirement of imaging USB drives is getting access to an ATA level and/or vendor-specific functionality that DR companies get used to while dealing with hard drives. This functionality includes imaging drives by read-write heads, disabling SMART or Read Look Ahead features, setting the drive to Sleep mode to perform a hot swap, and accessing other ATA level functions. This functionality is being used in the recovery processes of almost every modern hard drive nowadays, so lack of any of ATA level functions for USB drives would mean a loss of control over the imaging process, resulting in many unrecoverable cases.
New interface – new features
The USB interface also brings new features that a USB imager should be able to address. One of the most critical features introduced by USB drives that affects DR processes is an extra USB-level security system introduced by some vendors, such as WD SmartWare security. This security feature gives a user the ability to set an access password to a USB drive, which means that the imager should provide functionality to unlock the drive before the imaging starts, prompting for a user password. Unfortunately, such security protocols are vendor-specific, so their implementation requires more tune-ups to work properly compared to deploying any standardized protocol.
Another aspect of USB security systems such as WD SmartWare is that the drive creates a dedicated area at the end of its LBA space where it stores all of its security-related data. Access to this area, which usually takes up to 30-50 MB, is protected by the drive, so this data is not accessible via USB protocols. In fact, to hide this area, the drive reports a lower number of sectors via a USB connection, for example, from LBA0 up to the first LBA of the security data. Certainly, a USB imager should be able to overcome this limitation, giving access to the entire capacity of the drive, including the security area. This capability is especially important for cases that require recovery of corrupted security data and also from a computer forensics perspective. As one of the possible solutions, access to a hidden security data could be implemented using an ATA-over-USB protocol.
Another new feature of USB drives that is worth looking at from a DR perspective is the availability of an extensive USB-SCSI Error Messaging system. Such a high-level error reporting system lets a USB drive report extra diagnostics information, which definitely helps identify many issues while dealing with unstable or degraded drives.
Lack of reporting functionality was always a problem when dealing with ATA drives, so native USB imaging gives an advantage from this perspective. For example, when a read block timeout occurs during an ATA imaging, there is no information available about why the drive failed to return data for that block. During a USB imaging process, the drive may provide more information on why this failure happened. The drive may be busy with its internal background processes (for example, the drive is in the process of becoming ready), the drive may have a media/hardware error, or the data located in this block may be protected.
Good news!
Finally, after such a long time without a proper imaging solution for USB drives . . . the DR industry now has the first USB hardware imager implementing native USB support. The DeepSpar USB Add-on PCI-e board adds all of the features mentioned in this post to DeepSpar Disk Imager 4, once more extending the DeepSpar market-leading position as a provider of professional data recovery imaging solutions for the DR industry.
