data recovery myths

August 15th, 2010

Here is a list of   data recovery myths

1. Place hard drive in freezer
This possibly is the most widely known and tried myth which often results in complete hard disk and drive destruction, let’s take a look at the reasons why.
Hard drives operate on extremely fine tolerances there are fly heights of the head stack assembly rotational alignment between platters and spindle position for eccentricity information from the spindle., if the hard drive is placed into the freezer all of those measurements will be destroyed, additionally to this there will be a degree of water after the hard disk returns to normal or ambient temperature, how could the drive deal with this? Simply put it can not and may short out the preamplifier and or PCB upon switch on, for sure there are anecdotal evidence on the Internet of successful recovery from such a technique, our advice is do NOT attempt this if you value your data.

2.Replace PCB
This old chestnut has been doing the rounds for may years yet still is taking unsuspecting people in as they try this out, often with no recovery or worse still cause further issues which complicate the recovery further>
Many computer users are simply not aware of the complexity of modern hard drives and what each part of the disk actually perform, the PCB for instance is unique to the hard drive it was manufactured with and can not simply be exchanged or swapped with another even if you think that you have the right revision  or firmware details as the PCB will not function correctly on the patient drive.
A ROM on the or flash storage devie will contain such details as the head map and other such type data pertaining to adaptive information of the storage device, so in short do not change the PCB.

3. Hit or drop the hard disk
Yes this really does happen! some clients actually hit the device to try and ‘coax’ the hard drive back into life, when you consider point 1 of this article you can see how dangerous this could be for the hard drive and your data, never drop or hit the media it will damage your drive further than it already is.

4.Format hard drive
This really is a shocking one, many users either voluntarily format there hard drive or follow the request to format the drive if there is some form of logical error and the system requests this, again do not format the hard rive it will not help.

5.Remove platters
This is a relatively new concept for end users and myths, basically the computer user will open the hard drive up and remove the platters to another working hard drive, this procedure is known in the industry as a platter swap and is very complex and requires a clean room and specialist equipment, and moreover is only required when the spindle is seized, many users have been observed attempting this for such issues as media which is not detected in the BIOS or clicking, media will not require platter swapping under these failure conditions.
Platter swapping requires a clean room environment and skilled engineers, equipment and techniques, NEVER remove the platters from your hard rive, as you will render your hard drive unrecoverable.

  • Share/Bookmark

Tags:
Posted in Data recovery cases | No Comments »

Data destruction data erasure data security

August 10th, 2010

It would seem that a week does not pass without a high level organization like the MoD reporting that data had been ‘lost’ in some way.

Can you imagine if you lost your business data and a competitor managed to get hold of it? (It has been reported the the ICO has increased the previous fine level 100 times from £5000 to £500,000 for loss of data in serious breaches),  Or that your personal data ended up for sale somewhere to the highest bidder?
Sadly it does happen but all these events and scenarious are avoidable if you are security minded and consious of your data.

Typically your data may end up in the wrong hands if you dispose of your computer system or hard drive with securely erasing it, in other words uoi data destruction or erasure services are applied, simply formatting the device WILL NOT delete your data and can be recovered relatively easily.

If you are a business then the IT department should have a system in place that can be utilised for end of life or asset management where the equipment will leave your premises for refurbishment or re sale.

As stated earlier simply formatting the hard drive will not suffice as the data will remain on the storage device, so what exactly is required?
There are a number of services available, some are paid for a some a free, perhaps on site or a third party the choice has to be broken down into security, costs and practicality.
If the data is to be securely wiped then a reputable system or piece of software must be used and allowed to complete with a understandable report outlining that the procedure was undertaken and completed, any errors must also be reported as this could be area of weakness and must be scrutinized later, do not simply allow this to pass as there still could be vital or important data remaining.>

Many systems utilize a specific pattern of overwrites, sounds very impressive but in reality it simply can mean that 00 or 11 is written to all sectors available to the user data area at that time, this overwriting is very secure and can NOT be recovered at all despite what you may hear of or read on the Internet that Mi5 or Mi6, FBI or similar can recover overwritten data, it is not possible.

The main weakness from the system is with the hard drive itself, (that is if a hard drive holds your data, other storage systems operate differently,) hard dives utilize a system of handling bad sectors, I am not talking about meta data $bad sectors that the file system may handle but actual real bad sectors which are locked away from the user under normal conditions such as the G-list or growing list, the area may contain data which is now locked away from the user and the erasure software can not access, it is theoretically possible that a well used hard drive which has been used to capacity over a period of years and now has a full G-list may contain documents or other such type data locked away, however still available to people with the right tools.

As far as we are aware no data destruction tools actually can deal with or take into effect this vital area and are leaving hard drives open to further examination by qualified trained professionals with the right type of equipment.

If you are at all concerned over data erasure or data destruction please contact us directly and we can advisie you of the safest course without comprising your data.

  • Share/Bookmark

Tags: , ,
Posted in Data recovery cases | No Comments »

Legacy old hard drive museum

August 9th, 2010

On searching through our vast stocks we discovered a very old hard drive, in fact it is from the 70′s which makes the hard disk fit for a museum of sorts so we thought a basic page on older hard disks should be made.

Here are a few pictures and specs on this old hard disk.

Please note the 3.5″, 2.5″ and 1.8″ hard drive which has a capacity of 60Gb!

Here are some of the physical dimensions of the very old hard drive;
The storage device is 53Cm long, 37Cm wide, and 13 Cm deep, it weighs a whopping 12.1 Kg, its total storage capacity is unknown at present but thought to be around <50Mb, this is 50 Mega Bytes or less!

When you upscale the storage capacity to 60 GB as per the microdrive you can see how fay hard drive storage has come in the last 30-40 years, a truly massive growth while reducing the footprint of the unit, can you imagine an MP3 or iTunes player with this? not exactly portable and would have just a few select songs, then you would also need an interface and a computer to connect with it, helps put in perspective what modern day electronics offer consumers, really staggering.

3.5″ media is now available in 3Tb capacity and 2.5 media in 750Gb and 1TB capacity, this storage does present some problems as all the technology tries to deal with older formats and emerging and new areas, Windows XP can have issues above 2.1 TB as it was not considered when the format was created many years ago, and with the above hard drive you can see where they were coming from.

I suppose that with new LLBA format and other areas of development I will stick my neck out now and say that surely we will never need single volume hard drives which exceed 140 petabytes, I mean how many tunes are there out there? Or ho many movies do you want to store?

  • Share/Bookmark

Tags: , ,
Posted in Data recovery cases | No Comments »

Wedding photo’s lost, professional photographer

August 7th, 2010

A professional photographer with many weddings dropped his external hard drive, which was a Seagate 1TB, obviously he was extremely concerned, as was the bride and groom whom also had potentially ‘lost’ their precious day from that days shoot.

Upon receiving the faulty hard disk it was diagnosed with spindle seizure and HSA damage, both of which are serious failures the recovery would be very complex and would require many hours clean room work and other engineering duties.

The hard drive was not spinning at the time so this did limit the failure to a degree, if the storage device had been spinning then the HSA may have caused further damage to the disk surfaces or platters, this is due to the fact the the platters spin at 7200 rpm and the heads fly at a operational height of less than 1 micron, so the vertical displacement of torque or G’s to the disk only has to be minimal for it to come into contact with the disk surface causing damage.

This failure type was dealt with in the clean room and several techniques were employed, firstly the platters were transplanted to another known good chassis, this procedure is very complex, time consuming and requires specialist equipment, many companies can fail with this procedure, and here is why.
All hard drives are ‘synchronised’ platter to platter, that is to sat the the servo wedges, tracks and other vital areas are calibarated at the factory at the point of manufacture so any ‘slipping’ or moving of the rotational alignment could and very often does render the disk unusable, and more impertinently your data will not be accessible.

Following the platter transplant to a good known chasis with a good working motor, the HSA is the next part to be replaced, this also is not an easy procdure, it requires skill and dedication to source the correct parts and then install them in the new hard drive build.

Following the clean room the drive is then checked via the com port or TTL rs232 to USB port for firmware diagnosis, here a report of the hard drive firmware is diagnosed, if there are any issue here they are corrected and the drive is then taken to the image and cloning area to to cloned to a reliable destination.

The final part of the recovery is the file system reconstruction to its native format and a folder and file list sent to the client, a random amount of .jg, .raw.,tiff., nef files were launched as to check their integrity, all of which worked with no issues at all.

During the various stages of recovery the photographer was emailed and phoned with regular updates as to the progress and current position of the recovery, as he was very anxious to resolve this quickly, this we achieved in 5 days, to his immense relief.

Our advice if you accidentally drop or knock a hard drive, particulalry if the drive is on at the time please do not repower the drive as this will cause further issues and may compound the recovery at worst it may destroy your data.

If you are wedding photographer ensure that you have more than one back up in the filed so if you are using a Nikon and a Canon camera and have a decent size CF card, also it would be wise where time permits to backup to your hard drive and some other form of device such as an SD card, USB memory stick or similar, that way you should have a form of backup if your main drive fails.

  • Share/Bookmark

Tags: , , , , , ,
Posted in Data recovery cases | 2 Comments »

Western Digital WD5000AAKS, AAJS, KS, YS, AAVS, AAKB hard drive & disks

August 6th, 2010

Western Digital hard drives and disks from the following families are routinely diagnosed and subsequently  recovered in our data recovery labs.

Wd5000AAKS, WD5000AAJS, WD5000AAJS, WD5000KS, Wd5000YS, Wd5000AAVS, and WD5000AAKB.( This list is not definitive)

Typical issues users report are clicking noises, usually there are three clicks then the hard drive will stop spinning and shutdown, if the disk is connected via a Windows PC the device manager might offer a brief ID of the storage device a WD 5000 with a strange serial number, not related to the device at all.
In this instance the firmware has shutdown the spindle after n=x times as per the firmware instruction code, and can be caused by a variety of issues from PCB (Rare, but possible), HSA (More likely) and or firmware based of critical modules in the S-A range and therefore critical not only to the operation of the disk but to access the user data area.

Many users of the drives mentioned above have reported that the hard drive was functioning correctly and flawlessly before it failed, there appears to be no reason as to the failure, so why now?

Hard drives do offer a basic form of protection in the form of S.M.A.R.T, but very often this is disabled in the motherboard BIOS, basically SMART will look at sector re-allocated counts and other such lists and then re post back to the user, vary often with a vague or ambiguous message.

If the WD hard drive clicks three times then stops, generally speaking this is an indication of HSA head stack failure, at this point do not switch the drive back on, you need to speak and contact a data recovery company such as our lab’s.

Another issue we have had reported is that the drive spins up and calibrates as normal with no unusual noises or clicking, the serial number is correct as is the family name ot model however it reports its size a 0MB, this would in dictate that there firmware issues with the SA or system area which are damaged or corrupted and require repair or replacement, again this failure type is not fixable by end users and no software available wikll scan, or try and repair this, please do not even attempt to repair, you need to speak with a data recovery lab for advice and help.

If after diagnosis at our lab it is determined that clean room work is required, often the HSA will need to be exchanged for a good working working unit, this is not a s easy as it sounds, and here is why.
All hard drives are unique to themselves as are the HSA, so to simply buy the HSA (which is not possible as manufactures do not sell HSA units) is not easy, lets look at an example;

Model: Western Digital WD5000AAJS
DC: HARCHV2CAB

The important part is the DCM: Tghis 10 digit code pertains the HSA and must be matched for a good donor hard drive to be of any use at all, try phoning around to locate a drive with those details, they will say yes, ok we have that drive model in stock now ask them about the DCM: code, they won’t have a clue as they do not take a note of this information, this is where specialist suppliers and dedicated people in locating spares come into their own and track down what is required.

So we have our new HSA and are in the clean room, just exchange the old heads for the new right?, wrong, the HSA on WD drives require very fine tuning, particularly around the head pivot and lid, even experienced data recovery technicians find this very difficult, however it is possible with the right methodology, knowledge and tools.

  • Share/Bookmark

Tags: , , , , , , , ,
Posted in Data recovery cases | 2 Comments »

Hard drive issues common problems not detected in BIOS

August 5th, 2010

Our labs have seen all types of hard drive and disk issues ranging from not detected in the bios to, clicking or noisy, formatted, data removed from the recycle bin, disk registers as an alias of the hard drive family, partition corruption, HPA issues, and virus type damage.

Here are a few problems and fixes;

1.  Hard drive not recognised
Check all leads, it sounds obvious but sometimes after a period of time connectors can break down for both the power and the data cable, whether it is PATA IDE or SATA interface, simply unplug and reconnect all connectors to and from the hard drive and to the motherboard, you would be surprised how many ‘failed’ hard drives will suddenly be re detected in the BIOS and up and running again.

2. Reset motherboard BIOS CMOS, typically there is a RTC BIOS battery and the motherboard may have spurious or incorrect data regarding the geometry of the hard drive, after resetting go back into the BIOS and try and re detect the hard drive.

3. Wrong PSU
Check that firstly you have used the correct power supply, then that the connector to the hard drive is properly seated, if the wrong PSU has been used, DO NOT switch the hard drive back on again as further damage may occur, this applies to external storage devices.

4. Drive requets to be formatted
DO NOT follow the request if your system states that the hard drive should be formatted, partition and or logical corruption has occured and must not be formatted as this will really compound the recovery, some systems offer a low level format this will completely destroy your data, even a unconditional format will seriously compromise your data, do not attempt or do this.

5. System restore
DO NOT follow a system restore if your system has crashed as often this will be a form a ‘ghost’ type image which will completely erase your data as it could go over the top of your important data.

6.DIY attempt at data recovery
Friends and family although well intentioned ‘may have a go’ at restring your data, this is not a good idea as often the recovery software is downloaded directly to the target drive with the important data, additionally no write protects to the user data area will typically be set up, this will cause complete overwriting and destruction of your data.

7.  Swap PCB or hard drive board
Many clients now actually attempt to swap or exchange the PCB or board of the hard drive for another one, even locating the firmware or revision details correctly in an attempt to access the drive and get their data back, this should not be attempted as this can cause further issues for any data recovery company at a later date.

8. Update or ‘flash firware’
Hard drives are not like mobile phones or similar electronic devices where updating or flashing the firmware will ure bugs or glitches, the firmware stored on a hard drive is unique to itself and locked away for good reason away from normal user access and requires techno or vendor specific commands, any updates you find may actually brick your drive.

Prevention
The old adage that prevention is better than cure really does apply here as adding a UPS Uninterruptible Power Supply and a hard drive cooling kit to the hard drive really will pay off in the long run as the computer and the storage device will be protected from power spikes and loss of power something to which many hard drives actually fail from.

  • Share/Bookmark

Tags: , , ,
Posted in Data recovery cases | 1 Comment »

Overvoltage power surge fried external hard drive and disks

August 3rd, 2010

Overvoltage or power surged hard drives and disks are seen weekly in our lab and are usually caused by a user accidentally connecting the wrong power adapter to the hard drive.
This situation can occur if the hard drive is of external design and there are many other type power leads and connectors in the same area, some power adapter look very similar almost identical and may even fit into the socket for the external hard drive.

Many users then call our labs for advice and help to rescue their data after their hard drive has suffered from this failure type, do not switch the unit back on after this has happened, many users do attempt ‘another try’ which will only compound the recovery further, switch off and unplug the disk immediately.

Hard drives usually have a TVS Transient Voltage Suppressor which does offer a degree of fail safe for over voltage issues, also there are various Zener diodes and inductor coils  which will attempt to ‘clamp’ and reduce wrong polarity and excess current.

The PCB or printed circuit board will now have to be examined for electronic failures in said components and other SMC passive and active components, do not attempt to swap or exchange the PCB on your hard drive, this will not work, if the protection circuit fails and the current is high enough the HSA Head Stack Assembly could also fail, this then places the hard drive into a completely different and more complex area of recovery as clean room work will be required.

Our lab receives many enquiries from users who say that they have fried their PCB and hard drive and are looking at a very badly burned board, the spindle and or VCM Voice Coil Motor such as a Smooth chip can also suffer from thermal runaway issues and fry, this is very common, and simply finding a replacement board will not help as adaptive data is help on the ROM or MCU which is specific or unique to your hard drive and will not help.

GMR giant Magneto resistive heads are extremely sensitive and can fail from such over voltage and current failure types, this simply is not a user area for anyone to be looking at unless they have clean room access, knowledge and experience of all manufactures and models, again each hard drive has it’s own specific code for this area which may be the DCM: or MLC: Drive Configuration Matrix or Machine Level Code, and due to thermal and the unique design characteristics of each hard drive is ‘tunes’ to itself and so therefore parts location has to exact, even then there are many issues to deal with such as alignment of heads and other such issues.

  • Share/Bookmark

Tags: , , , , ,
Posted in Data recovery cases | No Comments »

RAID 0, 1, 0+1, 5, 10 JBOD server data recovery

July 15th, 2010

Losing a server with a RAID configuration especially if you are a business with mission critical data or other such type of very important information will strike fear into the hearts of all responsible for data backup and preservation within the company, this situation is particularly embarrassing and potential litigious if the RAID or server contains backup Set’s of other clients data, in other words you are an online storage backup and management company, no worries you might think RAID is indestructible and never fails right?, Wrong, it does and often without any warning at all.

RAID Redundant Array of Independant disks has many configurations and permatations, lets take a brief look at some of the options;

RAID 0: This is not really a RAID in the classical view or description as there is absolutely no redundancy whatsoever, they data is striped in blocks across both disks from anything from 4k to 512k, although 64k is a common configuration, as the data is ‘split’ if one drive fails catastrophically so will your data set as only ‘half’ the data will be available on the working disk.

RAID 1: Data is written in an identical manner to both disks symotaneously and is classed as a mirror set.

RAID 5: Requiring 3 disks or more offer distributed parity across all disks if one disk fails it can be rebuilt from the remaining disks, this configuration is very popular as it offers a level of protection and some operating ead and write performance.

JBOD: Just a bunch of disks this is not a RAID configuration at all it simply is one large volume configuring all disks into one large system.

Let’s take a look at failures and causes of such to the server and storage setup.

External issues such as power fluctuations can seriously damage your hard drives, a very good preventative measure is a UPS uninterruptible power supply, this device will stop excess power from reaching your hard drive, also it will power the system in power outages, a truly excellent piece of kit for any computer user and modestly priced, especially when you consider the value of your data.

Heat from within the computer system can be a serious problem for hard disks as this can cause the hard drive to degrade, a simple but very effective hard drive cooling kit will keep the drive from over heating and keep the system operating a optimal performance.

I can not over emphasize the importance and need for the items mentioned above  as they require little time and resources to implement and are inconsequential in terms of the value of the data.

Failure of the RAID may be instant and without warning at best you may have a S.M.A.R.T. warning or a basic RAID offline or RAID degraded error, please do not attempt to rebuild the RAID as this will compromise the data at best and potentially destroy the data at worst.

Each hard drive should be professional diagnosed to operability and then cloned from LBA 0 to the end of the user data, this should be performed on all hard drives, including any physical work that may be requyired in a clean room environment for physical damage to the HSA.

Rebuilding the file system using a hex type editor will then be the final stage with folder and file structure this can and often is a very complex area, discovering the drive order, start drive, block size, file system and user data area start, it may be NTFS with MFT master file table, or Linux, Unix Mac type structure an experienced engineer will be able to reconstruct manually such data.

  • Share/Bookmark

Tags: , , , , ,
Posted in Data recovery cases | 1 Comment »

Toshiba hard drive clicking noisy 2.5 BIOS issues

July 14th, 2010

Toshiba brand of laptop 2.5″ media are often used by laptop and notebook manufacturers in their builds and make a very reliable form of data storage with decent performance in read and write tests.

Excessive heat within the laptop may cause issues with the disk surface or magnetic coating this will first exhibit itself as degraded media and many bad sectors appearing, perhaps the operating system will attempt to repair or mark as bad these sectors.

Another form of failure may be caused by a back EMF electro motive force, an excessive or wrong power supply which may cause an over voltage, ofcourse the hard drive has rudimentary protection in the form of a fue(s) or a TVS transient voltage suppressor, however they have a limited use and may allow excess currents to enter into the disk enclosure and damage the HSA head stack assembly, thus causing the clicking or strange noise heard from the hard drive.

In 0ver 90% of cases a noisy Toshiba laptop hard drive can be located to a failed HSA and will require the intervention of a clean room and skilled engineers to resolve the issues, it will most likely not be the PCB as some users may attempt to change without success.

The MCU on the PCB together with the firmware will allow the hard disk to spin up and then when it has reached the correct speed will release the HSA to seek out the servo wedges and tracks, if this can not be located in x time it will shutdown the hard drive to stop any further damage to the disk surface or disk.

Locating and matching the Toshiba HSA is not straight forward as the manufacture will not simply sell this component, it requires the location of the same model and head stack assembly and date match, this requires determined effort by trained and dedicated people and good contacts worldwide to supply the correct replacement HDD.

Replacing the HSA in no clean room conditions and without correct ESD precautions will destroy the good HSA and compromise or destroy any possible data on your failed hard drive as the HSA literally files over the platters using Bernoulli effect at less than 1 micron, dust and fingerprints represent massive obstacles for the HSA to deal with and thus will destroy it and further degrade and damage the disk surface further.

A head crash can occur when the HSA comes into direct contact with the disk surface at a place and time it should not, vertical damage like a dropped laptop , particularly when it is on can cause massive damage as it has less than 1 micron distance to impact into the platter, if this happens do not switch your laptop back on it will further damage it.

Some of the range within the Toshiba hard drive disks are;

MK GAS, MK MAT, MK GAT this is not a definitive list.

In the right hands and with the right tools Toshiba data recovery to 2.5″ media very often is a success so do not despair if you lose your important and precious data.

  • Share/Bookmark

Tags: , , ,
Posted in Data recovery cases | 2 Comments »

Dropped hard drive & disk

July 5th, 2010

A dropped hard drive or disk, particularly if it was running at the time can cause significant damage to platter surfaces and or the HSA head stack assembly as you would imagine.
Perhaps it was an external hard drive which was knocked over on the table? Worse still falling directly to the floor?
During R&D lab tests we have seen catastrophic failure to certain hard drives which are dropped from just 1″ while in operation.

Why does the hard drive become so damaged?
Spinning magnetic media operates at a typical rotation speed 7200 RPM (speeds vary on exact model) the HSA Head Stack Assembly literally files over the disk surface by the Bernoulli effect and has a distance of less than 1 micron, so any excessive  horizontal movement can cause impacts to the surface.

The term is ‘head crash’ and can strike fear into the hearts of any who have heard those words and have important data on the drive.

Do not on any circumstances open the hard drive, ‘just to have a look’, as some have tried as this will compound the recovery further.

In a class 10 clean room environment a full and professional diagnosis can be made and a clear process can be developed as to secure a successful recovery of data.

The HSA will often need replacement, and this is not as simple as it first starts, as hard drives are unique and require exact replacement parts to be fitted, and it is not simply a case of contact the manufacturer for parts, because they do not sell such parts, a replacement hard drive with the correct MLC machine level code or DCM drive configuration matrix, site code and or relevant dates are required, no mean feat I can tell you, and requires a full time position to track down such parts.

Following a dropped hard drive many users attempt to restart the drive, again this is not a wise move as further damage can occur, for those that have attempted to spin up the drive they may hear a beeping like noise, this could indicate that the spindle is now seized, and for a modern 1-2 tb disk this is a very serious and complex recovery as a procedure called a ‘platter swap’ is now required, and as the name suggests it involves moving the damaged ‘patient’ platters to a good working ‘donor’ which has a free working spindle, this procedure must preserve the rotational alignment of all disks and in some instances eccentricity issues must be catered for.

  • Share/Bookmark

Tags: , , ,
Posted in Data recovery cases | 1 Comment »

« Older Entries