Images, not copies
A file copy captures what an operating system is willing to show. An image captures the medium itself: every sector, including deleted files, boot code, unusual formats and the deliberate errors many publishers used as copy protection.
Lazarus keeps images. Files can always be extracted from an image later. The reverse is not true, and a medium that has been copied file by file and then thrown away cannot be imaged again.
Magnetic disks, at flux level
Floppy disks store data as changes in the direction of a magnetic field. An ordinary disk controller decodes those changes as it reads, and silently discards anything it does not expect. Lazarus reads disks with Mnemonic, its imaging tool, which records the raw changes themselves, so that decoding can be done afterwards in software, and done again if a better decoder comes along.
- Every disk is read at least twice, in two different drives.
- Weak tracks are read many times and the reads combined, so that a bit unreadable on any one pass can still be recovered.
- Heads are cleaned between disks, and drive alignment is checked every morning against reference disks.
- The first read is always kept, even when later reads are better. It is the closest record of the disk as it arrived.
Tape
Tape is the most fragile medium in the archive. Many tapes made between the 1970s and the 1990s use a binder that absorbs moisture over the years and turns sticky. Played in that state, a tape sheds its magnetic coating onto the heads and destroys itself. Affected tapes are baked at a low temperature for a day or more, which stabilizes the binder for a few weeks, and then read once, slowly, on a restored drive.
Data cassettes from home computers are handled differently. They are sampled as audio at high resolution and decoded in software, so that damaged blocks can be repaired by hand from the recorded waveform.
Hard drives and flash memory
- Every drive is connected through a write blocker, which makes it physically impossible for the recovery computer to change what is on it.
- A failing drive is imaged in passes: the healthy areas first and quickly, then the damaged areas slowly, so that a drive that dies part way through has already given up most of what it holds.
- Seized or crashed drives have their platters moved into matching donor drives on a clean bench.
- Flash media that no longer respond are read chip-off: the memory chip is removed and read directly.
- Phones and other encrypted devices are read only with the consent and credentials of their owner or estate. Lazarus does not bypass protection.
When nothing else works
A few carriers defeat every drive: disks with their coating half gone, tapes snapped in many places. For these, Lazarus works with a university physics laboratory that can map the magnetic field of a surface directly, using superconducting quantum interference (SQUID) microscopy.
It is slow, expensive and occasionally miraculous. Most of the time it recovers fragments. Sometimes fragments are all anyone needs: a name, a date, the last page of a manuscript.
Chips and cartridges
EPROMs and mask ROMs are read several times in a programmer. EPROMs lose charge over the decades, especially if the windows on top of them have been uncovered, so reads that differ are resolved bit by bit and any uncertain bits are recorded.
Game cartridges are read through their edge connectors after cleaning. Any battery-backed save memory is copied first, because the battery is usually the first thing to go.
Checking the result
Every image is given a SHA-256 checksum the moment it is made, compared with checksums published by the original distributor where they exist, and then mounted or run in emulation to confirm that it works. From then on it is looked after by the processes described in Fixity.