Accidentally Installed Windows On Top Of Mac OS X

We have just completed a complex data recovery, where a Mac system had been inadvertently overwritten with Windows. The Mac drive originally had over 500GB of data, so we expected to get most of it back, we just didn’t know how good the structure would be.

It helps to visualise the layout of the data on the disk. before it was overwritten, the data would have looked something like this:

Overwrite Mac With Windows

Although the fresh Windows system is much smaller than the original data, it prevents you from seeing any of that old Mac data.

Once we made copies of the drive, we were able to reconstruct the missing parts of the Mac data, and could see all the original files and folders, with their original structure.

Luckily nobody had tried to fix the problem with this drive. Often the fixes people attempt are worse to recover from than the original problems.

What is a Digital Negative

We see various types of camera media come into us for data recovery, with surprisingly varied file formats. Many camera manufacturers use their own raw format, alongside various JPG options.

This raw format is sometimes known as a digital negative, containing (mostly) untouched data straight from the camera. These raw format images can be ten times the size of JPG images.

The benefits of raw files are to allow post-processing without the loss of quality from JPG files. Settings like sharpness, saturation and white balance can be changed at a later date using photographic software. Below are a few of the different raw file types in use.

The following is a description about some RAW formats:

  • CRW – Canon Digital Camera Raw Image Format. Raw image format for some Canon digital cameras. Raw images are basically the data as it comes directly from the CCD detector in the camera. Raw files can also contain text information about the picture and conditions in the camera when the picture was taken.
  • CR2 – Canon Digital Camera Raw Image Format version 2.0. Raw files can also contain text information about the picture and conditions in the camera when the picture was taken. These images are based on the TIFF image standard.
  • NEF – Nikon Digital SLR Camera Raw Image File. Raw image format for some Nikon digital cameras.
  • RAF – Fuji CCD-RAW Graphic File. Exif (Exchangeable Image File) information is within the file along with the image.
  • X3F – Sigma Camera RAW Picture File. Use the SIGMA Photo Pro software provided with the camera to download and manipulate the photos. The Foveon X3 direct image sensor captures all three colors at every pixel location and requires special software to manipulate the RAW files.
  • BAY – Kodak/Roper Bayer Picture Sequence. A specific Kodak picture format used by some high speed video cameras such as Kodak HRC-1000.
  • ORF – Descent 3 Outrage Room Format.
  • MRW – Minolta Diamage Raw Image File. Raw image format for some Minolta digital cameras.
  • RAW – Image Alchemy HSI Temporary Raw Bitmap
  • SRF – Sony DSC-F828 Raw Image File. CCD-Sensor RAW Data File from Sony DSC-F828 8 megapixel digital camera.

 

ST373454LC Unusual RAID drives

ST373454LC Unusual RAID Drive
ST373454LC Unusual RAID Drive

We have recently recovered a RAID 5 array which consisted of three of these ST373454LC SCSI hard drives. These are solid, weighty drives, which don’t give off a great deal of vibration, despite spinning at 15,000 rpm; 3 times faster than most laptop hard drives!

Upon opening one of the drives for cleanroom rework we discovered why these drives  spin so quietly. In the picture below you can see that although the drives are standard 3.5″ form factor, they actually have 2.5″ disk platters. These smaller disks create less drag, and therefore can spin faster without stability problems.

Inside a ST373454LC Hard Drive
Inside a ST373454LC Hard Drive

These drives are not alone in mixing up the form factors. The popular WD Raptor drives also use a similar design.

Downside?

Of course the biggest downside to using smaller disks is the lower storage capacity. Typically SCSI hard drives are much lower capacity than their SATA counterparts, so this trade-off is acceptable for the speed and reliability increases. The relatively low capacity is further mitigated when the drives are used in RAID arrays.

Old Quantum Pro Drive 250 MB 50 Pin SCSI

Old Quantum Pro Drive 250mb 50pin SCSI

This hard drive was opened in our clean room for internal rework. In the process we found that the rubber crash stops attached to the VCM magnet were perished.  They were oozing sticky rubber solution contaminating the drive internally. A word of warning to anyone who may still have one of these hard drives with critical data. I would recommend back up and replacement. This particular hard drive was from a synthesiser that had stopped working.

Archiving Old Data

Data Recovery Software - Do Not Erase!
Data Recovery Software - Do Not Erase!

I recently read a brilliant article about the guy that wrote the original Prince of Persia game for the Apple II in the 80’s. He had long since lost the original source code, until an old box of floppy disks was uncovered in his father’s apartment.

Sensibly, he enlisted some experts to help with the data extraction, and after a day of collaboration was able to release the source code online.

This got me thinking. Although I am meticulous with my backups of current data, I still have boxes of old software on floppy disks, which are happily degrading as we speak. John even found an old 212.6MB hard drive with some vintage data recovery software on it. Now this stuff isn’t always useful, but occasionally a really old drive comes down to us, and it is only this old software that can do the job.

As a result, John and I have started a project to get all of our old data recovery software from floppy disks and hard drives, and back it up to our file server. The 212.6 MB hard drive in the picture had 128MB of old DOS recovery software, which would easily fit on my mobile phone. Who knows when we might need it, but we now have it available when the need arises.

Cheap USB Pen Data Recovery

Cheap USB Pen Data Recovery

Our low cost USB Pen & Camera Flash Media Recovery Services can recover data from physically broken, formatted and deleted USB Pens & Camera cards. 

We have just received an 8GB USB pen with a broken connector. The customer started phoning around and was shocked by the costs he was given. He then called us and was pleased to hear that we only charged £90.00 if the rework was successful. This rework includes dismantling and repair of the USB Pen even when it appeared to be beyond repair.

The recovery was 100% successful.

PC World Data Recovery Know How Now Who?

We recently noticed our local PC World store has stopped advertising data recovery services. They used to offer a simple in-house recovery backed by a large international partnership to take care of the more difficult drives.

At some point, maybe around the time Know How replaced The Tech Guys for their support, things seem to have changed. Users are now left wondering where to go, and who to trust to recover their precious data.

This could be a blessing in disguise for users, as they can now choose any data recovery service, potentially saving some money.

Some tips for choosing a good data recovery lab:

  1. Give them a call and ask some questions. If you don’t like the answers then go with your instinct and try somewhere else. Data recovery takes care and attention to be carried out successfully, but don’t let somebody baffle you with jargon.
  2. Look out for additional costs. If you see adverts for £99 or less then be wary of costly hidden extras. Get all costs up-front. Note that you will probably need to add the cost of a new drive to the final bill, unless you supply one.
  3. The most you should pay without getting any data back is a small diagnosis fee. Unless you need urgent out of hours work, you shouldn’t pay hundreds without first seeing a file list, or being talked through the data by phone.
  4. Until the data has been recovered, then it is impossible to say that it can or can’t be done. Don’t rely on promises or estimates.

If you need data recovery then give us a call. We have services to suit home users and businesses, and have been in the industry for over ten years.

Bang Goes The Theory Data Recovery

Bang Goes The Theory – Series 6 Episode 3 – March 26th

Bang Goes The Theory Data Recovery

I love Bang Goes The Theory. I loved the alcohol powered motorbikes last week and find it a good doorway into ideas, which are presented in a fun and interesting way. I was extra excited when I started watching episode 3, and relised they would be featuring data recovery. A perfect opportunity to dispel some common myths, and dish out a bit of advice in the process.

Deletion

The data recovery guy Rob, made a good analogy when he described deleting data as ripping out a page from the table of contents. That is pretty much how it works, and really simple to understand.

Data Recovery Experts

Yes they are the world leaders. I’m not going to dispute that, but I’m also not going to name them. They don’t exactly need the extra publicity. It’s worth noting that any decent recovery firm would have reached the same results from the batch of damaged drives.

Getting Physical

I do have a couple of problems with the way some of the drives were “destroyed.”

  1. Sledgehammer. This would have been a good way to destroy a drive, but only if it had been removed from the PC first. Effectively the metal PC case acted like armour, thus protecting the drive from the brunt of the impact.
  2. Tractor. Same as above. If the drive was bare, and on solid ground, then maybe the tractor would have done more damage. Instead, the PC case protected it sufficiently and all the data was recoverable.
  3. Golf Swing. This was great in the example shown, but is a bit unreliable. If you only hit the edge, or if the disk didn’t have glass platters then it may have been recoverable. Maybe take it apart first, then you can see if it’s damaged.
  4. Tea Damaged USB Pen. This was a good one. Solid state storage should survive liquid damage, as long as it is powered off at the time. When dried out, there is a good chance of getting the data back. The worst thing you could do is plug in a wet drive, as this would cause an electrical short, and potentially damage the electronics of the device, and even the computer you plugged it into.
  5. Big Magnet. This was a good one, and surprisingly effective. Only problems are the fact that most people don’t have a giant magnet, and unless you test it afterwards, you wouldn’t know if it had worked.
  6. Toaster. This is an interesting one for me. Of course the toaster damaged the PCB (circuit board) of this hard drive. These drives were quite old, so that was no major problem. If however these were more modern drives the story could have been quite different. A lot of newer drives encrypt the data using keys stored on the PCB. If you melt that PCB, then you have a very difficult job on your hands.
  7. Torched. 100% successful. If you can see the drive destroyed, then that’s perfect.

Optical Discs

Liz later made some good points about the reliability of CD / DVD storage. I agree that although the quoted life spans of DVDs are enormous, in reality DVDs often only last for a couple of years. We have had discs in for recovery that have been stored in temperature-controlled server rooms that have still failed well short of their estimated lifespans.

Hard Disks

Hard disks can last for ages. We have some here that are well over 15 years old and still going strong. The problem is that they can fail without any warning. It is sound advice to backup one drive with another, and then another. This is the only surefire way to avoid being stung by a failed drive. Dallas made a good point of moving one of the backups off site, which is also a good idea.

Scrambling Software

I didn’t like the scrambling advice given near the end. There are problems with the way hard drives are designed, which can prevent the software from accessing bad sectors, and hidden parts of the disk. Although only small parts of the disk, you could leave enough data there to be targeted by fraudsters or whoever.

I advise a two pronged approach. First erase / scramble the data, then physically destroy the drive. This makes it far less likely that your data could end up in the wrong hands.

Summary

It is good to see this sort of thing on mainstream TV, and the advice given was a good starting point for most people. Despite my points above, it was basically a good show: Interesting and informative, with a decent amount of good info.

Many people have little or no knowledge of the way their data is stored, so any way to bring this to their attention is good in my books.

Maxtor N40P Hard Drives Still Around

These old slim Maxtor IDE 20 & 40GB hard drives are prone to start up problems. When they fail, it sounds like a mechanical problem as the heads cannot settle and make a clicking noise. They also do not show up correctly in a computer bios. This generation of Maxtor disks are known for firmware corruption, which is usually the fault.

We have just received one in for data recovery with the usual failure. With our past experience we have been able to overcome the problem without having to open up the drive in our cleanroom.

Maxtor has been sold to Seagate so if you need data recovery, have a look at our Seagate Data Recovery Services.

Slim Maxtor hard disk data recovery

Hitachi Model HTS5450 Notebook Hard Drives

Hard Drive Data Recovery

If you have a failed Hitachi hard drive, you may be interested in our Hitachi Data Recovery Services. We have been receiving Hitachi HTS5450 hard drives for data recovery since 2010. The majority of them appear to show a similar failing symptom, resulting in access to the data becoming more and more difficult.

After experience recovering several of these hard drives we have discovered that the problem appears to be trouble reading from the disc media. This may initially have been caused by the internal read and write heads writing bad data or the disc media itself suffering some mis-alignment or deteriorated magnetic coating.

Whatever the cause, the rework to overcome this can be a slow and very deliberate process. Anyone with one of these hard drives should make sure to back up regularly and any signs of slow or difficult access, you may want to think about replacing the drive.

If you have a failing 5450 drive, then it is important that you don’t try to fix or repair the drive in any way.  It will make things much worse. First try to copy off important files. If that doesn’t work then it may already need a professional recovery process.