Tag Archives: Beware

Troubleshoot Buffalo External Hard Drive

Posted on by
Reply

Like most external hard drives, Buffalo external drives are simply a wrapper around a regular hard drive. Aside from the protective shell they also have some electronic parts to convert between the internal hard drive and the external USB, Firewire, eSATA or Thunderbolt connections.

If you have problems with an external drive, you can perform a relatively simple test to check where the fault lies. Be aware that opening the external drive case will probably void your warranty, and if there is crucial data on the drive you should seek professional data recovery. That’s the obligatory warning out the way, so lets have a look at some troubleshooting.

Troubleshooting tips.

  • First check all cables are plugged in securely, and not damaged or frayed near the ends.. If you have an identical drive with spare cables try them, but make sure you don’t plug in a power supply with different voltage! Hard drives don’t handle extra voltage well so you’ll end up in a worse position than you started.
  • If you know how, you could remove the hard drive from the external case and attach it directly to a PC to see if that allows access to the data. If it does, you should copy the data off straight away. Problems have a habit of coming along in twos and threes so don’t push your luck.
  • Whatever you do, don’t dismantle the actual hard drive. Hard drives are built in controlled clean-air environments and even the smallest spec of dust can cause permanent damage to the drive.
  • Since the introduction of unique ROM chips on the hard drives, it is often no longer possible to exchange circuit boards with another hard drive to access the data. In our experience circuit board problems are far less common than they used to be.

If you are looking for data recovery from an external hard drive then have a look at our external drive recovery services.

Apple iMac 1TB Seagate Hard Drive Recall

Posted on by
Reply

Apple have recently announced a recall program for all iMacs with internal 1TB Seagate Hard Drives. These hard drives fail unexpectedly with no prior warning. We highlighted the failure of these hard drives in a blog back in 2009. You can check whether your iMac has an internal 1TB Seagate Hard Drive by entering your iMac Serial Number at this link.

If you have one of these hard drives that has already failed and you wish to recover your data, then please contact us.

How a Data Recovery Engineer Sees RAID

Posted on by
Reply

As somebody recovering data from RAID arrays, my view on them is a little different to the norm. In most cases I would say avoid RAID wherever possible. Simplicity is key.

Below are my answers to some real questions I have received from clients about RAIDs.

Why did this RAID disk fail?

Hard drive failure is not unusual and is often not avoidable. The truth is that all hard drives fail eventually, whether they are used in a RAID or not. Even though a RAID system can provide some fault tolerance from physical drive failure, they do have limits. A RAID5 on three disks for example can only handle a single drive failure at any one time. It is common for a second disk to fail whilst the other disk is being replaced. This is when RAID recovery is required; to first access the failed drives, and then rebuild the RAID. The best protection against RAID failure is to make backups. Backups in as many formats, in as many different physical locations as possible.

Why did the server fail so badly? Isn’t RAID meant to prevent this?

A 3-disk RAID5 can only cope with one bad disk. This doesn’t help when two drives fail at the same time. Although a RAID array can provide some leeway when it comes to disk failures, it doesn’t always help when you have multiple failures in quick succession. Adding more disks to the RAID can provide more redundancy, however this costs more money, and also adds complexity when things go wrong. Also you could be in a similar position if three disks happen to fail next time. A live system could fail at any time so prepare for the worst. Backups are cheap, and take a relatively short amount of time. RAID recovery can be expensive and cause unnecessary downtime.

Why couldn’t our IT support recover this?

We are a specialist data recovery company, with access to tools and resources which are not available to IT Support staff. We have spent the last fifteen years perfecting the process of extracting data from failed & failing hard drives and RAID arrays. For the best chance of recovery, we like to get the drives as soon after failure as possible. If more work gets carried out on the drives, things can be made much worse.

How can we avoid this happening again in the future?

To avoid similar problems in the future, the best way forward is some form of regular backup. The backups should be verified and then tested / restored as often as possible. This is where disaster recovery comes in, which can involve simulating certain types of failure and making sure you can get up and running again from your backups. At the very least, it wouldn’t hurt to put the really crucial business files onto an external hard drive every few weeks and store it in your company safe. It’s low-tech but at least you could plug it in to any PC and access the important business data if required as a last resort.

I’m not against RAIDs. They do have their place, but cannot be relied upon as a replacement for regular backups.

We have more articles about RAID here.

Hard Drive Crash During OS Upgrade

Posted on by
2

It is common to hear of hard drive problems happening as a result of a system update, or operating system upgrade. We have a theory that could possible explain this.

First of all, you should always make a full backup of your system before installing an update. It’s not unheard of for updates to go wrong, so this is crucial.

Hard Drive Crash During OS Upgrade / Update

During a software update, a large amount of data gets read and written to and from the hard drive. If the hard drive is functioning fine, this happens without issues. Installing updates is a normal (and necessary) part of computing.

If the hard drive is not quite 100%, then maybe running a software update is the last straw. It puts the failing drive under a bit of extra strain and bang. The hard drive fault which had been lying dormant for months, now rears it’s head and the hard drive gives up, leaving you stranded from your data. Bear in mind that the drive would have failed eventually anyway, but the heavy disk usage probably accelerated the failure.

There are a couple of things to look out for, that may predict an imminent hard drive failure. (Please don’t wait for these signs before backing up. Do it now!)

  • Warnings or messages during boot up
  • Computer being unresponsive / slow at times
  • The dreaded beachball animation (On the Mac)
  • Clicking / chirping noises

If you are running any computer with important data, you should back up immediately and as often as possible. That way it doesn’t matter if your hard drive fails; just throw in a new drive and reload it from your backup.

Recovering Deleted Data

Posted on by
1

In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.

Recovering Deleted Data

The Filing Cabinet

The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.

This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.

Overwritten / Deleted Data

We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.

The Problem With SSDs

Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.

Specifics

In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.

If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.

The Important Bit

If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.

Why RAID Can Be Bad For Business

Posted on by
2

RAID is often touted as the silver bullet in data storage. Increased storage capacity, resistance from hardware failures and improved performance. While these are all valid upsides to a RAID setup, there are also a few downsides which need to be addressed.

1. Extra Storage.

RAID can allow for a huge pool of storage, but with that storage comes great responsibility. You should factor in at least enough capacity to backup the RAID data somewhere else. If you can only afford 8TB of storage then you should only use 4TB for data and the other 4TB to back it up; Preferably on another machine / standalone system.

2. Redundancy.

The first letter in RAID stands for redundancy. This means you can afford to lose a certain number of disks without losing access to your data.  This also means that if you have a disk failure you need to get it replaced immediately, otherwise you’re running without redundancy.

3. Downtime.

Nobody likes downtime. If your 16TB RAID array goes offline without a backup then you have a couple of options. One option is to attempt to get the RAID back online by replacing disks, rebuilding the array etc, but this is risky. If this is your only copy of the data then rebuilding / reformatting the RAID could corrupt the data beyond recovery. Don’t do this if you don’t have a backup to fall back on.

The second and preferable option is to get the RAID professionally recovered. When we receive a RAID, the first thing we do is make images of all disks. This allows us to work on the RAID without risk. Then we use a read-only process to extract the data onto another form of storage. This is where downtime comes in. Unless you go for an emergency process, you could have to make do without the data for a number of days.

So What’s The Way Forward?

It’s one word. Redundancy.

Whatever you do, make sure your data is replicated across as many types of storage as possible. In an ideal world you would have a duplicate system running alongside the live system, which can take over if anything goes wrong. Then have the data on another type of storage, which you can access from somewhere else. Imagine if the RAID controller failed, and you could only access the data from that one machine.

It doesn’t matter how many backups you have if they all require the same system to access them.

I’ve only just scratched the surface here, but you should always look to make extra copies of your data. It may seem redundant now, but when your server fails containing all your data, all your accounts, all your client details and your website, you’ll be glad you kept that extra copy.

Old Quantum Pro Drive 250 MB 50 Pin SCSI

Posted on by
Reply

Old Quantum Pro Drive 250mb 50pin SCSI

This hard drive was opened in our clean room for internal rework. In the process we found that the rubber crash stops attached to the VCM magnet were perished.  They were oozing sticky rubber solution contaminating the drive internally. A word of warning to anyone who may still have one of these hard drives with critical data. I would recommend back up and replacement. This particular hard drive was out of a synthesiser that had stopped working.

Bang Goes The Theory Data Recovery

Posted on by
Reply

Bang Goes The Theory – Series 6 Episode 3 – March 26th

Bang Goes The Theory Data Recovery

I love Bang Goes The Theory. I loved the alcohol powered motorbikes last week and find it a good doorway into ideas, which are presented in a fun and interesting way. I was extra excited when I started watching episode 3, and relised they would be featuring data recovery. A perfect opportunity to dispel some common myths, and dish out a bit of advice in the process.

Deletion

The data recovery guy Rob, made a good analogy when he described deleting data as ripping out a page from the table of contents. That is pretty much how it works, and really simple to understand.

Data Recovery Experts

Yes they are the world leaders. I’m not going to dispute that, but I’m also not going to name them. They don’t exactly need the extra publicity. It’s worth noting that any decent recovery firm would have reached the same results from the batch of damaged drives.

Getting Physical

I do have a couple of problems with the way some of the drives were “destroyed.”

  1. Sledgehammer. This would have been a good way to destroy a drive, but only if it had been removed from the PC first. Effectively the metal PC case acted like armour, thus protecting the drive from the brunt of the impact.
  2. Tractor. Same as above. If the drive was bare, and on solid ground, then maybe the tractor would have done more damage. Instead, the PC case protected it sufficiently and all the data was recoverable.
  3. Golf Swing. This was great in the example shown, but is a bit unreliable. If you only hit the edge, or if the disk didn’t have glass platters then it may have been recoverable. Maybe take it apart first, then you can see if it’s damaged.
  4. Tea Damaged USB Pen. This was a good one. Solid state storage should survive liquid damage, as long as it is powered off at the time. When dried out, there is a good chance of getting the data back. The worst thing you could do is plug in a wet drive, as this would cause an electrical short, and potentially damage the electronics of the device, and even the computer you plugged it into.
  5. Big Magnet. This was a good one, and surprisingly effective. Only problems are the fact that most people don’t have a giant magnet, and unless you test it afterwards, you wouldn’t know if it had worked.
  6. Toaster. This is an interesting one for me. Of course the toaster damaged the PCB (circuit board) of this hard drive. These drives were quite old, so that was no major problem. If however these were more modern drives the story could have been quite different. A lot of newer drives encrypt the data using keys stored on the PCB. If you melt that PCB, then you have a very difficult job on your hands.
  7. Torched. 100% successful. If you can see the drive destroyed, then that’s perfect.

Optical Discs

Liz later made some good points about the reliability of CD / DVD storage. I agree that although the quoted life spans of DVDs are enormous, in reality DVDs often only last for a couple of years. We have had discs in for recovery that have been stored in temperature-controlled server rooms that have still failed well short of their estimated lifespans.

Hard Disks

Hard disks can last for ages. We have some here that are well over 15 years old and still going strong. The problem is that they can fail without any warning. It is sound advice to backup one drive with another, and then another. This is the only surefire way to avoid being stung by a failed drive. Dallas made a good point of moving one of the backups off site, which is also a good idea.

Scrambling Software

I didn’t like the scrambling advice given near the end. There are problems with the way hard drives are designed, which can prevent the software from accessing bad sectors, and hidden parts of the disk. Although only small parts of the disk, you could leave enough data there to be targeted by fraudsters or whoever.

I advise a two pronged approach. First erase / scramble the data, then physically destroy the drive. This makes it far less likely that your data could end up in the wrong hands.

Summary

It is good to see this sort of thing on mainstream TV, and the advice given was a good starting point for most people. Despite my points above, it was basically a good show: Interesting and informative, with a decent amount of good info.

Many people have little or no knowledge of the way their data is stored, so any way to bring this to their attention is good in my books.

Hitachi Model HTS5450 Notebook Hard Drives

Posted on by
Reply

We have been receiving these particular Hitachi model hard drives for data recovery since 2010. The majority of them all appear to show the same failing symptom to the customer. Resulting in access to the user data area of the hard drive becoming more and more difficult.

After several reworked hard drives we have determined that the problem appears to be the written data on the disc media. This may initially have been caused by the internal read and write heads writing bad data or the disc media itself suffering some mis-alignment.

Whatever the cause, the rework to overcome this is usually a slow and very deliberate process. To any customers with these particular hard drives, make sure you back up regularly and any signs of slow or difficult access, you may want to think about replacing the drive.

 

Seagate Full Disk Encryption FDE

Posted on by
Reply

These Seagate FDE hard drives encrypt the data automatically as it is read and written to the drive. As you save data to the drive it is encrypted immediately and can only be accessed when you input your user name and password. The drive will then be temporarily unlocked and allow the operating system to boot. Once the drive is powered off, it will be automatically locked again.

We have received several of these drives from customers who cannot access their data due to a hard drive failure. You may still b asked for the password, but the laptop will then fail to boot. This can be as a result of bad sectors or electronic problems. We can overcome virtually any type of failure and can return your data back to you decrypted and fully accessible on a new hard drive.