Tuesday, 10 August 2010

Data Structure of Non-Standard Sector

Today, details in identification of a non-standard sectored device will be introduced.

In conventional storage systems, they are normally using a standard 512Byte sector unit to store user data. In order to achieve a lower BER (Bit Error Rate), addition CRC checksum is added after each 512Byte user data in high level storage systems. These addition bytes will ONLY be recognized by its RAID controller where the storage media is operating with. The RAID controller will eliminate the addition bytes before it passes the raw data to the operating system (Windows OS/Linux/etc.) from a non-standard sectored storage media. In another word, device users will not be able to tell if a non-standard sector scheme has been used or not in their systems. So as for data recovery companies, file systems will not be recognized by any recovery application if the hard drives from a non-standard sectored RAID controller are raw mounted under aliened computer.

As the figure shown below, 8 byte CRC checksum are attached to the end of each 512 byte user data, which results in data shifting after the sector 0. The DBR (DOS Boot Record) of NTFS file system (as content show beginning with “EB 52 90”) will be shifted to address offset 8 (as shown on the right in this example) instead of offset 0 where it is supposed to be (as shown on the left). As you can imagine, all the remaining content will be shifted accordingly. The shifting cycle is 64 times (=512/8). It means that you will see a standard sector of data without shifting every 64 blocks of 520 sectors.

Written by: Zijian Xie (R&D Manager, BEng, MSc)

No comments:

Post a Comment