There is of course an exchange of air. The inside of a HDD is not hermetically sealed but since the drive was not lying in water there is a great chance that no water went inside.
However, if you start messing with the platters and misalign them just the slightest there is no chance of a successful data-recovery.
Organize such a drive to get a "fresh" pcb. Depending on how wet it got you could even open it (extremely carefully) and see if there is any water inside. If so, I do not really see great chances of recovery. If not you may risk starting it up with the new pcb.
But for all this you need a clean environment and be sure of every step you take. Not just blind-guessing and seeing what happens.
I've done full images of water logged disks, even disks immersed in the sea for weeks and corral growing on them! …all you have to do is let it dry out, literally. Stick it on a mild heated-radiator for a few weeks. It will work like new…some times…and save you £2,000 in the process 😉
L
Guys, I don't want to offend anybody personally here, but some of your attitudes towards repairing HDD's are amateur at best.
We are talking on a forensic forum here, so I must assume that we are talking about a drive that may have evidential value.
A simple PCB swap will not work on most modern drives. They now contain adaptive data and this data must be transferred to a new PCB in order to work.
Taking a drive apart is the worst thing you can do unless you have the experience, equipment and cleanroom facilities. The suggestion to remove the platters and dry them is outrageous. Moving platters, even by a fraction of an inch will render your data unrecoverable. Platter alignment is extremely important.
We have worked on a large number of water and fire damaged drives and most of them are unrecoverable due to attempts by the customer to DIY them or else they have serious platter damage.
If the data is important, don't screw with the drive. Data Recovery is expensive for a reason.
I disagree a bit, As long as you keep the original SIM chip and a few other bits and bobs from the original PCB, a PCB swap is quite simple as long as you have a solder Irons and the PCB replacement is a exact match (Firmware, model, SN and Date code). Sometimes you don't need to salder the SIM chip if you match all the above.
Taking out the platters is a bit more complex and I wouldn't advice it without a lot of practice first, even then at best its %60 success rate on average, bit higher with newer drives. Wouldn't advice messing with the platter unless you really know what your doing.
Again what I said above, the best thing for you to do is put it on a warmish heater, or use a hair dryer. You can completely soak the platter, let it dry and it works fine(don't ask!) I've done it many a time )
Maybe I am an amateur by your standards, but I have swapped PCBs in drives, and I have moved platters, both successfully.
As you said, this is a forensic forum, so most of us understand the gotchas of these procedures.
The "old" way to recover any electric/electronic device immersed in "dirty" water, let's say fallen overboard in the sea is/was
Immerse the thing in distilled water, possibly moving it a bit, so that distilled water "washes" any salt or contaminant.
Repeat if needed until the distilled water is not anymore polluted by the whatever was in the "dirty" water.
Disassemble the parts that can be disassembled "easily", do what is needed to take the most of the distilled water out of the thing.
In the case of a hard disk, since you are NOT going to mess with the platter, it is safe without any clean room, to losen a bit the cover with the drive placed vertically in order to let the water come out.
A poorman's clean room is an acquarium with a glass over it and two holes for your hands on two sides, with such an arrangement it is safe enough to carefully remove completely the cover of the HD, and check that no water is in it.
Put the thingy in an oven/dryer at 40 to 50 C, turn it around often, so that remaining water has a chance to evaporate.
Unless the thingy was ON when wet by the water or switched on after being wet, there are very scarcce possibilities that the PCB will be fried and that a transplant is needed.
jaclaz
I disagree a bit, As long as you keep the original SIM chip and a few other bits and bobs from the original PCB, a PCB swap is quite simple as long as you have a solder Irons and the PCB replacement is a exact match (Firmware, model, SN and Date code). Sometimes you don't need to salder the SIM chip if you match all the above.
@lmlewis What do you mean by SIM chip? I trust you mean NVRAM or ROM? You will find that this will not work on a significant number of newer drives, where adaptive data is embedded within the MCU. Take a Toshiba drive, you can swap PCB's til you are blue in the face and it will not work. Adaptive data is embedded within a BGA (Ball Grid Array) chip and this requires serious kit to transplant. If you are to do this properly, you need infra-red and x-ray equipment.
@jaclaz What is the point of using an aquarium as a cleanroom, if it contains air that's not clean? )
As I originally said, I don't want to offend. I'm merely making the point that this is advanced work which should not be DIY'ed if the data is important. The danger of a thread like this is that somebody may be prompted to attempt recovery of a drive when they do not understand the risks of the task ahead. I've seen too many screws ups in the past and most of them are caused by those who have some knowledge of drives, but not enough.
The issue with the new Toshibi disks can be done by using using Software, I cant recall what I used but there was specialist software which would combat this issue with new drives….But it still required some of the original chips. In ref to what chips to swap, it depends on what disk it is.
I use to swap the most ridiculously sized chips with a magnifier and Tweezers…and that was in a respectable large data recovery firm ;), Infra-red and x-ray? sounds a bit overkill, would be interested to know how that works though.
I also do not think keeping them in the liquid will retard oxidation, unless it is completely submerged and every air bubble is out.
We handled some drives coming out of NOLA after Katrina. The reason for keeping them wet is so that you can clean the platters/heads before they dry and whatever is in the water precipitates out onto them. I don't think that oxidation is really a concern for such a short period of time.
The real issue, as noted by someone else, is that you don't want to simply dry and spin up the drive if you are interested in preserving it, forensically. Sure, it might work, and I'll go so far as to say that it would probably work. But if you are wrong and there is something else besides water in there, you can be in big trouble.
You don't want to go into court and be asked "How many of these have you done, before?"
Well…
From what I can see, there is no ONE way to proceed in these situations…
So if I get this right, those are solutions sorted from best to worst
- Keep it in water and send it to a data recovery facility.
- Open up the cover and use a dryer to dry the platters/heads.
- Let it dry without opening the cover.
- Transplanting the platters to a new drive.
I don't know about you guys but in my experience, I've never seen a police officer seizing an electronic device and bringing it to us in the lab in a water filled container because it's been in contact with such water… So even though the first option is theorically ideal, I don't see it happening very often in real life.
As far as preserving the drive as evidence, I saw a presentation at Defcon 2007 from a data recovery specialist who said that your primary objective when doing a physical drive recovery should be to get an image. After that, you can always explain to the court that the hard drive has been in serious contact with water and the physical evidence is not working anymore.
What are your opinions on that?
I believe it is acceptable (however not the best) to do whatever is needed ASAP to get an image of the drive and then, if needed, going to court and explain what happened and why the drive is not working anymore.