Some tests carried out by the “Non-Volatile Systems Laboratory” have revealed some serious flaws with SSDs ability to be securely erased. When using standard tools designed for spinning disks, the results were understandably bad. They also tried the built-in “Security Erase Unit” command and the results of this were generally not good. After being securely erased, most of the SSDs still contained some large fragments of the test files.
Some secure erasure software would be similarly inefficient for hard disks anyway, as things like remapped or bad sectors can still contain readable data which may not be erased during the process.
The simplest solution for securely erasing any data is to completely destroy the storage media. For hard drives this means making a real mess of the platters, for SSDs it means wrecking the whole PCB, data chips and controller chips.
We are still seeing these drives failing even after nearly 4 years. This just shows that there is no specific time stamp when these drives are going to fail. So anyone out there who still owns a original mac book with its original drive needs to make sure a regular back up is in place.
Users of PGP Whole Disk Encryption for Mac are advised agains the recent system update to Snow Leopard 10.6.5. Reports of users getting stuck in a reboot loop after the update have been appearing on PGP forums. The official advice is to first decrypt, then install the update, then encrypt again. More details of this can be found on Threatpost, with links for people that have already performed the update and are now locked out of their systems.
Sophos have recently announced a free version of their Antivirus software for Mac. The software has low system requirements and will find and quarantine Mac and Windows viruses, trojans and worms.
One word of caution comes from a Mac user who lost his entire Time Machine backups while using the new software. Sophos have been quick to mention that their software has been used on Macs for many years, and by hundreds of thousands of new free users without problems.
What this really shows is that if you delete files from you mac then your Time Machine volume is no longer a backup but the only live copy of the files. Either make multiple backups or leave the files on the original volume after backing them up. Also be aware when installing new software that you should have backup copies of your data in case it all goes wrong.
It was interesting to read this article recently which shows how strong current encryption technology is. The FBI and other organisations were apparently unable guess or crack the pre-boot passwords of criminal’s hard drives using a technique known as a dictionary attack. As it’s name suggests, a dictionary attack uses a combination of known words to attempt to guess the password. This is opposed to a brute force approach which would start from one series of characters and continue in a sequence to guess possible combinations.
It is worth remembering that if you are going to encrypt your hard drive that even the FBI can’t access your data if you forget the password. Also if the bootable part of your hard drive becomes unstable, it can be almost impossible to gain access to your data, even with the password. Make sure you test out your disaster recovery process on an encrypted drive, before you trust your crucial data to it. And also make backups somewhere that can be accessed quickly if required. Some large drives can take a day to decrypt even if they are fully functional.
A new 3TB drive is looming on the horizon, yet this may not be the breakthrough it seems. There appears to be major problems in the way older versions of Windows handle drives above 2.1TB. Windows XP and below will be unable to make use of these drives in any meaningful way, with some reports suggesting that only 990MB of usable capacity would be available to these vintage operating systems. It sounds like one more nail in XP’s coffin. If you need this mountain of storage it seems like it’s time to ditch XP already!
I will start by saying that we can, and have, recovered data from these drives. As with all RAID recovery we carry out, we never use the original controller or drives to access the data. We image the drives on an individual basis and then work on these drives to rebuild the RAID using a form of RAID emulation. The most time consuming part of this type of recovery is discovering the RAID settings that the manufacturer has used.
Due to the complex nature of these NAS devices, we always recommend they are backed up to another form of media. Although recovery is possible, it can be expensive and relatively time consuming. Also if the unit is powered on and RAID rebuilds are attempted then the recovery can be made more complicated or even impossible.
A Little Background
The LaCie 5Big NAS device contains five hard drives and allows for a number of different configurations. One of these configurations is RAID 6, which works in much the same way as RAID 5, but with an additional parity stripe. This additional parity stripe uses an algorithm which requires a relatively high processing overhead, so RAID 6 has rarely been seen in consumer level devices. The low cost of processing means that RAID 6 is now a viable option for embedded NAS devices such as the LaCie 5Big.
The advantage of RAID 6 over RAID 5 is that with 5 disks it can theoretically cope with two disk failures. This gets round an increasingly common problem with large capacity RAID 5 arrays where if a second disk fails whilst rebuilding a failed disk, there should be enough parity information to continue the rebuild successfully.
It is important to remember that due to the complex nature of RAID arrays, it is crucial to make backups of the data to a different type of storage.
If you have a failed or broken LaCie 5Big then use the contact details on the right to contact us. Alternatively you can leave a comment here and we will get back to you.
We have received two of these failed drives recently in succession. Further clean room examination has confirmed that the spindle stack has detached itself from the motor base and coil. When first handling the drive it becomes quite obvious that this has happened as you can actually feel the pack rattling. Surprisingly we cannot see any physical damage on the media or contamination and fortunately the clamp has kept the pack secure. We would not recommend spinning the drive up in this condition. The only rework available is to transfer the pack into a good Seagate donor as part of the recovery process. Pack alignment is a critical part of this process.
We have recently started to see a peak in the number of 500GB WD drives sent to us from Western Digital MyBook World edition NAS Servers. These NAS devices use two WD5000AAKS drives in a RAID configuration.
The worrying thing for users is that even drives used in RAID 1 mirror mode are having problems, where either both drives are failing at the same time or where one drive has failed in the past and the other following suit some time later.
It is an important reminder that RAID does not equal backup. If there is important data on these types of devices, it also needs to be copied to another device for peace of mind.
We are currently able to recover the data from these devices using a combination of firmware repairs and other recovery methods.
An interesting note is that we have also seen a small increase in other WD drives at the moment, such as the 320GB WD3200AAJS drives from iMacs and WD5000AACS drives from external enclosures.
We are a specialist data recovery company in Hampshire recovering data from corrupt, defective and faulty hard disk drives. We are based in Copnor, Portsmouth and are an independent company, not part of a franchise. All of our work is carried out at our site, and not sent on to another company.
We offer data recovery on a national service. Some of the main areas we cover in Hampshire are Portsmouth, Southampton, Hayling Island, Isle of Wight, Gosport, Fareham, Basingstoke, Havant, Waterlooville, New Forest, Andover, Emsworth, Petersfield, Romsey, Winchester, Alton and Aldershot.
Our speciality is recovering data from hard disk drives, but we can also recover data from USB Pens, Camera flash cards and CDs, DVDs.
PC or Mac, we can recover either. Windows, Linux or Mac OS.
If you would like to use our data recovery service, please use the contact link near the top right of this page.
Our address is Dataquest International Ltd, 24 Domum Road, Copnor, Portsmouth, Hampshire, PO2 0QZ, United Kingdom.