Once again we had an enquiry from a customer who was at her wits end and wanted a second opinion. She had spilt coffee on her laptop that had all her family photographs. She had taken it to PC World where she had originally bought it. They advised her to use their internal recovery process, and sent it off for analysis. She was eventually told that there was no chance of recovering her data from the liquid damaged hard drive. But fortunately for her, against the advice she received, she decided to search online for another data recovery company. This is where we came in. Although the hard drive was covered in sticky coffee and damaged by the liquid, we were able to overcome the problem and recover all of the data for the customer. Once again another happy customer as a result of a second opinion. This is becoming a habit.
Problem: Clicking. Previously diagnosed by a third party as unrecoverable due to media damage.
We are always keen to test our services against our competitors, just to make sure we’re still up there with the best of them. When we heard from one of our service partners (ABC Rawpaw) that one of the top ranking data recovery companies on Google had given up on a customer’s drive, we were curious to take a look. It’s also worth mentioning that the client had paid £234 to the other company, despite them recovering no data.
Third party report
We received a copy of the original diagnosis report with the hard drive. The report mentioned incorrect head alignment and also damage to the head assembly preventing the drive from functioning correctly. It also stated that they had subsequently replaced the old heads with new ones but due to suspected disc damage, recovery was unsuccessful. A plausible enough report, but was it accurate?
The drive was booked into our process. We noted that the warranty seals had been removed and the top cover showed signs of being previously opened. Whenever we receive a drive in this state, we always want to make sure the drive has been rebuilt correctly. We need to do this in our cleanroom to prevent any contamination getting in from the air. Our office is clean, but it’s no place to open a hard drive.
The inside of the drive was examined in our cleanroom and found to be spotlessly clean. There were no signs of disc damage or particles, but we did notice that the screws were not factory-tight, suggesting previous work had taken place. Happy that there was nothing untoward inside the disk, it was rebuilt for further diagnosis. The drive was powered on and initially failed to reach a ready state. This is common for Western Digital drives as they often have firmware corruption. We used our proprietary firmware tools (and John’s keen knowledge) to repair some of the firmware area of the drive which then allowed the drive to reach a ready state and allow access by our imaging tools.
We did find that one of the heads was not performing within spec, but we were able to work around this, again using specialist tools. After imaging the majority of the drive we replaced the heads to allow better access to the missing areas. This helped improve the amount of successfully recovered data.
We ended up with over 800GB of data recovered from the drive in good condition, even though one of the biggest companies (according to Google) was unable to get anything! This is not the first time we’ve recovered data where others have failed, but we always wonder how many people give up on ever seeing their data again, even though it may be recoverable with the right knowledge.
In the end we had an extremely happy customer (and service partner), and were able to test ourselves against one of the biggest data recovery firms in the UK. A great result for us that shows the importance of getting a second opinion.
When your hard drive has failed, where do you turn for help? In many cases the supplier or manufacturer of your computer or hard drive are not the best place to deal with your data loss. Also your warranty only covers the hardware and not your lost files.
So why choose us at Dataquest ?
With over 15 years of experience we are very familiar with all types of hard drive failures. Unlike many other companies our costs are fixed and based on how quick you wish to have your recovered data returned. Like many other companies we offer a free diagnosis, but unlike many others this does not determine eventual recovery cost but decides wether the hard drives problem is mechanical or not. We use the latest hardware and techniques to produce the best results possible.
On a more personal note customer service is a large part of what we do and understanding customer needs is paramount. We will in many cases go beyond what other companies would deem cost effective when recovering lost data. We use all our acquired knowledge to exhaust all possibilities.
We are also partnered with many IT support companies around the UK, to enable us to connect with customers who would other wise have not known of our services.
PGP WDE is an encryption tool that uses a boot loader installed on an internal hard drive. This utility launches before Windows and prompts the user to input their password. Without the password you cannot gain access to the data.
This utility is widely used by IBM personnel and is now part of IBM’s process that has to be adhered to by end users. Prior to this utility IBM hard drives were restricted access by a low level ATA hard drive password setup by the internal IBM IT department. As computer systems advanced and maybe as a result of a reduced IBM IT department, IBM adopted the user friendly PGP encryption process.
We regulary receive these hard drives from IBM, and we find that the major problem is related to the PGP boot sequence. PGP does not like a hard drive that is suffering from bad sectors, especially within the partition table. It results in the user being unable to load their access code on startup, or in some cases the code is accepted but does not boot correctly due to bad sectors further along.
We have a lot of experience recovering data from PGP whole disk encrypted hard drives and as a result our data recovery process has a very high success rate.
I had an issue in searching for content within Apple Mail. Every time I tried to search for any particular phrase the Mail application crashed and closed instantly. So I decided to Rebuild the Mailboxes. Before doing this I checked that my latest Time Machine backup had carried out successfully. (It had.)
Once confirmed I clicked Rebuild from the Mailbox drop down menu. Instantly all the mail disappeared and I was left wondering whether it was doing anything. I was patient and waited to see what would happen and sure enough after a couple of minutes all my mail re-appeared intact.
What worried me was that there was no indication that the rebuild was being done. No progress bar or spinning wheel, just an empty window. If I had been impatient I could easily have force quit the rebuild process thinking the application had crashed. That would have resulted in an Apple Mail restore to be sure.
On the Apple Website details are very basic. So, be patient, go for a walk and then come back and see if the rebuild worked.
We’ve been hearing reports of data loss with certain external hard drives after an upgrade to the latest Mac operating system Mavericks. The blame seems to fall to the disk management software that Western Digital bundle with their external hard drives. In response WD has removed WD Drive Manager, WD Raid Manager, and WD SmartWare from their website until they figure out the problem.
We have already had first-hand data recovery enquiries for such disks, so it remains to be seen if these issues can be resolved, or if the data is permanently damaged. One notable case involved a 6TB RAID with two 3TB drives in a mirrored array. After the update to Mavericks, the volume appeared as an empty 3TB drive.
It’s worth noting that even if you use a Western Digital RAID drive set as a mirror, this problem can still cause data loss. Both disks in the mirror are susceptible to the same problem. Remember that RAIDs need to be backed up even more than single disks!
Update – 8-11-2013
We’ve now completed the recovery process for one of these hard drives. It appears that the drive we received had been formatted to an empty MyBook volume. The way the Mac filesystem stores data means although most of the files can be recovered, it is not possible to restore the original file and folder structure. This causes issues for files like InDesign which link to external files by name when you add graphics to the document.
We’ve not yet seen enough of these disks to know if this is a common outcome for all affected disks.
It’s a common problem that as we generate more data each year we start running out of space to put it. This is now even more of an issue in the smartphone market, where built-in cameras are generating increasingly large photos and videos, without providing much in the way of additional storage. The most common iPhones are still 16 & 32GB but the photos they now produce can be megabytes in size, with videos easily reaching 1GB.
It’s tempting to take that data and put it somewhere else, so either a laptop or external hard drive. Then once you’ve copied it all you delete it from the phone and gain back all that space. Problem solved.
Not So Fast…
If that copy on your laptop is now the only copy, then you could be one spilt coffee from disaster. If the laptop goes up in smoke, gets stolen, dropped or any of the myriad other ways of failing then it’s bye bye data.
The key to making backups is redundancy. The key to making backups is redundancy. The key to making backups is redundancy.
You need to make extra copies of your data to different types of storage. This could be an external hard drive, NAS, USB Pen, SD card, anything. But don’t just pick one of those. Make a few backups. Put one in a locked safe somewhere. Send photos off to the cloud. Store a copy of your music at your nan’s house. If any of those copies gets lost or broken you can just replace it with another copy.
So let’s run through an example. All those photos on your iPhone have filled it up. Here’s what I would do:
- Copy the photos to my computer. Check them.
- Backup the computer as usual. (You’re already doing that, right?)
- Make another backup, or copy the photos to an online storage service like Dropbox.
- Now it is safe to delete the photos from the iPhone and revel in all that fresh space.
Note: Deleted photo recovery is virtually impossible for all modern iPhone versions due to encryption.
Here’s another example for when your computer runs out of space instead:
- Is it possible to upgrade the internal storage? If it is then you should do that.
- If this is not possible, or too expensive then you will have to get creative. It will be more fiddly but copy all data to two external hard drives.
- You always want to avoid just leaving your data in one place. All electronic devices can (and will) fail, and they have a terrible habit of doing so at the worst possible moment.
So, just remember that no single copy of your files are safe. Making extra copies is cheaper and easier than waiting until something fails.
You have heard of the myth about water behaving differently from the northern hemisphere compared to the southern hemisphere. Especially when draining water out of a sink or bath. Well apparently this is a myth and not fact.
So what has this got to do with hard drives? Well the same was said about some of the old Maxtor hard drives and why they were built with clockwise disc rotation. Where they built for the southern hemisphere market and do they work as well in the northern hemisphere. Built in mid 2000 the Maxtor DiamondMax 10 hard drives were designed to spin in the opposite direction to the conventional mechanical hard drives.
I could not find any information as to why they were built this way and whether this design did improve performance depending on location in the world. Maybe this question will never be answered.
See pictures below of a the internal working of a conventional hard drive compared to the Maxtor DiamondMax 10 hard drives.
Conventional WD Hard Drive
Maxtor DiamondMax Hard Drive
The other day I got an error message from Time Machine that it wanted to start from scratch with the backups on my Time Capsule. As I only use the Time Capsule as one part of my backup routine that was no big deal. I made sure my other non Time Capsule backups were up to date and then clicked Start New Backup. But what if the Time Capsule had been my only backup? I’d have been running without a backup for as long as Time Machine takes to backup my machine from scratch. Somehow I’ve trimmed my work laptop down to 78GB but it still estimated 6-14 hours until completion. (Yes, over wireless. No, I can’t relocate my office for the day.) What if my laptop died in that time? I’d have a dead laptop, a deleted Time Machine backup and an unfinished Time Machine Backup. In other words I’d be stuffed!
Now don’t get me wrong, I think that Time Machine has been brilliant in getting people making regular backups and I applaud the ease of use. The problem I have is that the language they use in their warnings is not strong enough. People should be more scared of losing their precious family photos or business files. There’s no need to sugar coat it. Also instead of deleting the old backup first, Time Machine should start a new backup and then delete the old one after the new one is verified. As long as there is enough free space of course. In my case there was plenty of free space.
I have included the original warning text below, along with my own version. I’ve not gone totally overboard, and sure it could use some work, but little details like this could really costs somebody some important data. It’s worth spending some time on.
Original Message Text
Transcript: Time Machine completed a verification of your backups on “Time Capsule”. To improve reliability, Time Machine must create a new backup for you.
Click Start New Backup to create a new backup. This will remove your existing backup history. This could take several hours.
Click Back Up Later to be reminded tomorrow. Time Machine won’t perform backups during this time.
Transcript: Time Machine has found a problem with your backups on “Time Capsule”. First backup any important files, then click Start New Backup. This will create a new backup and then delete the old one. This could take several hours and you will be at risk of data loss until it completes.
Click Back Up Later to be reminded tomorrow. Time Machine won’t perform backups during this time.
There are a few interesting things to point out here. As you are starting from scratch with the backup, you lose any old versions of files that Time Capsule had stored. It’s bad practice but some people will happily delete files from their computer, safe in the knowledge that Time Capsule has a copy. In that scenario, deleting the backup would be a disaster!
I still don’t know exactly what caused the problem with my Time Capsule backup, but since starting again I haven’t seen that message.
We often hear from people that have lost their data, despite having some sort of backup. It’s important to remember that your backup is no-longer a backup if it becomes the only copy of your data. We usually suggest having at least two forms of backup to cover this problem.
We recently revisited this topic.
An example of a failed backup strategy came recently. A user had one server, and at the end of every day would duplicate the whole server to another server. This is OK for some scenarios and gives you a day-old server ready to bring out if your main server fails. We would have also suggested a second backup routine to run at the same time to some other storage. Preferably an external drive, accessible from a standard computer.
The system worked fine for over a year, until server 1 failed one day. Instead of replacing the disks and then restoring from the backup, it was decided to reuse the original disks and then load them from the backup. They overwrote server 1 with the backup from server 2.
When the restore was complete, it was discovered that the data on server 2 was actually corrupt. This corrupt data had also been written back to server 1. The client ended up with two corrupt servers, and no good copies of the data. Worst case scenario.
You will often hear that deleted data isn’t really deleted. This is kind of true, but only until you overwrite the data with something else. By writing server 2’s data over server 1, that effectively overwrote the original data, and left no possible avenues of recovery.
Another common problem we see is with external RAID cases like the Netgear ReadyNAS. These can be setup in a mirror mode which keeps the same data on both disks. Theoretically when one disk fails, the other can still be accessed. In reality the failed NAS will often end up in an unusable state where access to the data is not possible anyway. Even if you plug the hard drive directly into a PC, the NAS drives use a non-standard format so the data is not accessible.
The best way to avoid getting caught out by your backups is to never trust them. Be more paranoid. If you think you have a solid backup system then add another backup, just in case. Then next year add another. Most of the time it will seem irrelevant, but when your server and backup drives all get struck by lightning or end up flooded under six feet of water, you’ll be glad you spent the extra few pounds on an extra backup.
If you’re already using a Time Machine backup on your Mac then why not supplement that with a monthly whole-disk copy to a different drive. Carbon Copy Cloner or SuperDuper! can take care of it. This also has the advantage of being instantly bootable in an emergency and can even be stored in a locked safe, or at a friends’s house.