All posts from data recovery

July 29th, 2008

Hard drive & disk password security - unlocking advice & help

Securing your critical, sensitive or precious data is very important and necessary in the current computer climate with such threats as malware, spy ware, virus or other malicious code s such as root kits not to mention the portable nature of laptop and notebook computer systems which can left in areas where unscrupulous and criminal hands may gain access even for a temporary opportunist time and copy your data out of your laptop to a USB pen drive or similar in minutes.
If the laptop is stolen then there is obviously no time restriction to gain access to your user data area and methods can be employed to either brute force or dictionary attack passwords, at least this is true for most operating systems and applications.

Hard drives have the capacity for higher security levels password stored directly on the platters outside of the user data area , which is beyond the access of ordinary means, these are set up and controlled by ATA commands.
There are some drawbacks to this little used security for instance an ex employee may leave the company without revealing the hard drive password either because they simply felt disgruntled or forgot to pass this information on to the IT department thus leaving a headache for the technicians who need to pass the data on to new employees.
Another point is that occasionally the hard disk may suffer from a issue where the ATA modules become corrupt thus invoking a ‘artificial or phantom’ password which then locks the drive from the user.
Typical messages of the hard drive will be hard drive is security locked, Freeze locked, password locked.

Our labs can remove these passwords with sophisticated equipment, tools and experience and allow access to the required user data area.

Methods to recover hard drive passwords do not use such ideas as ‘master password’ or ‘backdoor password’ in fact the method employed is a hardware and software solution which often will erase the sector(s) of the password or repair any damaged modules pertaining to the ATA password area.
Specialist ATA command sets, protocol, ports and registers are set up to gain access to this area.

BIOS passwords are stored directly on the motherboard and are completely different to hard drive passwords and require a different methodology and should not be confused which can happen this is particularly the case as to setup a hard drive password you must enter the BIOS and enter the hard drive password section, which is different from the BIOS password area of the system.
BIOS passwords are generally much easier to get around however it is worth setting this up in addition to all other passwords if the data is particularly sensitive.

If you are an IT department and have not employed the hard drive password system it is worth your while doing an audit for all systems and rolling out this system, this is especially so for any portable computer systems as should the worst happen and the notebook fall into the wrong hands you have some comfort that the data has that added level of protection.

Next we look at operating system and application passwords.

Microsoft Vista has Bit locker offers strong encryption and is also worth setting up and enabling, Apple Mac systems often employ 256 bit AES advanced encryption system which also offers strong protection.

3rd party encryption software can also be of great use for ‘on the fly’ dynamic encryption and further compound a solid structure of security defence to your data.

• Posted in data recovery
July 28th, 2008

Data Recovery partner programme

IT, computer repair shops and existing data recovery companies are the first port of call so to speak for most computer users who have suffered from data loss and now require services to retrieve that important data.

Deleted or similar types of failure can usually be dealt with via their own software and engineers, however when the failure type is more severe such as a physical failure type or the drive is clicking, noisy or making unusual noises then more specialist help is required.

Our data recovery partner programme can help you if you need to take the recovery to the next level without having to invest in the resources and time.

For every successful recovery completed on your behalf a commission payment will be made directly to your company.

Our engineers have vast stocks of components, hard drives and the experience to recover from a ll types of failed media such as hard drive and disks, USM flash NAND devices, DVD the list is endless.

A no data no fee policy applies to all work undertaken and a recoverable file listing is emailed before any committal is required from the client thus assuring that the critical data has been recovered before you choose to proceed.

Our labs offer this service to existing data recovery firms which may have a particularly difficult failure type or may not be able to source the required parts to take the recovery to the next stage, as our stocks of hard drive media are vast and contain literally thousands of parts and donor hard drives required.

Commission payments start at 20% for a certain volume of jobs received per month and rise to 30% for 20 jobs completed per month on your behalf.

Unrecoverable data may actually be recoverable via our advanced systems and knowledge such as HSA replacement and PCB work.

• Posted in data recovery
July 5th, 2008

Clicking and noisy hard drives explained

During normal operation and from model to model some hard drive noises can be heard either when the disk is being accessed or sometimes even when the drive appears to be idle, these are normal and in line with operational performance of the hard drive.
Loud repetitive clicking, ticking, scratchy or rhythmic noises from the hard drive usually are an indication of imminent or actual failure of the hard drive which should be switched off immediately.

What is causing the noise?
Two components make up for the noise heard from the hard drive first there is the spindle motor and bearings which these days employ fluid dynamic bearings (FDB) which reduce noise considerable then there is the head stack assembly (HSA) which is driven by the voice coil motor (VCM) it is this components that creates the knocking, clicking or noise from the disk.
When the disk is powered on the spindle motor starts up the platters reach there designated speed such as 7200 RPM then the VCM releases the HSA to scan the platter surface and look for specific areas of the surface such as servo wedges and marks, tracks, calibration data and other unique data for that particular drive.
Surface damage can impede the location of these vital areas thus causing the HSA to repeatable look for those signals thus creating the repetitive clicking noise from the drive, the HSA may also be damaged which can be broken down into two main areas such as the actual heads and the preamplifier section, again if these are damaged no signal is being returned to the printed circuit board (PCB) and will cause a temporary loop to occur, of course the firmware and CPU on the PCB will allow for X number of retries before timing out and returning the HSA to the park position.

Firmware damage can also cause this failure type such as noisy or clicking and is caused because even thought the media surface is alright and the HSA operational the specific data for the drive can not be found and cause suspected physical damage this section requires specialist tools and knowledge and can easily be mistaken for issues mentioned in the previous paragraph.

What are the specific causes?

Specific causes to noisy hard drive storage media are broken down to internal and external influences.
We have discussed HSA failure briefly however this can be broken down into actual specifics such electrical over voltage entering into the HSA, excessive heat damage to the HSA, and the finite and mean time between failure (MTBF) with the start stop and hours breaking the HSA physically down.
Surface breakdown the magnetic properties of the media due to entropy and heat related issues.

How can the data be recovered?
Noisy hard drive Media rarely can be dealt with by home users in fact many IT departments do not have the required tools and knowledge to recover data with such failure types and certainly if the storage devices has valuable data then it should be handled by any other company than a professional data recovery company.
Software solutions will not help and in many situations will actually destroy the data as leaving the drive running in this format will compound or destroy your data surfaces.

Professional data recovery services.

In most circumstances a professional data recovery company will recover your required data using specialist tools, equipment and knowledge which might include replacing failed compo nets such as the HSA which is not as easy as it might sound as for instance there are many different permutations for HSA from model to model and even though a n identical model of drive is located to used as a donor drive for the failed components the actual HSA may differ considerably and must be matched exactly the procedure will fail.
Firmware revisions also can change on a day to day basis and from factory to factory again precise information and matching must be adhered to if a successful recovery is to effected and the required data recovered.
The cost of this type of service must be weighed against the value of the data if it is sentimental data then that is difficult to quantify, however when it comes to business data that is a much easier scenario, how much is the loss of accounts data say from the last year from a clicking or crashed hard drive? Only the company would know this but this can easily derived from what if any paper trail you may have, and the size of the business.

• Posted in data recovery
July 4th, 2008

What exactly is data recovery?

Data recovery is a process of reconnecting computer users with their data by extraordinary means.

Data loss occurs when the computer operator is unable to find, locate or connect with their data by ordinary means even though their data may be on the media.
Simple data loss is when a user accidentally deletes a file in this instance with many operating systems such as Microsoft and Apple systems the data can be ‘retrieved’ by reversing the action the file system is informed to keep that file or folder do not mark it as empty space thus the file will not be deleted.
What happens when the user deletes from the trash area or recycle bin or similar?
The computer data now appears to totally lost as the computer system has no means to access this data any more, so a different approach and tools will be required.
The file is now in ‘limbo’ for want of a better description it is neither permanently deleted or accessible to the operating system any further, moreover it is in jeopardy of being overwritten so if the file is of importance then you must immediately shut the computer system down, this will negate the chances of the file being overwritten.
The media must be removed then and installed to a computer system which has a write blocker which will inhibit any writes from taking place to the user data area as the operating system will try and write $meta data at least to the volume which could destroy your data, following the write blocker attachment the hard drive should be examined via a hexadecimal editor which will help the user locate the $MFT master file table with location of file.

If the data has any value to you and you are concerned about losing it then you must consider your actions carefully as unless you exactly know the above procedure you may overwrite and thus destroy your files so a professional data recovery company is a serious consideration.

Computer virus’s are now numbering in the 100,000 + mark and another type of data loss situation maliciously designed with intent to destroy, overwrite or effect the logical integrity of the file these have been designed to destroy data in many instances up to date complete protection is required such as anti virus, anti spyware & malware and the relatively new root kit bugs, but all of this is of no use if it is not updated and system scan regularly.

Heat related issues are the no.1 killer of hard drive and the data they hold, hard drive cooling kits can prevent thermal issues impacting the operational performance of your hard disk and are readily available.

Probably the term head crash has been heard by many computer users and it has to be said is not always a qualified statement of fact.
Unusual noises emanating from the disk enclosure such as clicking and ticking noised do not automatically mean that a head crash has occurred in fact that noise can be from a number of failures such as head failure, preamplifier failure, servo fields and address markers not found, and firmware issues within the drive itself.
A head crash is when the heads come into direct contact with the surface of the platter(s) in an area and time they should not as some hard disks rest the head arrangement on the inside diameter of the disk when the drive is parked however if the heads come into contact with the surface elsewhere within the drive they may cause the condition of a head crash and score and damage the platter(s).
This type of failure can be catastrophic but depending on the company, tools and experience there may be a possibility of a recovery.

PCB or the printed circuit board is another area of failure and can cause a disk to fail and will require data retrieval it has been noted that some have tried swapping the PCB in an attempt to recover the data and unless this is done with exact knowledge and understanding of the specific manufacturer and model it should not be attempted as the PCB contains unique code embedded into it that pertains to that exact hard drive only and can not be swapped from another.The code on the PCB includes such issues as the head map arrangement, start up algorithm, and other such data unique to the media.
Typical reasons why users swap the PCB is that there is apparent chip damage which is clearly visible and usually this failed chip is the motor and or VCM voice coil motor chip which has blown.To successfully repair the printed circuit board you will need hot air rework stations, fine solder, a multimeter and above all else the very steady hand! Again if the data is of any value then expert opinion, advice and services must be sought, as in some instances if severe damage occurs to the PCB it can make the data unrecoverable.

• Posted in data recovery
July 3rd, 2008

Peter Gutmann, overwrites, and DOD security.

The paper entitled secure deletion of data written by Peter Gutmann and published in 1996 postulated the possibility of recovering data from magnetic storage media via such exotic methods employing MFM Magnetic Force Microscopy this scanning techniques uses a sharp tip which interacts with the disk surface and an image is then produced of the disk surface
Section 2 of the paper there is the following statement “Even for a relatively inexperienced user the time to start getting images of the data on a drive platter is about 5 minutes”.
Off course this is well documented as is the paper and related to hard drive technology some 12 years ago and may as well be 12 light years ago based on the almost exponential growth of HDD storage media their capacity, areal density B.P.I Bits Per Inch track widths and perpendicular recording technology, coupled with the sub micron distance of the Head Stack Assembly head to surface calibrations, no one has produced any new evidence, photos or samples of MFM or STFM tunneling data from modern hard drive surfaces, not least that they have been able to reconstruct the data back to meaningful useful logical file structures for end user usage.
The paperwork discussed the famous 35 times overwrite to thoroughly sanitize the magnetic spinning media and destroy any data on the surface, is this really required?
Perhaps the DOD Department of Defence is then needed 7 times overwrites? or how about 3 times for a quick delete?
Answer = 1. Yes that’s correct 1 times overwrite from the beginning of the user data area LBA Logical Block Address 0 to the end of the drive. This is all that is required to destroy the data permanently for most requirements.~
There are a number of utilities which can do this for you some of which are freely available for download from the Internet.
Why not try this yourself then come back to us with your results we would be interested to hear from you?
However there is one small caveat that may be overlooked, bad sectors and lists may contain data for which the utility may not access thus leaving some data remaining.
Hard drive technology handles bad sectors by way of lists and marking them bad which the operating system will also do through the $meta data file badclus$ the secure deletion software may have limited or strict timing in accessing those sectors and move on before completing its overwrite pass to the area of the disk moreover software will not have access to defect lists as this contains the translator which is only accessible via ATA firmware commands completely outside of user access for obvious reasons.
To correctly erase all the data with standard software then low level format the media, next scan the media with a bad block tool making a note of bad blocks available acquire software which can deal with these issues, bad sectors and is able to have timeouts amended for slow sectors and CRC errors this way you will be able to deal with all user data area including bad sectors G & P Lists and LBA user area and securely erase your hard drive taking into consideration ALL bad sectors.This process obviously takes some time to complete and so it must be calculated into the desired results and objective.
The obvious answer to security and ALL storage media and if you want complete peace of mind then physical destruction of the device is the only absolute way to destroy the data and requires the least amount of resources, however the article is based on overwrites and the practical realistic possibility of recovering data from overwritten data have any companies or departments ever recovered any data from any media? There was a recent challenge and reward for any institution, comp[any or organization to recover overwritten data and to data the challenge remains intact and unclaimed.

• Posted in data recovery
June 20th, 2008

Data recovery services for previously declared unrecoverable data.

After careful selection of choosing your preferred data recovery service provider it can be nothing less than devastating to then be informed that your data is unrecoverable, but is this really true?
For sure there can be situations where your data is not recoverable, very often this can be from the most innocuous failure types, for instance your hard drive may be functioning perfectly well with no warnings or indications of failure from the S.M.A.R.T or unusual noises emanating from the disk enclosure when without warning its stops functioning and you get either a blue screen or similar messages via the BIOS informing you NO FIXED DISK PRESENT or similar wordings.
The diagnosis and plan of action is now very important in the quest to retrieve your data, this is where a calm approach is paramount to the success of the attempted recovery.

Following the diagnosis of the media by a professional data recovery lab the media will be examined at all levels along with the end users information of how and when and if any attempts at recovery have been made.

Hard drives are truly spectacular pieces of engineering and individually tuned at the point of manufacture for such issues as defects and thermal adjustments these details create a piece of technology which has very little margin for error and requires exacting precise standards for any recovery to take place.
Most users are not aware for instance that the hard drive has its own unique code encoded directly onto the disk surface(s) which is vital for the operation of normal disk performance and repeated reliability if this area becomes damaged then access to the user data area will not be possible with ordinary means.

The failure discussed at the beginning of this article could be such a failure in which the drive has suffered from extensive damage to the disk area and as a consequence the data may now be unrecoverable, however there are exceptions to this rule such as how much damage has occurred and who is conducting the attempt not all data recovery companies are equal in this discipline.
The failure type may have occurred because of heat or power fluctuations to which the user may not be aware of where as an external hard drive that has been knocked over while in operation clearly the failure type is identified.

Another point worth mentioning is that very often there is a finite amount of time to recover data from hard drive storage media with second and third attempts affecting the quality of any possible recovery, that being said a second opinion must be sought where the data is of value both financially and personally.

• Posted in data recovery