how was data recovery and forensics done in 70,80 and 90? - Page 1
Forum section: electronics / general

author: aqarwaen
author_rank: Regular Contributor
timestamp: April 25, 2020, 10:19:55 pm
content: what kind hardware and software, was used to recover data and do data forensics?did any kind dedicated software or hardware existed,what could recover data or do forensics research like we currently have in modem day.was it even possible to recover data from hdd,like one dave made teardown video?

author: Halcyon
author_rank: Unknown
timestamp: April 27, 2020, 03:24:55 am
content: Digital Forensics is a fairly new concept that really started to take off in the late 1990's and 2000's.Even today, some of the hardware used is highly specialised and very expensive. Back then, in its infancy, it was mostly reserved for the larger labs if it was anything beyond imaging a disk and working with file system constructs to recover data.Any meaningful data recovery these days is getting harder with even increasing data densities and built-in encryption, but like anything, it depends on the device.

author: Francis Vaughan
author_rank: Newbie
timestamp: May 03, 2020, 03:30:51 pm
content: Data recovery, whether for forensic or other purposes has been around since man was herding bits. It has just got harder and harder as time has gone on. There was a time when you could literally see the bits on a disk or a tape. If you have seen magnetic imaging film, that stuff laid over tape or a disk could image the individual bits. A disk drive was as large as a top loading washing machine, and held a disk pack with 11 platters, giving 21 surfaces (the bottom surface of the bottom platter was usually formatted for timing and servo control and didn't hold data.) Such a disk held maybe 300Mbyes. The disk drive had no smarts in at at all. It held the head amplifiers and servo system to position the heads. Actual operation of the dive was managed by the main computer processor (or in the case of really big machines, by dedicated IO processors that lived in separate cabinets.) The point is that given a disk pack, everything was on a very agricultural scale. The disk format was simple - there were a fixed number of sectors per track, and the format was as simple as one could wish for. A damaged disk could be cleaned and mounted and analysed. You could dump the bits, and reassemble the data. The file system format were simple.As time progressed disks got smaller, but the technology got smarter. It used to be that the operating system managed bad blocks. So you could find the bad block mapping tables on the disk in a known place. The as disks got dedicated controllers that information disappeared into the controller. Same with information controlling operational parameters. There was a big change in the move to SCSI disks. Disks used to be managed by the OS, and the file system in the OS would know exactly where on the disk pack every file system block, as a triple: surface, track, sector. SCSI only let you have a block number. This freed the disk manufacturer allowing them to lay out the disk however they felt. From here on in, disks became a black box. There were jealously guarded proprietary algorithms for optimising disk operation, and these could include layout of data on the disk. So it was only possible to read data of the disk with the manufacturers own code. It was no longer possible to treat the platter as a big recording surface and read it with your won specialised equpiment. Worse, things could change between revisions, so it became impossible to even move a disk platter from one drive to another - you had to have the same software revision. Then as more operational data was held in the drive controller, it became necessary to move the eeprom from a failed drive to a new controller.But nothing is impossible. Throw enough money at the problem and it is solvable. I once had a disk recovered in the 90's. Only the controller had failed, but it cost $8,000 (after discount) to get the data back. Speaking to the guy at the recovery company, he said that was a cheap and easy recovery. They had multi-hundred thousand dollar jobs. And jobs where an armed guard stood at the door 7x24 until the data was recovered. Fires were the hardest. But it was possible to recover submerged disks. What mattered was whether the disk was active or not when things went bad. A head crash was always bad. But even then, a lot of data could be recovered. Where things got grim was reconstructing the data from the fractured mess.But, tl;dr - data recovery and forensic has simply gotten ever harder, from reasonably simple beginnings to one where heroic measures are needed if the problem is not fixable with a simple transplant.The disk Dave did a teardown on was in the middle of development of disks. It had its own controller, but still delivered a platter, track, sector, interface to the computer OS. It would have been a trivial forensic subject. (I think it was a Fujitsu Eagle. I have one in my garage somewhere.)

author: Syntax Error
author_rank: Frequent Contributor
timestamp: May 03, 2020, 08:17:21 pm
content: Professional digital forensic labs maintain vast legacy libraries of hard drives from most disk manufacturers going back decades. These are used as donor mechanisms to access target platters.

author: westfw
author_rank: Super Contributor
timestamp: May 25, 2020, 09:07:23 pm
content: Tops20 (a 36bit mainframe) had a "FILDDT" utility approximately similar to their famous DDT debugger, except that it could access the raw filesystem and/or running operating system. You could "fix" disks by patching their descriptor blocks and/or directory entries, or patch the running OS while users were on...But most "recovery" consisted of going to the meticulously kept backups. Every night an "incremental" backup, every weekend a "full" backup (you could use a relatively low-paid "computer operator" for it. At schools, usually a student making minimum wage, maybe "work study.")

author: RoGeorge
author_rank: Super Contributor
timestamp: May 25, 2020, 10:39:25 pm
content: Good ol' days, when disk drive heads were made to read the space between tracks, in order to recover overwritten sectors...

author: Bud
author_rank: Super Contributor
timestamp: May 28, 2020, 04:58:59 am
content: DiskEdit was a powerful software tool for IBM compatible computers to view and manipulate partitions and data on FAT drives. Used it in early 90s.

author: james_s
author_rank: Super Contributor
timestamp: May 28, 2020, 07:14:54 am
content: I remember using Norton Utilities back in the late 80s or early 90s very successfully to recover data from quite a few damaged floppy and hard drives. It may sound ridiculous looking at more recent Norton products but in the early days they were really quite good.

author: Bud
author_rank: Super Contributor
timestamp: May 30, 2020, 03:15:04 am
content: Yes, there was also a great book by Peter Norton containing techical bonanza of description of PC hardware and low level software, cant remember the book title though... Nothing left from Norton by now, they just having a ride on his name. I bet young players have no idea who Norton was.

author: fordem
author_rank: Regular Contributor
timestamp: July 02, 2020, 01:32:49 am
content: Back in the 70's & 80's I worked with NCR corp and the disks of that era were made by CDC (Control Data Corp), 14" platters holding 5 megabytes of data, the Hawk disk was one 5 meg platter fixed, one removable, the Falcon disk was two 5 meg platters both fixed. These were units that we would disassemble and change heads or platters are required, head alignment with a scope was a requirement after replacement of either a head or a platter (the heads had to be removed to get the platters out) and the alignment was critical on the drives with removable platters or there would be problems with interchangeability of the removable cartridge between different disk units, but a good tech could "mis-align" the heads when necessary to read a removable cartridge that had been written on a unit that was out of spec.The techs had tools that the system analysts & programmers were not given access to, tools that would allow any sector to be read or written regardless of what was stored in that sector - tools to be used with great caution as they would allow a single bit in a sector to be changed, if you changed a bit, you had to manually calculate the CRC check and write that to disk or the operating system would detect the error and report it, I used it to "un-delete" files, but in the wrong hands it was capable of much more, numbers could be changed with no audit trail to show how/when the change was made.In the 80's & 90's, it was possible to open up the 5.25 disks from IBM compatibles and swap stuff around, Norton Utilities diskedit allowed you to read & write raw data (it calculated the CRCs and wrote them for you, but as disk capacities increased and physical reduced this sort of work became the domain of specialists with cleanrooms and I don't think I've opened a disk in a couple of decades. Some of the specialists (Ontrack Data Systems for example) made their software tools available to the public, for a fee of course, and I still have on the shelf here a copy of their Net-Utils for Novell Networks that was purchase specifically to allow me to get into a Novell server at one of our goverment agencies.