Dan has been a data recovery engineer at Dataquest International Ltd for over 8 years. When not recovering data, Dan can often be found writing articles, maintaining this website, or riding his old bicycle around Portsmouth.
It was interesting to read this article recently which shows how strong current encryption technology is. The FBI and other organisations were apparently unable guess or crack the pre-boot passwords of criminal’s hard drives using a technique known as a dictionary attack. As it’s name suggests, a dictionary attack uses a combination of known words to attempt to guess the password. This is opposed to a brute force approach which would start from one series of characters and continue in a sequence to guess possible combinations.
It is worth remembering that if you are going to encrypt your hard drive that even the FBI can’t access your data if you forget the password. Also if the bootable part of your hard drive becomes unstable, it can be almost impossible to gain access to your data, even with the password. Make sure you test out your disaster recovery process on an encrypted drive, before you trust your crucial data to it. And also make backups somewhere that can be accessed quickly if required. Some large drives can take a day to decrypt even if they are fully functional.
A new 3TB drive is looming on the horizon, yet this may not be the breakthrough it seems. There appears to be major problems in the way older versions of Windows handle drives above 2.1TB. Windows XP and below will be unable to make use of these drives in any meaningful way, with some reports suggesting that only 990MB of usable capacity would be available to these vintage operating systems. It sounds like one more nail in XP’s coffin. If you need this mountain of storage it seems like it’s time to ditch XP already!
I will start by saying that we can, and have, recovered data from these drives. As with all RAID recovery we carry out, we never use the original controller or drives to access the data. We image the drives on an individual basis and then work on these drives to rebuild the RAID using a form of RAID emulation. The most time consuming part of this type of recovery is discovering the RAID settings that the manufacturer has used.
Due to the complex nature of these NAS devices, we always recommend they are backed up to another form of media. Although recovery is possible, it can be expensive and relatively time consuming. Also if the unit is powered on and RAID rebuilds are attempted then the recovery can be made more complicated or even impossible.
A Little Background
The LaCie 5Big NAS device contains five hard drives and allows for a number of different configurations. One of these configurations is RAID 6, which works in much the same way as RAID 5, but with an additional parity stripe. This additional parity stripe uses an algorithm which requires a relatively high processing overhead, so RAID 6 has rarely been seen in consumer level devices. The low cost of processing means that RAID 6 is now a viable option for embedded NAS devices such as the LaCie 5Big.
The advantage of RAID 6 over RAID 5 is that with 5 disks it can theoretically cope with two disk failures. This gets round an increasingly common problem with large capacity RAID 5 arrays where if a second disk fails whilst rebuilding a failed disk, there should be enough parity information to continue the rebuild successfully.
It is important to remember that due to the complex nature of RAID arrays, it is crucial to make backups of the data to a different type of storage.
If you have a failed or broken LaCie 5Big then use the contact details on the right to contact us. Alternatively you can leave a comment here and we will get back to you.
We have recently started to see a peak in the number of 500GB WD drives sent to us from Western Digital MyBook World edition NAS Servers. These NAS devices use two WD5000AAKS drives in a RAID configuration.
The worrying thing for users is that even drives used in RAID 1 mirror mode are having problems, where either both drives are failing at the same time or where one drive has failed in the past and the other following suit some time later.
It is an important reminder that RAID does not equal backup. If there is important data on these types of devices, it also needs to be copied to another device for peace of mind.
We are currently able to recover the data from these devices using a combination of firmware repairs and other recovery methods.
An interesting note is that we have also seen a small increase in other WD drives at the moment, such as the 320GB WD3200AAJS drives from iMacs and WD5000AACS drives from external enclosures.
We are a specialist data recovery company in Hampshire recovering data from corrupt, defective and faulty hard disk drives. We are based in Copnor, Portsmouth and are an independent company, not part of a franchise. All of our work is carried out at our site, and not sent on to another company.
We offer data recovery on a national service. Some of the main areas we cover in Hampshire are Portsmouth, Southampton, Hayling Island, Isle of Wight, Gosport, Fareham, Basingstoke, Havant, Waterlooville, New Forest, Andover, Emsworth, Petersfield, Romsey, Winchester, Alton and Aldershot.
Our speciality is recovering data from hard disk drives, but we can also recover data from USB Pens, Camera flash cards and CDs, DVDs.
PC or Mac, we can recover either. Windows, Linux or Mac OS.
If you would like to use our data recovery service, please use the contact link near the top right of this page.
Our address is Dataquest International Ltd, 24 Domum Road, Copnor, Portsmouth, Hampshire, PO2 0QZ, United Kingdom.
There have been some new reports of drive issues in the new MacBook Pros. It seems that the updated Seagate 7200rpm drives are getting a bit noisy at times and clicking. No reports that this causes anything particularly sinister, but after the (still ongoing) MacBook headcrash fiasco, it’s bad news to see another problem between MacBooks and their drives. There are suggestions that the new 7200.4 G-Force drives are noisy due to some new anti-shock technology. It sounds obvious that a drive spinning at 7200rpm is going to generate more noise than a 5400rpm drive. We’ll see what happens with this one. Updates to come I’m sure.
Seagate Barracuda drives are often thought of as premium quality hard drives, which is largely true. The build quality of these drives is solid and they feel heavy and look good when compared to some other drives. They are however still susceptible to the same failures and problems which affect other hard drives.
A common problem with Seagate Barracuda drives is firmware corruption (sometimes known as SA Corruption). This is something which can be fixed without taking the drive apart, however sometimes the extent of the corruption can prevent it from being repaired at all. The usual faults are corrupt log files which prevent the drive from performing it’s usual startup routine. Once corrected, the drive can usually be accessed for long enough to extract the required data using a controlled imaging process. Sometimes further repair is required in order to continue extracting data. Corrupt firmware can be an indication that there is an underlying problem with the drive. For example, if the drive is writing hundreds of bad sectors into the S.M.A.R.T log, it is likely that there is a problem with either the heads or the disk media which is causing the errors. Although the S.M.A.R.T counters can be reset to zero, they will quickly fill up again. The best option in this case is to recover your data and scrap the old drive.
Seagate drives have been used in G4, G5 & Intel Macs from Mac Pros to iMacs and various other PCs, such as Packard Bell and Compaq machines. We now also see Seagate Barracuda drives which have been used in external USB / Firewire enclosures. This opens up a new problem which these drives were not originally built to withstand. ie. Shock. External drives can be shocked, either by being knocked over or dropped. If the drive is reading or writing at this time it could cause a head crash, as it would with most other brands of drive (although modern 2.5″ laptop drives have protection for this type of shock). If the drive was not in use at the time of impact, the motor can still become stuck and fail to spin up. The motor spindle is attached to the hard disk casting, so the best way to gain access to these types of drives is by transplanting the disk pack into a known good casting (with a good motor).
Seagate Barracuda drives are also prone to electronic damage caused by faulty power supplies or having the power connector incorrectly inserted. It is often necessary to repair the damaged PCB, as it contains unique information which would not be present on a donor part.
We have had a lot of success recovering data from these hard disks and as long as they haven’t been dropped or knocked over, we can usually recover then externally without moving into a cleanroom.
We have recently been trying out FreeNAS as a way to add some storage to our internal network. First impressions are positive. We are able to utilise an old spare low power PC to run the software from a compact flash card. We currently use four 1TB drives in two separate hardware RAID 0 arrays. This gives us two 2TB volumes which we can access over the network on either Windows (SMB/CIFS) or Mac (AFP).
Setup was simple, by booting a liveCD and choosing the 64MB compact flash card to install to. Once setup, the server can be run headless (without a monitor) and configured via the handy web interface. It is possible to setup hard disks, file sharing protocols, and even a transmission torrent server and iTunes music server, all directly from the web interface. The web interface also shows the status of CPU and memory usage and can also provide graphs for disk access and network throughput.
It takes some minor setup to access the drives in Windows by mapping the network drives, however no setup is required on the Mac end. The server shows up in the finder sidebar and is just a click away from the network volumes. An overview from the FreeNAS website is included below:
FreeNAS is a free NAS (Network-Attached Storage) server, supporting: CIFS (samba), FTP, NFS, AFP, RSYNC, iSCSI protocols, S.M.A.R.T., local user authentication, Software RAID (0,1,5) with a Full WEB configuration interface.
FreeNAS takes less than 32MB for version’s up to 0.686.x and 32+ MB from version 0.69
Can be installed on Compact Flash, USB key, USB key or just run as LiveCD saving the configuration file on floppy or USB key .
The minimal FreeBSD distribution, Web interface, PHP scripts and documentation are based on M0n0wall.
I would be interested to run FreeNAS on a small form factor Atom based PC, maybe using external storage drives. The EEE Box would make an interesting FreeNAS server.
Over the years we have seen stacks of LaCie Big Disks (and quite a few LaCie Bigger Disks too). With their designer looks and an abundance of different interfaces, it is no surprise that they are so popular. There is however one main reason that people send us their drives, and that is because they are not working.
Those of you familiar with hard drives will be aware that these LaCie drives are substantially larger in physical size and storage capacity when compared to a standalone hard disk drive. The reason being is that the LaCie Big Disk contains two hard disks (and the LaCie Bigger Disk contains four hard drives). Of course when you attach the drive to your computer you only see one volume. This is due to a RAID controller inside the LaCie drive which allows for multiple disks to appear as one large, usable disk. The main advantage to this setup is that read and write speeds can be very fast, as the reads and writes are spread over multiple disks. Another bonus is that the capacity of the volume is as large as the two drives. So two 500GB drives will give you a 1TB volume. There is however a massive downside to all of this clever RAID business which boils down to some simple mathematics.
The larger the number of hard disk drives used in this particular striped (RAID 0) setup, the more chance that one of them will fail, therefore a higher chance that you will lose all of the data stored on these drives. The way a RAID 0 stripe works is to distribute the data across the disks at block level. The amount of blocks used for each stripe is determined by the RAID controller and varies between different manufacturers. What this means, from a data recovery point of view is that in order to extract data from a LaCie Big Disk, you need to figure out the block size, and read the data from both drives in sequence, in order to extract usable data. This sounds a lot more complicated than it actually is and is often explained with the analogy of a filing cabinet.
Imagine the LaCie Big Disk is a filing cabinet. The cabinet has two drawers (disks) with an index in the first drawer. Now imagine that when you save a file into the cabinet, all of the odd numbered pages are put into the first drawer, and all of the even numbered pages are put into the second drawer. Once saved, the files location is stored in the index. In order to read back the saved file, it must first be collected from the relevant drawers, one page from each drawer at a time, and arranged into the correct order.
This is all great until a problem occurs. What happens when one of the drawers becomes damaged and can no longer be opened. Sure you can access all of the pages in the other drawer but having every other page is not much use to anybody! So until you can access both drawers, the documents are worthless.
Special Hard Drives?
The hard drives in a LaCie Big Disk are much the same as any other hard drive on the market. This means they are just as likely to have the same failures as a standalone drive. They suffer from electronic problems on the PCB, firmware corruption and also internal component failure and head crashes. These are problems which need to be overcome before any attempt at a recovery is even possible.
Aside from the usual hard drive problems, we have also seen other problems such as failed power supplies or damaged circuit boards within the LaCie Big Disk, which prevent access to the stored data.
This is why we have spent a lot of time researching the process of recovering data from RAID systems such as the LaCie Big Disk. We follow the same precautions with RAID as we do with single volume drives.
We make binary images of all of the individual hard drives on a read-only basis to protect against drive failure.
We don’t use the original hardware to read the RAID data, as this may be part of the problem.
We never write the recovered data back to the LaCie Big Disk, as this would prevent any further recovery process if it was required.
As with all data recovery, the most important thing to remember is that any attempts to access the data without following strict precautions could result in the data being either lost forever, or extremely expensive to get back.
The best advice is to keep these drives backed up as regularly as possible to avoid future headaches.
These Maxtor slimline drives are only 16mm deep compared to the usual 22mm depth for 3.5″ hard drives. This may be the reason they have been so popular in recent years. Sometimes known as “Fireball 3” or “DiamondMax Plus 8” drives, they are unfortunately prone to a number of different types of failure. One of the most common fail symptoms of these drives is for them to be identified in the BIOS by an unusual name like “Maxtor N40P” instead of the drive model number. This unusual name is known as the “factory alias” or drive “family name”. When a drive displays it’s factory alias it often means it was unable to complete it’s start-up routine, which it needs to carry out to allow you to access your data. Causes range from failed PCB components, a damaged motor, or the most common cause which is system area corruption. When these drives are functioning correctly, they will remap any bad sectors they find, and save the list of bad sectors to a log file. This works fine for a while but after some time the log can become full. When this happens, there is nowhere left for the bad sectors to be mapped to, so the log file becomes corrupt. The next time you turn on your PC, the drive will attempt to read the log file and fail, displaying the factory alias instead of the model number. I have included a list of affected drive model numbers below: