We have been offering Apple Mac Data Migration as a service for many years now. Here’s a quick reminder about this service which we call Mac Setup. You are bound to be over the moon when you are told that we have recovered your lost data, but in many cases this is only half the battle.
We wrote a detailed blog on the subject back in November 2011, but it still appears to trouble many customers.
We still often get the questions: “What do I do with the recovered data once I receive it?” and “How do I get the data back into it’s original places on my Mac?” For out-of-warranty Macs, this is where our Mac Setup comes into play. For a fixed cost we will provide you with a new installed hard drive, with all your recovered data migrated into it’s original locations, so that when you receive your Macintosh computer back, hey presto! it’s as if your Mac had never failed in the first place, everything up and running as it was.
When developing our iPhone data recovery process we had to make a few decisions about the devices we can support. The newer iPhones (4s +) are not accessible in the same way as older models.
With the iPhone 4 and below we can extract the data using a forensically clean process. What this means is that we can take the data off without writing anything to the NAND chips (storage) inside the iPhone. This fits in perfectly with our regular data recovery process as we never write data to a device we receive.
With the iPhone 4s, Apple changed the part of the system we use to access the iPhone’s memory. There is a chance that a new method of extraction for iPhone 4s will become available, but until it does we will not be recovering files from these devices.
iPhones store their data on NAND chips which are soldered to the main circuit board of the phone. The data can only be correctly decoded if we also have access to other parts of the circuit board, so it is crucial that the iPhone is electronically functional. If water damage has shorted the iPhone then we have no way to access the data externally. It’s not that it’s impossible, just that the work would be unreasonably expensive and time consuming.
Another potential barrier for iPhone recovery is down to the way files are stored. Since iOS4 most files including iPhone camera photos and videos are encrypted before being written to storage, using unique encryption keys. This means every file ends up with a different header. When files are deleted there is nothing to distinguish a photograph from any other random collection of bytes.
Another problem with the file based encryption is that if you restore the iPhone using iTunes, those encryption keys get erased and new ones are generated. This prevents recovery of the old data, which is good for security but bad for data recovery.
In most computers, when you save files they get stored on a hard drive. Although you wouldn’t know it, the drive does not store your files in a straightforward way. The data is written magnetically by a fixed comb of heads stacked above one another. These heads pass between several magnetic discs, writing data as they go. In most cases, instead of storing files on one whole disk they are split up and spread across the disks. This means that when we carry out data recovery we usually need all of the disc surfaces in good condition to get the data back.
When required we can use a process to take the data from the drive by one disc surface at a time. This can allow us to avoid a failing head until we have the rest of the data extracted. When we have extracted all of the data the parts are combined to allow access the files. In some cases this is the only way to get the data back.
Hard drives do not allow access to individual disks during normal operations so we need to use specialist hardware and software.
We commonly need to access individual heads on Hitachi drives, due to degraded magnetic discs. Also if a drive is dropped when in-use, it will often damage at least one head.
Apple have recently announced a recall program for all iMacs with internal 1TB Seagate Hard Drives. These hard drives fail unexpectedly with no prior warning. We noted the failure of these hard drives in a post back in 2009. You can check whether your iMac has an internal 1TB Seagate Hard Drive by entering your iMac Serial Number at this link.
This recall program has now ended. If you have one of these hard drives that has failed you may be interested in our Mac Data Recovery Services.
October was a pretty busy month for us, so I thought it would be a good chance to check on our success rate. As you can see from the graphic below, we have a great success rate of at least 69%. We always keep an eye on our success rate, to make sure we are still recovering as many drives as possible. Our success rate is often higher than 69% but we did get a few non-recoverable drives which had suffered physical media damage. For an example of why those are unrecoverable, have a look at a photo of a head crash. (Tip: Those dark circular lines are not meant to be there!)
Of those successful jobs, a whopping 90% of them were recovered without even needing to repair them in our cleanroom. This is interesting as cleanroom facilities are often advertised as one of the most important factors when choosing a data recovery company. Not to undermine the need for cleanroom facilities, but they are not required for most hard drives.
In the graphic above we have classified non-cleanroom jobs as external, and cleanroom jobs as internal.
As somebody recovering data from RAID arrays, my view on them is a little different to the norm. In most cases I would say avoid RAID wherever possible. Simplicity is key.
Below are my answers to some real questions I have received from clients about RAIDs.
Why did this RAID disk fail?
Hard drive failure is not unusual and is often not avoidable. The truth is that all hard drives fail eventually, whether they are used in a RAID or not. Even though a RAID system can provide some fault tolerance from physical drive failure, they do have limits. A RAID5 on three disks for example can only handle a single drive failure at any one time. It is common for a second disk to fail whilst the other disk is being replaced. This is when RAID recovery is required; to first access the failed drives, and then rebuild the RAID. The best protection against RAID failure is to make backups. Backups in as many formats, in as many different physical locations as possible.
Why did the server fail so badly? Isn’t RAID meant to prevent this?
A 3-disk RAID5 can only cope with one bad disk. This doesn’t help when two drives fail at the same time. Although a RAID array can provide some leeway when it comes to disk failures, it doesn’t always help when you have multiple failures in quick succession. Adding more disks to the RAID can provide more redundancy, however this costs more money, and also adds complexity when things go wrong. Also you could be in a similar position if three disks happen to fail next time. A live system could fail at any time so prepare for the worst. Backups are cheap, and take a relatively short amount of time. RAID recovery can be expensive and cause unnecessary downtime.
Why couldn’t our IT support recover this?
We are a specialist data recovery company, with access to tools and resources which are not available to IT Support staff. We have spent the last fifteen years perfecting the process of extracting data from failed & failing hard drives and RAID arrays. For the best chance of recovery, we like to get the drives as soon after failure as possible. If more work gets carried out on the drives, things can be made much worse.
How can we avoid this happening again in the future?
To avoid similar problems in the future, the best way forward is some form of regular backup. The backups should be verified and then tested / restored as often as possible. This is where disaster recovery comes in, which can involve simulating certain types of failure and making sure you can get up and running again from your backups. At the very least, it wouldn’t hurt to put the really crucial business files onto an external hard drive every few weeks and store it in your company safe. It’s low-tech but at least you could plug it in to any PC and access the important business data if required as a last resort.
I’m not against RAIDs. They do have their place, but cannot be relied upon as a replacement for regular backups.
This immense 2TB iMac drive may be heavy, but have you ever wondered why?
When we recover these drives we often have to work on individual heads. As you can see from the image, this monster has 10 heads (the first is numbered zero). This means there are 5 spinning disks inside the drive.
From the outside, the only clue that these drives are so rammed full of disks is their weight. They are no bigger physically than any other desktop hard drive.
It is common to hear of hard drive problems happening as a result of a system update, or operating system upgrade. We have a theory that could possible explain this.
First of all, you should always make a full backup of your system before installing an update. It’s not unheard of for updates to go wrong, so this is crucial.
During a software update, a large amount of data gets read and written to and from the hard drive. If the hard drive is functioning fine, this happens without issues. Installing updates is a normal (and necessary) part of computing.
If the hard drive is not quite 100%, then maybe running a software update is the last straw. It puts the failing drive under a bit of extra strain and bang. The hard drive fault which had been lying dormant for months, now rears it’s head and the hard drive gives up, leaving you stranded from your data. Bear in mind that the drive would have failed eventually anyway, but the heavy disk usage probably accelerated the failure.
There are a couple of things to look out for, that may predict an imminent hard drive failure. (Please don’t wait for these signs before backing up. Do it now!)
Warnings or messages during boot up
Computer being unresponsive / slow at times
The dreaded beachball animation (On the Mac)
Clicking / chirping noises
If you are running any computer with important data, you should back up immediately and as often as possible. That way it doesn’t matter if your hard drive fails; just throw in a new drive and reload it from your backup.
Myth 1: When files are deleted they are gone forever.
Fact: When files are deleted they are actually only removed from an index. Unless you then overwrite those sectors with new data, the files will still be there. If you delete a file it is important to stop using the computer. Even browsing the internet causes cache files and images to be downloaded to the hard drive, potentially overwriting the deleted files.
Myth 2: Putting a hard drive in the freezer will bring it back to life.
Fact: This is an old one, which will not die. We have never had to put a hard drive in a freezer. There is only anecdotal evidence that freezing a hard drive helps in any way. One of the most common types of hard drive failure is firmware corruption, which cannot be fixed in a freezer. I would be worried about introducing condensation into the drive, which could be devastating. If anyone knows where this idea came from, or how the freezer is supposed to help, then I would love to hear about it.
Myth 3: The FBI can recover anything.
Fact: The FBI are bound by the same laws of physics as we are. If a hard drive has had a head crash, and scraped the magnetic coating off the platter, there is no data left to recover. You cannot read magnetic data from particles of dust! Even the FBI can’t recover that.
Myth 4: The best way to recover a hard drive is by swapping the platters out.
Fact: In almost all cases, you should not disturb the alignment of the platters. They are manufactured within strict tolerances which cannot be recreated outside of a manufacturing environment. If the problem lies with the on-disk firmware, electronic components, or read / write heads, then swapping the platters would not solve anything.
Note – If the spindle motor gets stuck then it can be necessary to swap the platters, but only as a last resort.
Hard drive firmware is the embedded software which controls the running of your hard drive. Most of it is stored within hidden sectors on the hard drive, and in normal operation you wouldn’t know it was there. Whenever you power up a drive, the firmware makes the motor spin, starts the read / write heads, and checks against a list of bad sectors. Only then will the computer be able to access the data area and allow you to see your files. If there is a problem with the firmware, the drive will get stuck and you won’t be able to access your data at all.
Failed firmware is almost impossible to diagnose without specialist equipment. In fact, it is hard to confirm that the firmware is faulty at all. Many hard drive problems manifest themselves in the same way; by clicking, or spinning down, or just generally not being identified by the PC. You shouldn’t start changing components until you know where the problem lies.
In the early days, most firmware could fit onto the electronic circuit board; simply swapping a damaged PCB with a good one was a common fix. Firmware is now too large to fit on the PCB, so the PCB contains just a very simple boot loader which starts off the drive and then loads the firmware from the disk surface. This means that swapping the PCB is no longer a common fix, and won’t work on most modern hard drives.
We have specialist hardware and software that allows us to check and repair the firmware on most hard drives. We have also dealt with many of these problems before and have a huge database of previous experience to draw on.