Hard drive Encryption is becoming much more common especially in many large enterprise companies. Some hard drive encryption is more sophisticated than others, but in many data recovery cases we receive, a common flaw is the inability of the encryption software to overcome bad sectors on a hard drive. In most cases it results in partial or no access to the decrypted data on the hard drive by the user or even their I.T dept.
We have created an image and decryption process that allows us to recover the users data with the original file and folder structure intact. The time it takes to carry out this process will depending on the level of hard drive encryption used.
This year we have seen a fair number of these particular model hard drives with internal media damage caused by a head crash. These are 3.5″ hard drives from external cases such as Seagate Freeagent Go-Flex and Seagate Expansion Desktop. They are also used as internal hard drives in PCs running Windows 7 & 8 also used in Apple iMac’s running OSX.
It has been difficult to confirm whether the media damage seen has been caused by an impact such as a dropped drive or from general electronic failure. What we do know is that as soon as you hear one of these hard drives start to click, then if you have not already got a backup in place, backup your data immediately.
On an Apple Mac running OSX the first sign of a problem is usually a spinning beach ball resulting in slow access. On a PC running Windows 7 & 8, the signs of a hard drive problem are once again slow access and lack of movement from the mouse icon.
If you have a problem with a Seagate hard drive, have a look at our Seagate Data Recovery Services. If we catch it early enough we should be able to recover the data!
These notebook size drives must be popular at the moment as we have started to see a fair few of them come into us. Last month we saw three of them alone with no spin failures. When opened in our clean room we have found that the internal mechanical heads have prevented the motor and discs from spinning as a result of the heads sitting on the disc media. In normal operation the heads should never touch the discs but fly above them carrying out the reading and writing. When the drive is not in use or idle the heads will locate on a parking ramp at the side of the discs. If power to the hard drive is lost while it is reading or writing then this will cause the heads to drop onto the discs and not onto the parking ramp. Once reworked in our internal clean room they were all recovered successfully.
A common cause of this, is the unplugging of the USB cable incorrectly.
When you hear of data recovery companies using disk imaging as part of their process, this is done to create a Bit by Bit copy of the customers hard drive. This then allows work to be carried out on a copy instead of the original. It can also be used to take the data off the customers hard drive in a controlled manner, especially when the hard drive shows signs of being unstable. In those situations this process usually works well and has a very good success rate, but what if the customers hard drive is part of a criminal investigation that requires forensic evidence for court proceedings.
This then takes the whole disk imaging process to a different level. A hard drives data storage is not as straight forward as it appears when you see it on your computer. The hard drive manufacturer allows the user access to the majority of the hard drives storage space, but there are areas of the drive that are kept free and protected (HPA) for use by the manufacturer only. It is these areas that are not normally carried over in a standard Bit by Bit imaging process used by most data recovery companies.
Technically If someone wanted to hide specific data and had the use of specialist tools, they could hide data within these protected areas. There are also many other alterations, that can be carried out to a hard drive to hide user data, so it can be a bit of a mine field for forensic data recovery. To read a more detailed technical description then please see the following article about Forensic Imaging.
Being born and bred in Birkenhead, I wanted to let you local Birkonian’s know of our data recovery services. Although now based in Costa del Portsmouth we cover all towns and cities in the UK. We may not be local, but with the low cost in transport and courier services, it makes using a company you can trust the sensible thing to do. I already know the lingo so hopefully already halfway there. So Cum ‘ed den try using our services, I would be chuffed if you did.
If there is data on the drive that you cannot afford to lose, then do not try to fix the drive yourself. I would also suggest that you do not even try to power it back on after it has been dropped, as this is what usually causes the most damage. Whether your drive is an external desktop drive or a small portable one, they all work in the same way. Broadly speaking the inside of a hard drive is a bit like a record player with a mechanical moving needle reading the vinyl record. I can remember the times when playing old vinyl records, once you got scratches on them they never really worked the same again.
So I recommend not to panic, decide on what the value of the lost data is to you. Sometimes it may not be money value but a sentimental one. Once you have decided, then carry out some research online and look at data recovery company reviews. From our experience with dropped drives, the amount of work involved in overcoming the problem would not be covered by the low initial cost that some data recovery companies advertise and therefore the cost would soon escalate.
There is always hope of recovering data from a dropped drive but as you have read, it depends on your actions as to the eventual outcome.
You may be surprised by some of the old computer hardware that’s still used by some companies today. Especially where they are used as the control interface for manufacturing purposes. We recently received a Quantum 40MB SCSI II hard drive from an old Macintosh IICX that was controlling a piece of 7 Ton Fabricating equipment. The software communicated to the CNC equipment through an internal Nubus card with SCSI interface. For the customer it was not just a case of getting the user data off the drive, but to get an exact image so they had a bootable drive with all the relevant software and drivers to run the CNC machine. With our experience in old computer hardware especially old Macs and DOS based PC’s we were able to recover the data from the hard drive and make a bootable replacement drive to get the customer back up and running. For the customer there was no other option but to get his old Macintosh IICX back up and running as new CNC equipment was too expensive to replace.
Old Macintosh & DOS CNC Machines
This is not the first time we have been involved in this sort of request and process. Back in 2008 we had a similar situation with a customer who had a CNC milling machine that was run by an old DOS PC with a Fujitsu M2682TAM hard drive. Again we managed to get a bootable image back to the customer.
So if there is anyone out there running “obsolete” PC’s or Macs, then you know were to come to get the best outcome.
You often see data recovery companies claiming that they are approved data recovery partners to specific hard drive manufacturers. In all honesty most hard drive manufacturers will retain the warranty on hard drives that have been worked on by a reputable data recovery company, as long as a written report with a company letterhead is supplied on completion of the work.
Seagate on the other hand use their own Partner Recovery Process with registered data recovery companies to retain the warranty on the hard drive. These companies are usually more costly than the competition and it does not allow you the freedom of choice. With the low cost of replacement hard drives, it could work out cheaper using a data recovery company outside of the Seagate Recovery Process.
We have heard from customer feedback that it is the computer warranty that causes most issues. This is usually the case when you have bought a PC or Laptop from a seller and the hardware warranty also covers the internal hard drive. Sometimes to remove the problem hard drive, the PC or laptop has to be dismantled to gain access, and it is this process that can supposedly void your hardware warranty. I think the key is communication with the seller. As long as you explain the reason behind the removal of the hard drive and adhere to their process, then there should not be a problem.
This hard drive is one of the new Hybrid drives that also uses flash memory for quicker access. It recognises frequently accessed data and stores this in the flash memory for faster read performance.
We have received these hard drives for recovery before and have had good success with rework ranging from firmware fixes to internal repair.
We received one of these hard drives just recently which had very limited access. It would show all of the hard drives details including Make, Model, Serial Number and Firmware, but it would not allow access to the user data.
Further diagnosis revealed a problem with the firmware. Even with our specialist hardware we could not overcome the problem. This drive has been designated for R&D, to try and understand this problem, and create a solution for it in the future.
Just recently we received a failed HTS543232L9SA0 out of a Macbook Pro. When we proceeded to carry out the initial diagnosis we noticed that the drive capacity was 160GB and not 320GB as the model number suggests. The Model number should have read HTS543216L9SA0. This particular hard drive has a black label which is different than most Hitachi drive labels of the same type. When we opened the drive in our clean room we found that the drive only had two heads compared to a 320GB which has four. When the drive is attached to our hardware or a PC it Identify’s correctly as a HTS543216L9SA0.