For the last few years, newer editions of Windows have the ability to encrypt the whole disk with bitlocker. This means far more users are experimenting with encryption. We have seen an increase in recoveries from drives secured with bitlocker.
Is Data Recoverable From Bitlocker Drives?
In many cases the data is recoverable. It is important that we get the recovery key or password, as bitlocker security has not been compromised.
The most common problems we see with bitlocker encrypted drives are when the disk starts to fail, or when Windows becomes corrupt. This can prevent the built-in decryption process from working correctly and leave users locked out of their data. These drives can fail like any other, but the encryption adds an extra layer of complexity to the recovery process.
If using bitlocker on your drive, it is important to keep a copy of the decryption keys in a safe secure place away from the computer. It is also extra important to keep a constant and regular backup process. Although recovery is usually possible from a failed bitlocker drive, it could take a number of days. You probably wouldn’t want to live without your files for that time.
If you have a failed bitlocker drive that needs recovery, (and if you have the recovery key) get in touch.
This OWC external enclosure is a common sight on the desks of Mac users with big storage needs. It’s a pretty standard 4-bay box, styled somewhat like a cousin of a PowerMac G5 or 1st generation Mac Pro. Inside are the usual options of RAID 0 to RAID 5 with a few additions like JBOD & RAID 10 thrown in for good measure. There are a few variations of this device but the back panels commonly have USB, Firewire, and eSATA ports for direct connection to a PC or Mac. There is no ethernet port on these drives which makes the Qx2 a DAS (Direct Attached Storage) rather than NAS (Network Attached Storage).
Aside from massive name, the OWC Mercury Elite Pro Qx2 also comes with a potentially huge amount of storage. Currently up to 32TB on the OWC store, but also available diskless or BYOD (Bring your own disks). With so much storage space, these drives often become the one and only repository for vast lumps of important data. The benefits of RAID give a false sense of security that the data is safe from drive failures. Unfortunately, there are a number of reasons why the RAID array alone will not protect from certain failures. Most of these failures can be overcome by us in our workshop, but they are not one-button fixes. It is helpful to understand why a seemingly rock-solid platform can be even more risky than a simple external USB drive.
Under common settings, the Qx2 will use RAID 5 for the array. With four 2TB drives this gives you a 6TB volume on a Mac or ~5.5TB on a PC, and can cope with a single disk failure. There is a lot of debate about how good RAID 5 really is for such large drives. In our example this means that if a single disk fails, it will need to be replaced, and then the new disk rebuilt with 2TB of data calculated from the other disks. This will take many hours, even under optimal conditions, but if anything goes wrong before it completes the array could stop showing up all together. At this stage, the data is probably recoverable but don’t panic. One wrong move and the data could be gone for good.
If the data is crucial then get assistance from a RAID recovery service now and you should get back all or most of the data.
If any disks are removed or replaced at this point the array could get reinitialised and either make the recovery more complicated or wipe the data completely.
Aside from all the problems with a RAID setup, the volume could also fail in the same ways that a standard hard drive can. There could be deleted files, a reformatted or corrupt partition, or even the RAID controller failure. RAID cannot protect against those types of failure at all.
Our first step would be making read-only copies of each disk in the array. This protects against further disks failing, and also allows us to work from copies without risking the original disks. In fact, once the disks are copied, we put the originals to one side and don’t touch them again until all the data is recovered and supplied back to the user.
Once we have our copies, they are loaded into our own hardware where we recreate the RAID in a virtual environment. Again, we don’t use the original hardware, as that may have been the root cause of the problem.
When the virtual RAID has been loaded and all the data extracted, the files are supplied back on whatever alternative storage is suitable, (not the original device!) Once the data has been delivered to the user, and backups made, the old unit can then be destroyed, or returned and reused.
Anyone using RAID on a regular basis should know that RAID is not a replacement for backups. If anything, the increased number of disks makes failure more likely. This needs to be addressed by either making backups to another device, or an online service (preferably both). You ideally want backups that keep historic versions of the files, so that inadvertently deleting a file or changing a file by mistake will not also replace the backup version.
If you are having problems with an OWC Mercury Elite Pro Qx2, give us a call or send a message via the form on this page. We give free advice and could help you avoid permanent data loss.
1. Macs now use 1000 bytes for 1KB but PCs use 1024 bytes.
2. Even RAID 6 does not solve the long time required to rebuild a disk, even though it allows for two disk failures.
I had an issue in searching for content within Apple Mail. Every time I tried to search for any particular phrase the Mail application crashed and closed instantly. So I decided to Rebuild the Mailboxes. Before doing this I checked that my latest Time Machine backup had carried out successfully. (It had.)
Once confirmed I clicked Rebuild from the Mailbox drop down menu. Instantly all the mail disappeared and I was left wondering whether it was doing anything. I was patient and waited to see what would happen and sure enough after a couple of minutes all my mail re-appeared intact.
What worried me was that there was no indication that the rebuild was being done. No progress bar or spinning wheel, just an empty window. If I had been impatient I could easily have force quit the rebuild process thinking the application had crashed. That would have resulted in an Apple Mail restore to be sure.
On the Apple Website details are very basic. So, be patient, go for a walk and then come back and see if the rebuild worked.
We’ve been hearing reports of data loss with certain external hard drives after an upgrade to the latest Mac operating system Mavericks. The blame seems to fall to the disk management software that Western Digital bundle with their external hard drives. In response WD has removed WD Drive Manager, WD Raid Manager, and WD SmartWare from their website until they figure out the problem.
We have already had first-hand data recovery enquiries for such disks, so it remains to be seen if these issues can be resolved, or if the data is permanently damaged. One notable case involved a 6TB RAID with two 3TB drives in a mirrored array. After the update to Mavericks, the volume appeared as an empty 3TB drive.
It’s worth noting that even if you use a Western Digital RAID drive set as a mirror, this problem can still cause data loss. Both disks in the mirror are susceptible to the same problem. Remember that RAIDs need to be backed up even more than single disks!
We’ve now completed the recovery process for one of these hard drives. It appears that the drive we received had been formatted to an empty MyBook volume. The way the Mac filesystem stores data means although most of the files can be recovered, it is not possible to restore the original file and folder structure. This causes issues for files like InDesign which link to external files by name when you add graphics to the document.
We’ve not yet seen enough of these disks to know if this is a common outcome for all affected disks.
It’s a common problem that as we generate more data each year we start running out of space to put it. This is now even more of an issue in the smartphone market, where built-in cameras are generating increasingly large photos and videos, without providing much in the way of additional storage. The most common iPhones are still 16 & 32GB but the photos they now produce can be megabytes in size, with videos easily reaching 1GB.
It’s tempting to take that data and put it somewhere else, so either a laptop or external hard drive. Then once you’ve copied it all you delete it from the phone and gain back all that space. Problem solved.
Not So Fast…
If that copy on your laptop is now the only copy, then you could be one spilt coffee from disaster. If the laptop goes up in smoke, gets stolen, dropped or any of the myriad other ways of failing then it’s bye bye data.
The key to making backups is redundancy. The key to making backups is redundancy. The key to making backups is redundancy.
You need to make extra copies of your data to different types of storage. This could be an external hard drive, NAS, USB Pen, SD card, anything. But don’t just pick one of those. Make a few backups. Put one in a locked safe somewhere. Send photos off to the cloud. Store a copy of your music at your nan’s house. If any of those copies gets lost or broken you can just replace it with another copy.
So let’s run through an example. All those photos on your iPhone have filled it up. Here’s what I would do:
Copy the photos to my computer. Check them.
Backup the computer as usual. (You’re already doing that, right?)
Make another backup, or copy the photos to an online storage service like Dropbox.
Now it is safe to delete the photos from the iPhone and revel in all that fresh space.
Note: Deleted photo recovery is virtually impossible for all modern iPhone versions due to encryption.
Here’s another example for when your computer runs out of space instead:
Is it possible to upgrade the internal storage? If it is then you should do that.
If this is not possible, or too expensive then you will have to get creative. It will be more fiddly but copy all data to two external hard drives.
You always want to avoid just leaving your data in one place. All electronic devices can (and will) fail, and they have a terrible habit of doing so at the worst possible moment.
So, just remember that no single copy of your files are safe. Making extra copies is cheaper and easier than waiting until something fails.
The other day I got an error message from Time Machine that it wanted to start from scratch with the backups on my Time Capsule. As I only use the Time Capsule as one part of my backup routine that was no big deal. I made sure my other non Time Capsule backups were up to date and then clicked Start New Backup. But what if the Time Capsule had been my only backup? I’d have been running without a backup for as long as Time Machine takes to backup my machine from scratch. Somehow I’ve trimmed my work laptop down to 78GB but it still estimated 6-14 hours until completion. (Yes, over wireless. No, I can’t relocate my office for the day.) What if my laptop died in that time? I’d have a dead laptop, a deleted Time Machine backup and an unfinished Time Machine Backup. In other words I’d be stuffed!
Now don’t get me wrong, I think that Time Machine has been brilliant in getting people making regular backups and I applaud the ease of use. The problem I have is that the language they use in their warnings is not strong enough. People should be more scared of losing their precious family photos or business files. There’s no need to sugar coat it. Also instead of deleting the old backup first, Time Machine should start a new backup and then delete the old one after the new one is verified. As long as there is enough free space of course. In my case there was plenty of free space.
I have included the original warning text below, along with my own version. I’ve not gone totally overboard, and sure it could use some work, but little details like this could really costs somebody some important data. It’s worth spending some time on.
Original Message Text
Transcript: Time Machine completed a verification of your backups on “Time Capsule”. To improve reliability, Time Machine must create a new backup for you.
Click Start New Backup to create a new backup. This will remove your existing backup history. This could take several hours.
Click Back Up Later to be reminded tomorrow. Time Machine won’t perform backups during this time.
Transcript: Time Machine has found a problem with your backups on “Time Capsule”. First backup any important files, then click Start New Backup. This will create a new backup and then delete the old one. This could take several hours and you will be at risk of data loss until it completes.
Click Back Up Later to be reminded tomorrow. Time Machine won’t perform backups during this time.
There are a few interesting things to point out here. As you are starting from scratch with the backup, you lose any old versions of files that Time Capsule had stored. It’s bad practice but some people will happily delete files from their computer, safe in the knowledge that Time Capsule has a copy. In that scenario, deleting the backup would be a disaster!
I still don’t know exactly what caused the problem with my Time Capsule backup, but since starting again I haven’t seen that message.
We often hear from people that have lost their data, despite having some sort of backup. It’s important to remember that your backup is no-longer a backup if it becomes the only copy of your data. We usually suggest having at least two forms of backup to cover this problem.
An example of a failed backup strategy came recently. A user had one server, and at the end of every day would duplicate the whole server to another server. This is OK for some scenarios and gives you a day-old server ready to bring out if your main server fails. We would have also suggested a second backup routine to run at the same time to some other storage. Preferably an external drive, accessible from a standard computer.
The system worked fine for over a year, until server 1 failed one day. Instead of replacing the disks and then restoring from the backup, it was decided to reuse the original disks and then load them from the backup. They overwrote server 1 with the backup from server 2.
When the restore was complete, it was discovered that the data on server 2 was actually corrupt. This corrupt data had also been written back to server 1. The client ended up with two corrupt servers, and no good copies of the data. Worst case scenario.
You will often hear that deleted data isn’t really deleted. This is kind of true, but only until you overwrite the data with something else. By writing server 2’s data over server 1, that effectively overwrote the original data, and left no possible avenues of recovery.
Another common problem we see is with external RAID cases like the Netgear ReadyNAS. These can be setup in a mirror mode which keeps the same data on both disks. Theoretically when one disk fails, the other can still be accessed. In reality the failed NAS will often end up in an unusable state where access to the data is not possible anyway. Even if you plug the hard drive directly into a PC, the NAS drives use a non-standard format so the data is not accessible.
The best way to avoid getting caught out by your backups is to never trust them. Be more paranoid. If you think you have a solid backup system then add another backup, just in case. Then next year add another. Most of the time it will seem irrelevant, but when your server and backup drives all get struck by lightning or end up flooded under six feet of water, you’ll be glad you spent the extra few pounds on an extra backup.
If you’re already using a Time Machine backup on your Mac then why not supplement that with a monthly whole-disk copy to a different drive. Carbon Copy Cloner or SuperDuper! can take care of it. This also has the advantage of being instantly bootable in an emergency and can even be stored in a locked safe, or at a friends’s house.
Many hard drives we see have been more damaged by a failed recovery than they were in the first place. We have released the Data Survival Guide to help people avoid some of the common mistakes. This first version is for Mac users but we have more on the way.
Why not print this out and keep it in your laptop bag in case of emergency!
When we recover iPhones, although we can usually provide the data in a computer-readable format, it is often easier to just load the data back onto another iPhone. Fortunately, as long as you restore the data in the correct order, you should get your iPhone up and running with your restored data.
Before you attach the iPhone you need to make sure iTunes is ready for it. You need to put the recovered iPhone backup into the correct place for iTunes to find. Quit iTunes first.
The iPhone backups go into:
C:\Documents and Settings\username\Application Data\Apple Computer\Mobile Sync\Backup
Now copy your iPhone backup folder from the recovered data to the backup folder on the computer. If you’ve ever made any iPhone backups they will be in this folder with long unreadable names of random numbers and letters. It doesn’t matter that you can’t read it, iTunes can. Don’t rename it!
So now your /MobileSync/Backup folder should look something like:
Remember that the string of numbers will not be the same.
Next you can launch iTunes and see if the iPhone backup is seen in the list. Within iTunes select Preferences and then the Devices tab (Image Below). If your backup file has been recognised then you should see the iPhone name in the list and the date of the backup. If not, go back and check that everything is in the right place.
Next, it’s a good idea to sign in to the iTunes Store. If you’ve not used this computer with this iPhone before you may also need to authorise the computer to access your purchased apps and media. Once signed-in to the store you should choose the Store menu and select “Authorise This Computer…” Be aware that you can only authorise a set number of computers. (The limit can be reset if needed.)
Now you can import the Music and apps into iTunes. Don’t worry if some of the apps don’t have icons yet.
Once all that is finished you are ready to connect the new iPhone. You will need to follow some on-screen prompts and settings, and then it will ask if you want to set it up as a new device, or restore it from a backup. This is where all that hard work pays off. Choose the backup, and let iTunes work its magic. It can take a while if you have lots to restore but when it’s finished your phone should boot into a familiar screen. Your Contacts, Messages, Calendars, Notes and lots of other data will be back in their respective apps.
If none of the other apps got transferred you can choose the Apps tab within iTunes and tick “Sync Apps.” You can then tick whichever apps you want to send to the iPhone.