We recently completed an extremely difficult recovery from a fire damaged hard drive. The drive was stolen from an Annke CCTV system during a burglary and then set on fire.
This is what we received:
Despite looking like it had fallen from space, we could recognise that it was a Seagate drive. Most of the label was burnt off.
Where to start with the recovery
It’s easy to get overwhelmed by a case like this, but it’s important to break the problem down into manageable chunks. First we needed to extract the unique information from the circuit board (PCB). The board was black and charred from the outside, but the delicate underside was still green, and it looked like the main components survived. With a little bit of a clean-up we were able to read the required info and transfer it to a suitable (non-burned) donor board.
Next, we needed to turn our attention to the inside of the drive. We gave the outside a thorough clean first, to avoid transferring contamination inside. Then we opened up the drive to assess the damage. The gasket between the top cover and main device had turned to a gluey mess, so we had to be careful separating the two.
It’s important to point out that we haven’t attempted to power up the drive so far. Spinning up a drive in this state will never end well, and it’s a good job we didn’t. The heads were melted into a plastic blob that was once a parking ramp, and the particle filter was transformed into a stiff little pillow. By some miracle, the discs (platters) themselves were in surprisingly good condition. The pack of discs was also turning freely, so the motor was not stuck.
We replaced the filter with one from a similar drive, but the heads would be the real challenge. It wasn’t possible to read the exact label information (it was burnt off), so confirming a match for a suitable donor was a challenge. We could read some of this missing info from the circuit board that we’d backed up earlier. There was another worrying sign on what was left of the label. A warning that the Warranty was valid only in China, and Exclusive to China. We worried about trying to source such a drive if it was only intended for the Chinese market.
We did find a suitable donor, and installed the new heads and parking ramp into the drive. We also borrowed the new top-cover as it was clean, and still had a proper gasket.
Moment of truth
The drive came ready, and although it was reporting some problems, allowed basic access. We were able to carry out our usual Seagate process, and start cloning sectors to another drive. This process went extremely well, and only tripped up a handful of times. In the end after multiple passes, we had skipped just 100MB of the drive due to errors, and successfully extracted the 2-3TB of CCTV footage.
In total, the whole process took just under three months, mostly due to delays finding a suitable matching donor, and then the careful imaging process.
The best part of the story is that the burglar was clearly visible in the footage so will hopefully be brought to justice.
Leave a Reply