Recovering with the RapidSpar and Configuration Options

Recovering with the RapidSpar

The process is fairly simple to get going. Attach your source and target drives (target must be equal to or larger than the source), connect power, and (optionally) connect to the host system via USB. The RapidSpar will appear as a storage device and you will see the contents of the internal SSD.

rsaSetup.exe can be found on the RapidSpar drive or can be downloaded from DeepSpar. This tool is a one stop shop for installing RapidSpar Assistant onto the host as well as downloading and performing firmware updates to the RapidSpar itself. Updates to everything associated with this tool has been quick and painless every time I have attempted it. Firmware updating is also a relatively safe evolution as the RapidSpar ‘firmware’ simply consists of files stored on its internal SSD.

This drive was part of a RAID, so no partitions or file systems were found and Targeted Recovery can not be utilized. Still, RSA / RapidNebula is useful for loading optimal configuration prior to fully imaging the source drive.

RapidSpar Assistant (RSA) connects to the RapidSpar upon launch. Here you can get your project going. The rough process is as follows:

‘Connect’ (first icon) if necessary. You may need to power on the source drive by pressing the ‘Power’ icon on the upper right of the RapidSpar display.

‘New’ (fourth icon) – You may be prompted to start a new project if one has not yet been started for this source drive. You’ll have a choice of sector-by-sector image or imaging to a file on the target drive, which will appear on the RapidSpar display.

‘RapidNebula Diagnosis’ (second icon) – Prompts for some basic drive info and then reaches out to RapidNebula to obtain optimal recovery settings for the source drive. Other drive parameters are also evaluated during this stage, such as firmware and head health.

‘Firmware Repair and Optimization’ (third icon) – Enables multiple stages / risks of firmware repair. This only needs to be used when firmware issues are suspected. ‘Easy’ fixes only make changes to RAM that are wiped the next time the drive power is cycled, but more permanent changes can be performed in bad cases. The original firmware is backed up to the RapidSpar / RapidNebula prior to making any such changes, so they can be rolled back and/or used by more professional services if this particular recovery goes outside of the capabilities of this device. RapidNebula maintains an archive of known-good firmware and is able to provide them via RSA.

Once you’ve gone through the applicable steps above, you’re ready to start recovering. If partitions were detected, they will appear on the left pane and can be double clicked to read the file system into memory. RSA coordinates with the RapidSpar to simultaneously read and image only the sectors necessary to complete this task. No writing takes place during this or any other part of the recovery process, and the RapidSpar maintains a bitmap of sectors successfully read from the source drive. Subsequent reads of those same sectors will come from the cloned copy of that sector on the target drive, meaning you will only ever read each individual sector from the source drive *once*.

If a file system was detected and selected, you can then search for the files you want to recover (or just select all, but you should go for the more important files first), right click the root, and choose ‘recover selected’. RSA will once again coordinate with the RapidSpar to image only the sectors related to the chosen files. Once complete, you may right click again and choose ‘copy selected’, which will prompt for a destination on the host system (where RSA is running). You can go straight to the second option if you know exactly what you are going for and just need the files off of the drive quickly, but the RapidSpar will still transparently image those sectors as they are copied. Once you’ve got everything you need, well, you’re done! If there were files skipped due to errors you can reattempt those with different options (more on that below).

Configuration Options

Source Drive Options:

Here you can choose to generate a recovery report. Additional options become available if you opted for and unlocked the Data Acquisition add-on feature set. These include various mounting options which allow the RapidSpar to be seen by other logical data recovery tools. The unit will still clone all successful reads to the target (and repeated reads come from the target not the source) even in this mode.

Target Drive Options:

Here you can get disk info for the target drive, perform a write test, wipe the drive (write zeroes), or security erase (changes drive crypto key to perform a more complete wipe, but without feedback on progress). Wiping the target is not required when switching projects, since the RapidSpar makes a new volume bitmap and configuration data set for each new recovery. The only time you’d need a completely clean target is if you were fully imaging a source disk and doing more advanced slack space analysis or RAID-related full disk recoveries.

Imaging Options:

The default here is ‘balanced’, which first attempts relatively large reads, but then reverts to smaller reads if a large read fails. It will drill all the way down to single sector retries, but will skip after that retry fails.

Skip bad blocks will jump ahead by ~256 sectors on each failed read. This is handy for quickly skipping past bad areas in search of good ones.

Dig bad blocks does whatever it can to get bad sectors back, which for modern hard drives means longer read / reset timeouts. Bypassing ECC doesn’t work for most modern drives, so the RapidSpar team have opted to no longer default to statistical analysis of sectors read ignoring ECC. Even if the default was set to balanced, the more sensitive/vital read operations initiated by RSA (such as reading file system metadata) may briefly shift the RapidSpar into this mode in an attempt to obtain as much good data as possible from these critical areas.

One final note. While RapidNebula diagnosis should be performed on each new project, you can use the RapidSpar as a completely standalone imager for an entire project. You won’t have optimal drive-specific settings, but their defaults are good enough to work in a pinch where you just needed to fully image a drive in the field. You won’t be able to perform a targeted recovery unless you have a connected PC, but it’s still better than nothing.

« PreviousNext »