We recently posted on Facebook about a pair of disks that we recovered. Both had been sent around the market a little bit, so I thought they’d be worth writing about in a bit more detail.
Disk 1 – 3TB Seagate drive from an Apple Time Capsule.
The disk had previously been sent to another lab for recovery. It was diagnosed as having multiple damaged heads, a stuck motor, cracked head-ramp, and microscopic damage to the disk surface.
Our Findings
We could see the screws and seals had been tampered with on the outside of the drive. When we took the drive into our cleanroom, we found sharpie pen markings on the various components. This usually indicates that parts had been removed or replaced. Of particular concern were the markings and screws around the spindle motor. With vertical and horizontal alignment, we never want to see a disk pack disturbed. We had no way to know if the disks had been rotated independently and had their alignment destroyed.
Although we didn’t know about the disk pack, our only way forward was to install new heads and ramp, release the stuck motor, and see how the drive responded. On power-up, the drive failed to reach readiness and we were unable to access the diagnostic mode. One tiny sliver of hope was that when we rebuilt the donor heads back into their own drive they still worked fine. This at least told us there wasn’t significant disk damage.
We installed a different set of heads, and this time were able to bring the disk ready using our diagnostic tools. We were able to extract a small amount of data before the heads stopped reading again. This time, we confirmed that disk damage had contaminated the new heads. This gets into awkward territory. The only way forward is to keep feeding new heads into the drive, resume the procedure, and keep extracting more data. In total we used three sets of fresh heads before we’d extracted all the files. We ended up with over 95% of the data recovered successfully.
Disk 2 – 1TB Western Digital My Passport drive.
This one was a bit different. The user had been given a good chance of recovery from another company, but been quoted over £1300 for the recovery. If you’ve been here before, you might know that we prefer to publish our prices online. You can see the costs before you even send a disk to us. The maximum price for a similar recovery with us was £488 but it was likely to be recovered for £329.
By the time we received this disk it had been sent to a second other company. One with a bad track record that I won’t name. They quoted an impossibly low fee but after receiving the drive raised it until it was higher than ours!
The more places that meddle with a disk, the lower chance we have of ever figuring out what the original fault was. In many cases we need to revert all the recovery attempts first, and then start from scratch.
This disk again showed signs that it had been dismantled so we took it straight into the cleanroom to check the internal parts. There was no sign of damage, so we rebuilt the drive and proceeded with our usual diagnostic routine.
We found a fault with the external electronic board on the drive so replaced it with a known good one. As with most modern disks, this also meant adapting the replacement board to work with our drive.
The drive showed some instability during imaging, but it completed successfully and allowed full data access. Why the disk had been opened during the previous recovery attempts is a mystery. It served no purpose, and just introduced the chance of contamination and misalignment that was no help to the recovery.
As expected, we ended up recovering the data for our lower fee.
The Moral of the Story
We always go the extra mile with a recovery. If you know anyone that’s had to give up on getting their data back, it’s worth sending them our way. We’ll never know how many more people have resigned themselves to never seeing their files again.
Leave a Reply