Data Recovery You Can Trust
This immense 2TB iMac drive may be heavy, but have you ever wondered why?
When we recover these drives we often have to work on individual heads. As you can see from the image, this monster has 10 heads (the first is numbered zero). This means there are 5 spinning disks inside the drive.
From the outside, the only clue that these drives are so rammed full of disks is their weight. They are no bigger physically than any other desktop hard drive.
It is common to hear of hard drive problems happening as a result of a system update, or operating system upgrade. We have a theory that could possible explain this.
First of all, you should always make a full backup of your system before installing an update. It’s not unheard of for updates to go wrong, so this is crucial.
During a software update, a large amount of data gets read and written to and from the hard drive. If the hard drive is functioning fine, this happens without issues. Installing updates is a normal (and necessary) part of computing.
If the hard drive is not quite 100%, then maybe running a software update is the last straw. It puts the failing drive under a bit of extra strain and bang. The hard drive fault which had been lying dormant for months, now rears it’s head and the hard drive gives up, leaving you stranded from your data. Bear in mind that the drive would have failed eventually anyway, but the heavy disk usage probably accelerated the failure.
There are a couple of things to look out for, that may predict an imminent hard drive failure. (Please don’t wait for these signs before backing up. Do it now!)
If you are running any computer with important data, you should back up immediately and as often as possible. That way it doesn’t matter if your hard drive fails; just throw in a new drive and reload it from your backup.
In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.
The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.
This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.
We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.
Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.
In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.
If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.
If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.
RAID is often touted as the silver bullet in data storage. Increased storage capacity, resistance from hardware failures and improved performance. While these are all valid upsides to a RAID setup, there are also a few downsides which need to be addressed.
RAID can allow for a huge pool of storage, but with that storage comes great responsibility. You should factor in at least enough capacity to backup the RAID data somewhere else. If you can only afford 8TB of storage then you should only use 4TB for data and the other 4TB to back it up; Preferably on another machine / standalone system.
The first letter in RAID stands for redundancy. This means you can afford to lose a certain number of disks without losing access to your data. This also means that if you have a disk failure you need to get it replaced immediately, otherwise you’re running without redundancy.
Nobody likes downtime. If your 16TB RAID array goes offline without a backup then you have a couple of options. One option is to attempt to get the RAID back online by replacing disks, rebuilding the array etc, but this is risky. If this is your only copy of the data then rebuilding / reformatting the RAID could corrupt the data beyond recovery. Don’t do this if you don’t have a backup to fall back on.
The second and preferable option is to get the RAID professionally recovered. When we receive a RAID, the first thing we do is make images of all disks. This allows us to work on the RAID without risk. Then we use a read-only process to extract the data onto another form of storage. This is where downtime comes in. Unless you go for an emergency process, you could have to make do without the data for a number of days.
It’s one word. Redundancy.
Whatever you do, make sure your data is replicated across as many types of storage as possible. In an ideal world you would have a duplicate system running alongside the live system, which can take over if anything goes wrong. Then have the data on another type of storage, which you can access from somewhere else. Imagine if the RAID controller failed, and you could only access the data from that one machine.
It doesn’t matter how many backups you have if they all require the same system to access them.
I’ve only just scratched the surface here, but you should always look to make extra copies of your data. It may seem redundant now, but when your server fails containing all your data, all your accounts, all your client details and your website, you’ll be glad you kept that extra copy.
This hard drive was opened in our clean room for internal rework. In the process we found that the rubber crash stops attached to the VCM magnet were perished. They were oozing sticky rubber solution contaminating the drive internally. A word of warning to anyone who may still have one of these hard drives with critical data. I would recommend back up and replacement. This particular hard drive was from a synthesiser that had stopped working.
I recently read a brilliant article about the guy that wrote the original Prince of Persia game for the Apple II in the 80’s. He had long since lost the original source code, until an old box of floppy disks was uncovered in his father’s apartment.
Sensibly, he enlisted some experts to help with the data extraction, and after a day of collaboration was able to release the source code online.
This got me thinking. Although I am meticulous with my backups of current data, I still have boxes of old software on floppy disks, which are happily degrading as we speak. John even found an old 212.6MB hard drive with some vintage data recovery software on it. Now this stuff isn’t always useful, but occasionally a really old drive comes down to us, and it is only this old software that can do the job.
As a result, John and I have started a project to get all of our old data recovery software from floppy disks and hard drives, and back it up to our file server. The 212.6 MB hard drive in the picture had 128MB of old DOS recovery software, which would easily fit on my mobile phone. Who knows when we might need it, but we now have it available when the need arises.
I love Bang Goes The Theory. I loved the alcohol powered motorbikes last week and find it a good doorway into ideas, which are presented in a fun and interesting way. I was extra excited when I started watching episode 3, and relised they would be featuring data recovery. A perfect opportunity to dispel some common myths, and dish out a bit of advice in the process.
The data recovery guy Rob, made a good analogy when he described deleting data as ripping out a page from the table of contents. That is pretty much how it works, and really simple to understand.
Yes they are the world leaders. I’m not going to dispute that, but I’m also not going to name them. They don’t exactly need the extra publicity. It’s worth noting that any decent recovery firm would have reached the same results from the batch of damaged drives.
I do have a couple of problems with the way some of the drives were “destroyed.”
Liz later made some good points about the reliability of CD / DVD storage. I agree that although the quoted life spans of DVDs are enormous, in reality DVDs often only last for a couple of years. We have had discs in for recovery that have been stored in temperature-controlled server rooms that have still failed well short of their estimated lifespans.
Hard disks can last for ages. We have some here that are well over 15 years old and still going strong. The problem is that they can fail without any warning. It is sound advice to backup one drive with another, and then another. This is the only surefire way to avoid being stung by a failed drive. Dallas made a good point of moving one of the backups off site, which is also a good idea.
I didn’t like the scrambling advice given near the end. There are problems with the way hard drives are designed, which can prevent the software from accessing bad sectors, and hidden parts of the disk. Although only small parts of the disk, you could leave enough data there to be targeted by fraudsters or whoever.
I advise a two pronged approach. First erase / scramble the data, then physically destroy the drive. This makes it far less likely that your data could end up in the wrong hands.
It is good to see this sort of thing on mainstream TV, and the advice given was a good starting point for most people. Despite my points above, it was basically a good show: Interesting and informative, with a decent amount of good info.
Many people have little or no knowledge of the way their data is stored, so any way to bring this to their attention is good in my books.
The Register has today posted two articles about the ongoing battle to expand hard drive capacities.
First is an actual device for sale, a 2TB Western Digital portable drive. This drive has a fancy new case and USB3 connection. It contains backup software and also the option to encrypt the data with a password. I wonder if it encrypts the data by default like some of their previous portables. (A bad thing!)
Second is a futuristic announcement from Seagate about their new HAMR technology. This new tech uses a laser to heat part of the disk before magnetising it. This apparently allows for much higher densities, theoretically paving the way for 60TB hard drives. There doesn’t appear to be any products using this technology at the moment.
60TB drives will be fantastic for backups, but horrible to backup without a new, faster form of connection. These would take almost forever (exaggeration) to fill up by SATA.
This news helps prove that hard drives are far from dead. It will take a long time until SSDs can cope with such massive capacities, at a similar cost to these beasts.
Seagate FDE hard drives encrypt the data automatically as it is read and written to the drive. As you save data to the drive it is encrypted immediately and can only be accessed when you input your user name and password. The drive will then be temporarily unlocked and allow the operating system to boot. Once the drive is powered off, it will be automatically locked again.
We have received several of these drives from customers who cannot access their data due to a hard drive failure. You may still be asked for the password, but the laptop will then fail to boot. This can be as a result of bad sectors or electronic problems. We can overcome virtually any type of failure and can return your data back to you decrypted and fully accessible on a new hard drive.
See our Seagate Data Recovery Services for more info.
I have lost count on the amount of times we have received hard drives for data recovery from Mac customers, who are not aware of the Time Machine back software. Time Machine has been preinstalled in every version of OS X since 10.5. This software is easy to setup, and once the first backup of the internal hard drive is complete, it will then carry on backing up as you create new data.
As a small business or personal user it is ideal for your everyday backup needs.