With the recent floods in the United Kingdom, it is important to know that time can be a critical factor when trying to recover data from mechanical hard drives that have been submerged or damaged by water. Most mechanical hard drives have breather holes that may allow water to enter the hard drive enclosure if submerged. If this is the case then the longer the hard drive is left in this condition the worse the internal damage. Even if the hard drive is left to dry out, internally the damage has already been done. Our advice is not to try this if the data is critical to you or your business.
Any water damage hard drives that we receive go straight into our clean room environment to be dismantled and dried out internally. The hard drives external electronics would also require a cleaning process to prevent any electrical shorting caused by the water residue.
Although Solid Sate Hard Drives ( SSD ) do not have any mechanical moving parts, they are still prone to damage to the data chips and electronics by residue left by the water. Very much as mechanical hard drives they would require dismantling and specialist cleaning to ensure no electrical shorting of components.
These notebook size drives must be popular at the moment as we have started to see a fair few of them come into us. Last month we saw three of them alone with no spin failures. When opened in our clean room we have found that the internal mechanical heads have prevented the motor and discs from spinning as a result of the heads sitting on the disc media. In normal operation the heads should never touch the discs but fly above them carrying out the reading and writing. When the drive is not in use or idle the heads will locate on a parking ramp at the side of the discs. If power to the hard drive is lost while it is reading or writing then this will cause the heads to drop onto the discs and not onto the parking ramp. Once reworked in our internal clean room they were all recovered successfully.
A common cause of this, is the unplugging of the USB cable incorrectly.
When you hear of data recovery companies using disk imaging as part of their process, this is done to create a Bit by Bit copy of the customers hard drive. This then allows work to be carried out on a copy instead of the original. It can also be used to take the data off the customers hard drive in a controlled manner, especially when the hard drive shows signs of being unstable. In those situations this process usually works well and has a very good success rate, but what if the customers hard drive is part of a criminal investigation that requires forensic evidence for court proceedings.
This then takes the whole disk imaging process to a different level. A hard drives data storage is not as straight forward as it appears when you see it on your computer. The hard drive manufacturer allows the user access to the majority of the hard drives storage space, but there are areas of the drive that are kept free and protected (HPA) for use by the manufacturer only. It is these areas that are not normally carried over in a standard Bit by Bit imaging process used by most data recovery companies.
Technically If someone wanted to hide specific data and had the use of specialist tools, they could hide data within these protected areas. There are also many other alterations, that can be carried out to a hard drive to hide user data, so it can be a bit of a mine field for forensic data recovery. To read a more detailed technical description then please see the following article about Forensic Imaging.
If there is data on the drive that you cannot afford to lose, then do not try to fix the drive yourself. I would also suggest that you do not even try to power it back on after it has been dropped, as this is what usually causes the most damage. Whether your drive is an external desktop drive or a small portable one, they all work in the same way. Broadly speaking the inside of a hard drive is a bit like a record player with a mechanical moving needle reading the vinyl record. I can remember the times when playing old vinyl records, once you got scratches on them they never really worked the same again.
So I recommend not to panic, decide on what the value of the lost data is to you. Sometimes it may not be money value but a sentimental one. Once you have decided, then carry out some research online and look at data recovery company reviews. From our experience with dropped drives, the amount of work involved in overcoming the problem would not be covered by the low initial cost that some data recovery companies advertise and therefore the cost would soon escalate.
There is always hope of recovering data from a dropped drive but as you have read, it depends on your actions as to the eventual outcome.
This OWC external enclosure is a common sight on the desks of Mac users with big storage needs. It’s a pretty standard 4-bay box, styled somewhat like a cousin of a PowerMac G5 or 1st generation Mac Pro. Inside are the usual options of RAID 0 to RAID 5 with a few additions like JBOD & RAID 10 thrown in for good measure. There are a few variations of this device but the back panels commonly have USB, Firewire, and eSATA ports for direct connection to a PC or Mac. There is no ethernet port on these drives which makes the Qx2 a DAS (Direct Attached Storage) rather than NAS (Network Attached Storage).
Aside from massive name, the OWC Mercury Elite Pro Qx2 also comes with a potentially huge amount of storage. Currently up to 32TB on the OWC store, but also available diskless or BYOD (Bring your own disks). With so much storage space, these drives often become the one and only repository for vast lumps of important data. The benefits of RAID give a false sense of security that the data is safe from drive failures. Unfortunately, there are a number of reasons why the RAID array alone will not protect from certain failures. Most of these failures can be overcome by us in our workshop, but they are not one-button fixes. It is helpful to understand why a seemingly rock-solid platform can be even more risky than a simple external USB drive.
Under common settings, the Qx2 will use RAID 5 for the array. With four 2TB drives this gives you a 6TB volume on a Mac or ~5.5TB on a PC, and can cope with a single disk failure. There is a lot of debate about how good RAID 5 really is for such large drives. In our example this means that if a single disk fails, it will need to be replaced, and then the new disk rebuilt with 2TB of data calculated from the other disks. This will take many hours, even under optimal conditions, but if anything goes wrong before it completes the array could stop showing up all together. At this stage, the data is probably recoverable but don’t panic. One wrong move and the data could be gone for good.
If the data is crucial then get assistance from a RAID recovery service now and you should get back all or most of the data.
If any disks are removed or replaced at this point the array could get reinitialised and either make the recovery more complicated or wipe the data completely.
Aside from all the problems with a RAID setup, the volume could also fail in the same ways that a standard hard drive can. There could be deleted files, a reformatted or corrupt partition, or even the RAID controller failure. RAID cannot protect against those types of failure at all.
Our first step would be making read-only copies of each disk in the array. This protects against further disks failing, and also allows us to work from copies without risking the original disks. In fact, once the disks are copied, we put the originals to one side and don’t touch them again until all the data is recovered and supplied back to the user.
Once we have our copies, they are loaded into our own hardware where we recreate the RAID in a virtual environment. Again, we don’t use the original hardware, as that may have been the root cause of the problem.
When the virtual RAID has been loaded and all the data extracted, the files are supplied back on whatever alternative storage is suitable, (not the original device!) Once the data has been delivered to the user, and backups made, the old unit can then be destroyed, or returned and reused.
Anyone using RAID on a regular basis should know that RAID is not a replacement for backups. If anything, the increased number of disks makes failure more likely. This needs to be addressed by either making backups to another device, or an online service (preferably both). You ideally want backups that keep historic versions of the files, so that inadvertently deleting a file or changing a file by mistake will not also replace the backup version.
If you are having problems with an OWC Mercury Elite Pro Qx2, give us a call or send a message via the form on this page. We give free advice and could help you avoid permanent data loss.
1. Macs now use 1000 bytes for 1KB but PCs use 1024 bytes.
2. Even RAID 6 does not solve the long time required to rebuild a disk, even though it allows for two disk failures.
Just recently we received a failed HTS543232L9SA0 out of a Macbook Pro. When we proceeded to carry out the initial diagnosis we noticed that the drive capacity was 160GB and not 320GB as the model number suggests. The Model number should have read HTS543216L9SA0. This particular hard drive has a black label which is different than most Hitachi drive labels of the same type. When we opened the drive in our clean room we found that the drive only had two heads compared to a 320GB which has four. When the drive is attached to our hardware or a PC it Identify’s correctly as a HTS543216L9SA0.
Once again we had an enquiry from a customer who was at her wits end and wanted a second opinion. She had spilt coffee on her laptop that had all her family photographs. She had taken it to PC World where she had originally bought it. They advised her to use their internal recovery process, and sent it off for analysis. She was eventually told that there was no chance of recovering her data from the liquid damaged hard drive. But fortunately for her, against the advice she received, she decided to search online for another data recovery company. This is where we came in. Although the hard drive was covered in sticky coffee and damaged by the liquid, we were able to overcome the problem and recover all of the data for the customer. Once again another happy customer as a result of a second opinion. This is becoming a habit.
PGP WDE is an encryption tool that uses a boot loader installed on an internal hard drive. This utility launches before Windows and prompts the user to input their password. Without the password you cannot gain access to the data.
This utility is widely used by IBM personnel and is now part of IBM’s process that has to be adhered to by end users. Prior to this utility IBM hard drives were restricted access by a low level ATA hard drive password setup by the internal IBM IT department. As computer systems advanced and maybe as a result of a reduced IBM IT department, IBM adopted the user friendly PGP encryption process.
We regulary receive these hard drives from IBM, and we find that the major problem is related to the PGP boot sequence. PGP does not like a hard drive that is suffering from bad sectors, especially within the partition table. It results in the user being unable to load their access code on startup, or in some cases the code is accepted but does not boot correctly due to bad sectors further along.
We have a lot of experience recovering data from PGP whole disk encrypted hard drives and as a result our data recovery process has a very high success rate.
Like most external hard drives, Buffalo external drives are simply a wrapper around a regular hard drive. Aside from the protective shell they also have some electronic parts to convert between the internal hard drive and the external USB, Firewire, eSATA or Thunderbolt connections.
If you have problems with an external drive, you can perform a relatively simple test to check where the fault lies. Be aware that opening the external drive case will probably void your warranty, and if there is crucial data on the drive you should seek professional data recovery. That’s the obligatory warning out the way, so lets have a look at some troubleshooting.
First check all cables are plugged in securely, and not damaged or frayed near the ends.. If you have an identical drive with spare cables try them, but make sure you don’t plug in a power supply with different voltage! Hard drives don’t handle extra voltage well so you’ll end up in a worse position than you started.
If you know how, you could remove the hard drive from the external case and attach it directly to a PC to see if that allows access to the data. If it does, you should copy the data off straight away. The drive could still be faulty & fail again soon.
Whatever you do, don’t dismantle the actual hard drive. Hard drives are built in controlled clean-air environments and even the smallest spec of dust can cause permanent damage to the drive.
Since the introduction of unique ROM chips on the hard drives, it is often no longer possible to exchange circuit boards with another hard drive to access the data. In our experience circuit board problems are far less common than they used to be.
Now in a new 7mm slimline form factor, and Advanced Format specification, the HTS5450 hard drive is proving a popular choice for vendors with limited space. The drives are especially popular in Ultra thin laptops and slim portable external cases. Now being manufactured by Western Digital under the brand name of HGST, the 500GB boasts just a single media platter to store all that data. Part of the redesign also brings Advanced Format to these drives. Certain older operating systems such as Windows XP require the use of the HGST Align Tool provided by Western Digital. Users of the latest OS X systems and Windows 7+ do not require the use of this Tool.
Advanced Format has been introduced to cram more data on a single platter. To do this the manufacturer has increased the standard 512 byte sector size to a 4096 byte sector. This format design also incorporates better data integrity, hopefully giving the customer all round better performance and reliability.