This hard drive is one of the new Hybrid drives that also uses flash memory for quicker access. It recognises frequently accessed data and stores this in the flash memory for faster read performance.
We have received these hard drives for recovery before and have had good success with rework ranging from firmware fixes to internal repair.
We received one of these hard drives just recently which had very limited access. It would show all of the hard drives details including Make, Model, Serial Number and Firmware, but it would not allow access to the user data.
Further diagnosis revealed a problem with the firmware. Even with our specialist hardware we could not overcome the problem. This drive has been designated for R&D, to try and understand this problem, and create a solution for it in the future.
This OWC external enclosure is a common sight on the desks of Mac users with big storage needs. It’s a pretty standard 4-bay box, styled somewhat like a cousin of a PowerMac G5 or 1st generation Mac Pro. Inside are the usual options of RAID 0 to RAID 5 with a few additions like JBOD & RAID 10 thrown in for good measure. There are a few variations of this device but the back panels commonly have USB, Firewire, and eSATA ports for direct connection to a PC or Mac. There is no ethernet port on these drives which makes the Qx2 a DAS (Direct Attached Storage) rather than NAS (Network Attached Storage).
Aside from massive name, the OWC Mercury Elite Pro Qx2 also comes with a potentially huge amount of storage. Currently up to 32TB on the OWC store, but also available diskless or BYOD (Bring your own disks). With so much storage space, these drives often become the one and only repository for vast lumps of important data. The benefits of RAID give a false sense of security that the data is safe from drive failures. Unfortunately, there are a number of reasons why the RAID array alone will not protect from certain failures. Most of these failures can be overcome by us in our workshop, but they are not one-button fixes. It is helpful to understand why a seemingly rock-solid platform can be even more risky than a simple external USB drive.
Under common settings, the Qx2 will use RAID 5 for the array. With four 2TB drives this gives you a 6TB volume on a Mac or ~5.5TB on a PC, and can cope with a single disk failure. There is a lot of debate about how good RAID 5 really is for such large drives. In our example this means that if a single disk fails, it will need to be replaced, and then the new disk rebuilt with 2TB of data calculated from the other disks. This will take many hours, even under optimal conditions, but if anything goes wrong before it completes the array could stop showing up all together. At this stage, the data is probably recoverable but don’t panic. One wrong move and the data could be gone for good.
If the data is crucial then get assistance from a RAID recovery service now and you should get back all or most of the data.
If any disks are removed or replaced at this point the array could get reinitialised and either make the recovery more complicated or wipe the data completely.
Aside from all the problems with a RAID setup, the volume could also fail in the same ways that a standard hard drive can. There could be deleted files, a reformatted or corrupt partition, or even the RAID controller failure. RAID cannot protect against those types of failure at all.
Our first step would be making read-only copies of each disk in the array. This protects against further disks failing, and also allows us to work from copies without risking the original disks. In fact, once the disks are copied, we put the originals to one side and don’t touch them again until all the data is recovered and supplied back to the user.
Once we have our copies, they are loaded into our own hardware where we recreate the RAID in a virtual environment. Again, we don’t use the original hardware, as that may have been the root cause of the problem.
When the virtual RAID has been loaded and all the data extracted, the files are supplied back on whatever alternative storage is suitable, (not the original device!) Once the data has been delivered to the user, and backups made, the old unit can then be destroyed, or returned and reused.
Anyone using RAID on a regular basis should know that RAID is not a replacement for backups. If anything, the increased number of disks makes failure more likely. This needs to be addressed by either making backups to another device, or an online service (preferably both). You ideally want backups that keep historic versions of the files, so that inadvertently deleting a file or changing a file by mistake will not also replace the backup version.
If you are having problems with an OWC Mercury Elite Pro Qx2, give us a call or send a message via the form on this page. We give free advice and could help you avoid permanent data loss.
1. Macs now use 1000 bytes for 1KB but PCs use 1024 bytes.
2. Even RAID 6 does not solve the long time required to rebuild a disk, even though it allows for two disk failures.
Following a fire at a science lab, five hard drives had sustained damage. Although hard drives often survive a fire, they can sometimes be damaged more by the water used to bring the blaze under control. Fortunately for the lab involved, somebody had managed to extract the hard disks from the scene and quickly bag them. It is critical to work fast with fire and water damage, before corrosion takes hold.
The lab have been using our data recovery services since 2005 so the technical department knew exactly where to send the disks.
Cleaning and Decontamination
To maximise the chances of recovery, we have a strict procedure for fire and water damaged disks. First the outside covers of the drives are cleaned of any loose soot and all electronic components are labelled and removed. The hard drive carcases then get thoroughly cleaned and inspected for signs of water ingress or damage to the protective seals. If the damage has transferred inside the drive then it will be taken into our cleanroom for internal decontamination and cleaning. The electronic parts of the disks are dealt with separately. First they are dusted of loose debris, and then immersed in a chemical bath. This removes contaminants from any connectors or contact surfaces, and also helps remove anything that could cause the electronics to malfunction when powered on. The circuit boards are then dried and tested for faults before being reattached to the hard drives.
Once cleaning and decontamination is complete, the drives are reassembled and attached to an imaging machine. The drives are copied as fast as possible, as they may have been exposed to temperatures outside of their specified design. This process means that each sector is only read a single time and then the disk is powered off and returned to storage. We are then free to work on the copies. It is part of our standard data recovery procedure, but all the more important in this case.
Our strict and thorough process for fire and water damaged drives meant that we had a 100% success rate from these drives. Failure to follow any part of the process could have meant the difference between the data being recovered or not.
Just recently we received a failed HTS543232L9SA0 out of a Macbook Pro. When we proceeded to carry out the initial diagnosis we noticed that the drive capacity was 160GB and not 320GB as the model number suggests. The Model number should have read HTS543216L9SA0. This particular hard drive has a black label which is different than most Hitachi drive labels of the same type. When we opened the drive in our clean room we found that the drive only had two heads compared to a 320GB which has four. When the drive is attached to our hardware or a PC it Identify’s correctly as a HTS543216L9SA0.
We recently received a call from a customer asking if there was any chance of recovering data from an old IBM IDE laptop hard drive that he had stored away. He mentioned that many years ago he had sent it to a data recovery company, who had no success in overcoming the problem, so he had it returned back to him, hoping that in the future technology may change.
As we offer a free diagnosis, I told him that we can determine if there is any chance of recovery at no initial cost. So with nothing to lose the customer sent the hard drive to us.
The hard drive was a IBM IC25N040ATMR040 laptop drive with the old IDE 44 pin interface. Upon inspection we found that the drive had suffered liquid damage on the PCB and also possibly effecting the internal electronics. We proceeded to carry out the rework necessary to overcome the problem, resulting in a successful recovery for the customer.
So anyone out there holding onto an old hard drive that had previously been diagnosed as unrecoverable, bear in mind that with modern technology and expertise your previous lost data may be recoverable.
Drive: WD3200AAJS-40RYA0 Problem: Clicking. Diagnosed by multiple third parties as unrecoverable.
This hard drive has travelled the globe and had been looked at by various data recovery companies, eventually landing on the desk of our data recovery partner in Amsterdam. Our partner then asked us if we were up for a challenge and explained to us that the last data recovery company to look at the drive in Portugal had given up with no success.
Third Party Feedback
We got in contact with the company in Portugal and they explained to us that they had tried mechanical and firmware repair, but both did not overcome the problem.
Once the drive was booked into our process, it was clear that the warranty seals had been removed and the top cover had been previously opened. Therefore we needed to take the hard drive straight into our clean room to check for any media damage and also to confirm that the mechanics of the drive had been rebuilt correctly.
We found no cause for concern in the clean room examination. The drive appeared to be clean and was correctly rebuilt. We replaced the internal heads with a new set as a matter of course and rebuilt the drive and then moved to the next stage of our process. The drive was then powered up on our proprietary equipment and an extensive firmware check and fix process was carried out. Perseverance was the key to overcoming the firmware corruption. It was apparent that a lot of the original firmware had been totally overwritten and a lot of painstaking work was done over the next few weeks to rebuild the firmware to eventually allow the drive to come ready.
Once it was established that we could access the data area of the drive, it was put into a block level head map imaging process. This allowed us to control the drive and to further stabilise it by imaging each disk surface individually. Once this process was complete a file extraction was carried out on the image to reveal the original folder and file structure.
The image process was a complete success and resulted in over 190GB of data recovered. A folder and file structure list was sent to the customer, who acknowledged saying that all the data had been recovered.
Once again we were able to test ourselves against our competition, all be it in Portugal. In this case the customer was fortunate to seek advice from our data recovery partner in Amsterdam who recommended us. We can’t help but wonder how many people are told that their data is lost for ever, without the thought of getting a second opinion.
For a limited time only we have produced collectible battle cards, complete with hard drive portraits and battle stats. There are 10 to collect. Some are based on common hard drives, but others are a bit more obscure.
We’ve also got plans for a few new ranges, so get these new cards while you can. These cards are not for sale so contact us if you want some.
I’ve previously written about the difficulties recovering data from modern iOS devices. This new post by Avast(!?) shows it from another angle. What happens when you sell an old device?
Because iOS uses hardware encryption on the main storage, recovery is almost impossible without the passcode. In contrast, Android phones (usually, by default) don’t encrypt the main storage. Also they allow external SD cards which may not be encrypted either. This means if an iPhone and an Android phone are sold or lost without being carefully erased, the iPhone will not easily give up the data but an android phone will. It also means if you forget your iPhone passcode you are unlikely to ever get the data back.
Maybe the title is a bit harsh, but in the past week I have seen an unusually high number of hard drives ruined by avoidable problems. There is nothing more frustrating than knowing the data would have been recoverable if the hard drive hadn’t been tampered with first.
Hard drives are manufactured in a controlled environment. Staff wearing white overalls, gloves, and masks, control machines which are carefully organised to prevent contamination getting inside the hard drive.
To prevent contamination when repairing the inside of a hard drive, it is necessary to use a cleanroom. This is a specially designed system that filters the air and keeps airborne particles to a minimum. A cleanroom is the only safe way to open a hard drive. We have one of these, which allows us to carry out the most intricate repairs without any risk of particle damage.
Before opening a hard drive for internal rework, it is crucial to confirm that there is an internal mechanical problem in the first place. For instance, our data recovery process has numerous tests we can carry out before we confirm that the problem is under the hood. Only then will we open the top cover and check for damage inside. Unlike CDs or DVDs, the internal disks of a hard drive are not designed to come into contact with normal air. Even a fingerprint could mean the difference between a successful or unsuccessful recovery. If you slip with a screwdriver then forget it.
On a percentage basis of all the failed drives we receive (hundreds per year), we only need to go to the cleanroom with around 10%. There are likely to be far less intrusive ways into the data without ever taking off the top cover.
I’ve lost count of the number of times I’ve been told, “It’s an internal fault. The heads are clicking.” Although some drives will click as a symptom of failed heads, there are so many other reasons to cause a drive to click that it is not a reliable way to diagnose problems.
Reasons a hard drive will click
Weak (but not completely failed) heads
Problems reading partition info
All of the problems above can be overcome without ever unscrewing the top cover. In fact, removing the top cover will only introduce more doubt to the diagnosis. If the top cover is removed outside of a cleanroom, then not only do the above problems need to be solved, but also new problems of contamination and possibly damage by tools.
(Don’t) Get the discs out
Another common wrong diagnosis is to take the disc pack from one drive and place it into a donor drive. Although this is a correct course of action for some drives, there are some serious implications. First, when the disc pack is built it is clamped together onto the spindle motor. This alignment is so crucial that if you remove one disc at a time, you will never be able to regain this alignment. This was true 20 years ago when the magnetic data was nowhere near as densely packed. Rotate the discs a fraction of a millimetre and you can wave goodbye to all the files.
It is also the case that most of the hard drive firmware is now stored on the discs, so moving them to a new donor will not help if the fault is firmware based.
If you are even considering a destructive course of action, at least get some professional advice first. You don’t need to follow the advice, but at least it gives somebody (maybe me) the option to give a warning. You don’t want to find out later that the data would have been simple to recover, if only…
Just recently I was able to meet up with one of our European business partners in Holland. The company is based in Amsterdam nd offers a national data recovery service. Although a young company, they already have a strong market presence and are growing all the time. Their English is excellent which is more than I can say for my Dutch. It is always good to put a personal face behind the telephone conversations.