Common Data Recovery Myths Exposed

Myth 1: When files are deleted they are gone forever.

Fact: When files are deleted they are actually only removed from an index. Unless you then overwrite those sectors with new data, the files will still be there. If you delete a file it is important to stop using the computer. Even browsing the internet causes cache files and images to be downloaded to the hard drive, potentially overwriting the deleted files.

Myth 2: Putting a hard drive in the freezer will bring it back to life.

Fact: This is an old one, which will not die. We have never had to put a hard drive in a freezer. There is only anecdotal evidence that freezing a hard drive helps in any way. One of the most common types of hard drive failure is firmware corruption, which cannot be fixed in a freezer. I would be worried about introducing condensation into the drive, which could be devastating. If anyone knows where this idea came from, or how the freezer is supposed to help, then I would love to hear about it.

Myth 3: The FBI can recover anything.

Fact: The FBI are bound by the same laws of physics as we are. If a hard drive has had a head crash, and scraped the magnetic coating off the platter, there is no data left to recover. You cannot read magnetic data from particles of dust! Even the FBI can’t recover that.

Myth 4: The best way to recover a hard drive is by swapping the platters out.

Fact: In almost all cases, you should not disturb the alignment of the platters. They are manufactured within strict tolerances which cannot be recreated outside of a manufacturing environment. If the problem lies with the on-disk firmware, electronic components, or read / write heads, then swapping the platters would not solve anything.

Note – If the spindle motor gets stuck then it can be necessary to swap the platters, but only as a last resort.

What Is Hard Drive Firmware?

What is Hard Drive Encrytion

Hard drive firmware is the embedded software which controls the running of your hard drive. Most of it is stored within hidden sectors on the hard drive, and in normal operation you wouldn’t know it was there. Whenever you power up a drive, the firmware makes the motor spin, starts the read / write heads, and checks against a list of bad sectors. Only then will the computer be able to access the data area and allow you to see your files. If there is a problem with the firmware, the drive will get stuck and you won’t be able to access your data at all.

Symptoms.

Failed firmware is almost impossible to diagnose without specialist equipment. In fact, it is hard to confirm that the firmware is faulty at all. Many hard drive problems manifest themselves in the same way; by clicking, or spinning down, or just generally not being identified by the PC. You shouldn’t start changing components until you know where the problem lies.

Repair.

In the early days, most firmware could fit onto the electronic circuit board; simply swapping a damaged PCB with a good one was a common fix. Firmware is now too large to fit on the PCB, so the PCB contains just a very simple boot loader which starts off the drive and then loads the firmware from the disk surface. This means that swapping the PCB is no longer a common fix, and won’t work on most modern hard drives.

We have specialist hardware and software that allows us to check and repair the firmware on most hard drives. We have also dealt with many of these problems before and have a huge database of previous experience to draw on.

Recovering Deleted Data

In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.

Recovering Deleted Data

The Filing Cabinet

The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.

This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.

Overwritten / Deleted Data

We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.

The Problem With SSDs

Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.

Specifics

In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.

If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.

The Important Bit

If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.

Why RAID Can Be Bad For Business

RAID is often touted as the silver bullet in data storage. Increased storage capacity, resistance from hardware failures and improved performance. While these are all valid upsides to a RAID setup, there are also a few downsides which need to be addressed.

1. Extra Storage.

RAID can allow for a huge pool of storage, but with that storage comes great responsibility. You should factor in at least enough capacity to backup the RAID data somewhere else. If you can only afford 8TB of storage then you should only use 4TB for data and the other 4TB to back it up; Preferably on another machine / standalone system.

2. Redundancy.

The first letter in RAID stands for redundancy. This means you can afford to lose a certain number of disks without losing access to your data.  This also means that if you have a disk failure you need to get it replaced immediately, otherwise you’re running without redundancy.

3. Downtime.

Nobody likes downtime. If your 16TB RAID array goes offline without a backup then you have a couple of options. One option is to attempt to get the RAID back online by replacing disks, rebuilding the array etc, but this is risky. If this is your only copy of the data then rebuilding / reformatting the RAID could corrupt the data beyond recovery. Don’t do this if you don’t have a backup to fall back on.

The second and preferable option is to get the RAID professionally recovered. When we receive a RAID, the first thing we do is make images of all disks. This allows us to work on the RAID without risk. Then we use a read-only process to extract the data onto another form of storage. This is where downtime comes in. Unless you go for an emergency process, you could have to make do without the data for a number of days.

So What’s The Way Forward?

It’s one word. Redundancy.

Whatever you do, make sure your data is replicated across as many types of storage as possible. In an ideal world you would have a duplicate system running alongside the live system, which can take over if anything goes wrong. Then have the data on another type of storage, which you can access from somewhere else. Imagine if the RAID controller failed, and you could only access the data from that one machine.

It doesn’t matter how many backups you have if they all require the same system to access them.

I’ve only just scratched the surface here, but you should always look to make extra copies of your data. It may seem redundant now, but when your server fails containing all your data, all your accounts, all your client details and your website, you’ll be glad you kept that extra copy.

Accidentally Installed Windows On Top Of Mac OS X

We have just completed a complex data recovery, where a Mac system had been inadvertently overwritten with Windows. The Mac drive originally had over 500GB of data, so we expected to get most of it back, we just didn’t know how good the structure would be.

It helps to visualise the layout of the data on the disk. before it was overwritten, the data would have looked something like this:

Overwrite Mac With Windows

Although the fresh Windows system is much smaller than the original data, it prevents you from seeing any of that old Mac data.

Once we made copies of the drive, we were able to reconstruct the missing parts of the Mac data, and could see all the original files and folders, with their original structure.

Luckily nobody had tried to fix the problem with this drive. Often the fixes people attempt are worse to recover from than the original problems.

ST373454LC Unusual RAID drives

ST373454LC Unusual RAID Drive
ST373454LC Unusual RAID Drive

We have recently recovered a RAID 5 array which consisted of three of these ST373454LC SCSI hard drives. These are solid, weighty drives, which don’t give off a great deal of vibration, despite spinning at 15,000 rpm; 3 times faster than most laptop hard drives!

Upon opening one of the drives for cleanroom rework we discovered why these drives  spin so quietly. In the picture below you can see that although the drives are standard 3.5″ form factor, they actually have 2.5″ disk platters. These smaller disks create less drag, and therefore can spin faster without stability problems.

Inside a ST373454LC Hard Drive
Inside a ST373454LC Hard Drive

These drives are not alone in mixing up the form factors. The popular WD Raptor drives also use a similar design.

Downside?

Of course the biggest downside to using smaller disks is the lower storage capacity. Typically SCSI hard drives are much lower capacity than their SATA counterparts, so this trade-off is acceptable for the speed and reliability increases. The relatively low capacity is further mitigated when the drives are used in RAID arrays.

Extreme Close-Up: Toshiba Hard Drive [video]

This is a video of a functional Toshiba laptop drive. Using a macro lens, we are able to see what happens when you read or write data to or from a hard drive. You can also see how the hard drive parks the heads off the disks when the power is shut off. This is to protect the hard drive from shocks during transportation.

It’s my first one of these videos so you can see my reflection in a couple of places, when I lean over to send different commands to the drive.

Old Quantum Pro Drive 250 MB 50 Pin SCSI

Old Quantum Pro Drive 250mb 50pin SCSI

This hard drive was opened in our clean room for internal rework. In the process we found that the rubber crash stops attached to the VCM magnet were perished.  They were oozing sticky rubber solution contaminating the drive internally. A word of warning to anyone who may still have one of these hard drives with critical data. I would recommend back up and replacement. This particular hard drive was from a synthesiser that had stopped working.

Archiving Old Data

Data Recovery Software - Do Not Erase!
Data Recovery Software - Do Not Erase!

I recently read a brilliant article about the guy that wrote the original Prince of Persia game for the Apple II in the 80’s. He had long since lost the original source code, until an old box of floppy disks was uncovered in his father’s apartment.

Sensibly, he enlisted some experts to help with the data extraction, and after a day of collaboration was able to release the source code online.

This got me thinking. Although I am meticulous with my backups of current data, I still have boxes of old software on floppy disks, which are happily degrading as we speak. John even found an old 212.6MB hard drive with some vintage data recovery software on it. Now this stuff isn’t always useful, but occasionally a really old drive comes down to us, and it is only this old software that can do the job.

As a result, John and I have started a project to get all of our old data recovery software from floppy disks and hard drives, and back it up to our file server. The 212.6 MB hard drive in the picture had 128MB of old DOS recovery software, which would easily fit on my mobile phone. Who knows when we might need it, but we now have it available when the need arises.

PC World Data Recovery Know How Now Who?

We recently noticed our local PC World store has stopped advertising data recovery services. They used to offer a simple in-house recovery backed by a large international partnership to take care of the more difficult drives.

At some point, maybe around the time Know How replaced The Tech Guys for their support, things seem to have changed. Users are now left wondering where to go, and who to trust to recover their precious data.

This could be a blessing in disguise for users, as they can now choose any data recovery service, potentially saving some money.

Some tips for choosing a good data recovery lab:

  1. Give them a call and ask some questions. If you don’t like the answers then go with your instinct and try somewhere else. Data recovery takes care and attention to be carried out successfully, but don’t let somebody baffle you with jargon.
  2. Look out for additional costs. If you see adverts for £99 or less then be wary of costly hidden extras. Get all costs up-front. Note that you will probably need to add the cost of a new drive to the final bill, unless you supply one.
  3. The most you should pay without getting any data back is a small diagnosis fee. Unless you need urgent out of hours work, you shouldn’t pay hundreds without first seeing a file list, or being talked through the data by phone.
  4. Until the data has been recovered, then it is impossible to say that it can or can’t be done. Don’t rely on promises or estimates.

If you need data recovery then give us a call. We have services to suit home users and businesses, and have been in the industry for over ten years.