When you hear of data recovery companies using disk imaging as part of their process, this is done to create a Bit by Bit copy of the customers hard drive. This then allows work to be carried out on a copy instead of the original. It can also be used to take the data off the customers hard drive in a controlled manner, especially when the hard drive shows signs of being unstable. In those situations this process usually works well and has a very good success rate, but what if the customers hard drive is part of a criminal investigation that requires forensic evidence for court proceedings.
This then takes the whole disk imaging process to a different level. A hard drives data storage is not as straight forward as it appears when you see it on your computer. The hard drive manufacturer allows the user access to the majority of the hard drives storage space, but there are areas of the drive that are kept free and protected (HPA) for use by the manufacturer only. It is these areas that are not normally carried over in a standard Bit by Bit imaging process used by most data recovery companies.
Technically If someone wanted to hide specific data and had the use of specialist tools, they could hide data within these protected areas. There are also many other alterations, that can be carried out to a hard drive to hide user data, so it can be a bit of a mine field for forensic data recovery. To read a more detailed technical description then please see the following article about Forensic Imaging.
Being born and bred in Birkenhead, I wanted to let you local Birkonian’s know of our data recovery services. Although now based in Costa del Portsmouth we cover all towns and cities in the UK. We may not be local, but with the low cost in transport and courier services, it makes using a company you can trust the sensible thing to do. I already know the lingo so hopefully already halfway there. So Cum ‘ed den try using our services, I would be chuffed if you did.
For the last few years, newer editions of Windows have the ability to encrypt the whole disk with bitlocker. This means far more users are experimenting with encryption. We have seen an increase in recoveries from drives secured with bitlocker.
Is Data Recoverable From Bitlocker Drives?
In many cases the data is recoverable. It is important that we get the recovery key or password, as bitlocker security has not been compromised.
The most common problems we see with bitlocker encrypted drives are when the disk starts to fail, or when Windows becomes corrupt. This can prevent the built-in decryption process from working correctly and leave users locked out of their data. These drives can fail like any other, but the encryption adds an extra layer of complexity to the recovery process.
If using bitlocker on your drive, it is important to keep a copy of the decryption keys in a safe secure place away from the computer. It is also extra important to keep a constant and regular backup process. Although recovery is usually possible from a failed bitlocker drive, it could take a number of days. You probably wouldn’t want to live without your files for that time.
If you have a failed bitlocker drive that needs recovery, (and if you have the recovery key) get in touch.
If there is data on the drive that you cannot afford to lose, then do not try to fix the drive yourself. I would also suggest that you do not even try to power it back on after it has been dropped, as this is what usually causes the most damage. Whether your drive is an external desktop drive or a small portable one, they all work in the same way. Broadly speaking the inside of a hard drive is a bit like a record player with a mechanical moving needle reading the vinyl record. I can remember the times when playing old vinyl records, once you got scratches on them they never really worked the same again.
So I recommend not to panic, decide on what the value of the lost data is to you. Sometimes it may not be money value but a sentimental one. Once you have decided, then carry out some research online and look at data recovery company reviews. From our experience with dropped drives, the amount of work involved in overcoming the problem would not be covered by the low initial cost that some data recovery companies advertise and therefore the cost would soon escalate.
There is always hope of recovering data from a dropped drive but as you have read, it depends on your actions as to the eventual outcome.
You may be surprised by some of the old computer hardware that’s still used by some companies today. Especially where they are used as the control interface for manufacturing purposes. We recently received a Quantum 40MB SCSI II hard drive from an old Macintosh IICX that was controlling a piece of 7 Ton Fabricating equipment. The software communicated to the CNC equipment through an internal Nubus card with SCSI interface. For the customer it was not just a case of getting the user data off the drive, but to get an exact image so they had a bootable drive with all the relevant software and drivers to run the CNC machine. With our experience in old computer hardware especially old Macs and DOS based PC’s we were able to recover the data from the hard drive and make a bootable replacement drive to get the customer back up and running. For the customer there was no other option but to get his old Macintosh IICX back up and running as new CNC equipment was too expensive to replace.
Old Macintosh & DOS CNC Machines
This is not the first time we have been involved in this sort of request and process. Back in 2008 we had a similar situation with a customer who had a CNC milling machine that was run by an old DOS PC with a Fujitsu M2682TAM hard drive. Again we managed to get a bootable image back to the customer.
So if there is anyone out there running “obsolete” PC’s or Macs, then you know were to come to get the best outcome.
You often see data recovery companies claiming that they are approved data recovery partners to specific hard drive manufacturers. In all honesty most hard drive manufacturers will retain the warranty on hard drives that have been worked on by a reputable data recovery company, as long as a written report with a company letterhead is supplied on completion of the work.
Seagate on the other hand use their own Partner Recovery Process with registered data recovery companies to retain the warranty on the hard drive. These companies are usually more costly than the competition and it does not allow you the freedom of choice. With the low cost of replacement hard drives, it could work out cheaper using a data recovery company outside of the Seagate Recovery Process.
We have heard from customer feedback that it is the computer warranty that causes most issues. This is usually the case when you have bought a PC or Laptop from a seller and the hardware warranty also covers the internal hard drive. Sometimes to remove the problem hard drive, the PC or laptop has to be dismantled to gain access, and it is this process that can supposedly void your hardware warranty. I think the key is communication with the seller. As long as you explain the reason behind the removal of the hard drive and adhere to their process, then there should not be a problem.
This hard drive is one of the new Hybrid drives that also uses flash memory for quicker access. It recognises frequently accessed data and stores this in the flash memory for faster read performance.
We have received these hard drives for recovery before and have had good success with rework ranging from firmware fixes to internal repair.
We received one of these hard drives just recently which had very limited access. It would show all of the hard drives details including Make, Model, Serial Number and Firmware, but it would not allow access to the user data.
Further diagnosis revealed a problem with the firmware. Even with our specialist hardware we could not overcome the problem. This drive has been designated for R&D, to try and understand this problem, and create a solution for it in the future.
This OWC external enclosure is a common sight on the desks of Mac users with big storage needs. It’s a pretty standard 4-bay box, styled somewhat like a cousin of a PowerMac G5 or 1st generation Mac Pro. Inside are the usual options of RAID 0 to RAID 5 with a few additions like JBOD & RAID 10 thrown in for good measure. There are a few variations of this device but the back panels commonly have USB, Firewire, and eSATA ports for direct connection to a PC or Mac. There is no ethernet port on these drives which makes the Qx2 a DAS (Direct Attached Storage) rather than NAS (Network Attached Storage).
Aside from massive name, the OWC Mercury Elite Pro Qx2 also comes with a potentially huge amount of storage. Currently up to 32TB on the OWC store, but also available diskless or BYOD (Bring your own disks). With so much storage space, these drives often become the one and only repository for vast lumps of important data. The benefits of RAID give a false sense of security that the data is safe from drive failures. Unfortunately, there are a number of reasons why the RAID array alone will not protect from certain failures. Most of these failures can be overcome by us in our workshop, but they are not one-button fixes. It is helpful to understand why a seemingly rock-solid platform can be even more risky than a simple external USB drive.
Under common settings, the Qx2 will use RAID 5 for the array. With four 2TB drives this gives you a 6TB volume on a Mac or ~5.5TB on a PC, and can cope with a single disk failure. There is a lot of debate about how good RAID 5 really is for such large drives. In our example this means that if a single disk fails, it will need to be replaced, and then the new disk rebuilt with 2TB of data calculated from the other disks. This will take many hours, even under optimal conditions, but if anything goes wrong before it completes the array could stop showing up all together. At this stage, the data is probably recoverable but don’t panic. One wrong move and the data could be gone for good.
If the data is crucial then get assistance from a RAID recovery service now and you should get back all or most of the data.
If any disks are removed or replaced at this point the array could get reinitialised and either make the recovery more complicated or wipe the data completely.
Aside from all the problems with a RAID setup, the volume could also fail in the same ways that a standard hard drive can. There could be deleted files, a reformatted or corrupt partition, or even the RAID controller failure. RAID cannot protect against those types of failure at all.
Our first step would be making read-only copies of each disk in the array. This protects against further disks failing, and also allows us to work from copies without risking the original disks. In fact, once the disks are copied, we put the originals to one side and don’t touch them again until all the data is recovered and supplied back to the user.
Once we have our copies, they are loaded into our own hardware where we recreate the RAID in a virtual environment. Again, we don’t use the original hardware, as that may have been the root cause of the problem.
When the virtual RAID has been loaded and all the data extracted, the files are supplied back on whatever alternative storage is suitable, (not the original device!) Once the data has been delivered to the user, and backups made, the old unit can then be destroyed, or returned and reused.
Anyone using RAID on a regular basis should know that RAID is not a replacement for backups. If anything, the increased number of disks makes failure more likely. This needs to be addressed by either making backups to another device, or an online service (preferably both). You ideally want backups that keep historic versions of the files, so that inadvertently deleting a file or changing a file by mistake will not also replace the backup version.
If you are having problems with an OWC Mercury Elite Pro Qx2, give us a call or send a message via the form on this page. We give free advice and could help you avoid permanent data loss.
1. Macs now use 1000 bytes for 1KB but PCs use 1024 bytes.
2. Even RAID 6 does not solve the long time required to rebuild a disk, even though it allows for two disk failures.
Following a fire at a science lab, five hard drives had sustained damage. Although hard drives often survive a fire, they can sometimes be damaged more by the water used to bring the blaze under control. Fortunately for the lab involved, somebody had managed to extract the hard disks from the scene and quickly bag them. It is critical to work fast with fire and water damage, before corrosion takes hold.
The lab have been using our data recovery services since 2005 so the technical department knew exactly where to send the disks.
Cleaning and Decontamination
To maximise the chances of recovery, we have a strict procedure for fire and water damaged disks. First the outside covers of the drives are cleaned of any loose soot and all electronic components are labelled and removed. The hard drive carcases then get thoroughly cleaned and inspected for signs of water ingress or damage to the protective seals. If the damage has transferred inside the drive then it will be taken into our cleanroom for internal decontamination and cleaning. The electronic parts of the disks are dealt with separately. First they are dusted of loose debris, and then immersed in a chemical bath. This removes contaminants from any connectors or contact surfaces, and also helps remove anything that could cause the electronics to malfunction when powered on. The circuit boards are then dried and tested for faults before being reattached to the hard drives.
Once cleaning and decontamination is complete, the drives are reassembled and attached to an imaging machine. The drives are copied as fast as possible, as they may have been exposed to temperatures outside of their specified design. This process means that each sector is only read a single time and then the disk is powered off and returned to storage. We are then free to work on the copies. It is part of our standard data recovery procedure, but all the more important in this case.
Our strict and thorough process for fire and water damaged drives meant that we had a 100% success rate from these drives. Failure to follow any part of the process could have meant the difference between the data being recovered or not.