Tag: Hard Drive

  • 20MB SCSI MiniScribe HDD Recovery

    We recently received this very cool old Mac drive to recover. It came from a Macintosh SE, and the user was happy for us to share the information about the case.

    Specs

    BrandMiniScribe
    Model8425SA
    HDA06
    PCBA03
    Unique07
    Capacity20MB
    Interface50 pin SCSI
    Year1990

    Cloning

    The first step to recovering an old drive like this is the physical connection. We have numerous old machines with old interfaces, as well as some old hardware designed for data recovery from those systems. Although the disk is stamped 1990, it has a fairly modern (for the time) 50-pin SCSI connection.

    We connected it to our recovery machine, and powered the drive up. We were expecting it to be a bit noisy and maybe need some cleanroom work, but were pleased to see that after a bit of calibration we could get a successful ID from the drive. No time for messing about, we started cloning off the sectors to a file, and managed to get all but a handful of sectors read successfully. It’s possible to retry the sectors again later, but we always wait until we’ve got as much recovered before we do that. As it turned out, we couldn’t read those missing sectors at all, so we marked them as bad and moved on to the next step.

    File System

    The disk was from a Macintosh SE 1/20 and originally running System 6. This means it was formatted as HFS Standard. Our recovery software can understand that format, so we loaded up the disk image file and ran a file recovery. The data came off in good condition, with all original file and folder names. This is when we started to see the quirks of old Mac drives. We’ve been doing this long enough to remember this stuff, but it could easily overlooked.

    About old Mac files

    It’s standard now, even on Mac to have file extensions for every file to tell the system how to open it. *.doc or *.docx for documents, and *.jpg for images etc. This wasn’t the case for early Macs. In fact even up to Mac OS 9, not all files had extensions. The Mac didn’t need them, so it was only an issue if you shared files with PCs. This probably lead to the long standing belief that Macs and PCs don’t work well together.

    A partial solution

    We have a tool that can scan over a folder full of files and see if it recognises the contents of the file. It can optionally add the guessed file extension to the files. We took a copy of the files, and ran it through the tool. It was able to recognise the document files, and some FileMaker databases.

    And the rest?

    Some other files are not so common, so it couldn’t identify them. In particular, drawings made in SuperPaint. This lead us to plan-b…

    Emulation

    Fortunately vintage Macs can be emulated really well on modern hardware, so we decided to fire up a Mac emulator and load the disk for a closer look. Running this virtual Mac environment allows the files to be accessed as they were back in the day.

    It’s an interesting process, so I’ll post follow up soon with more info about loading a recovered disk image into an emulator.

  • Beware “New” Disks on Amazon

    If you search for external hard drives on Amazon, you’ll see a vast selection of disks, with little more than price as a differentiator. Some of those are from established manufacturers, but others have curious1 names and very little reputation. What’s concerning is that we’ve found recertified (AKA, Used) drives being sold inside some of these supposedly new drives.

    If you put an old motor in a new car, is it still a new car?

    You might think buying used drives is OK, but recertified drives are usually marked in some way, and come with a lower cost. Then it’s up to you if you’d like to make the trade-off.

    Quote from serverpartdeals.com

    Emphasis mine.

    1. SMART Data and Power-On Hours
      Both new and recertified drives have minimal SMART data and power-on hours. For Recertified drives, this is due to the Manufacturers wiping the SMART data during the recertification process. Meaning any previous data, if there was any, will be gone forever. Before our testing process, ALL Recertified drives will come to us with zero power on hours and zero power cycles. 
    2. Labelling: Recertified drives are clearly marked to indicate their status: Seagate: Uses a different label that prominently denotes the drive as recertified. Toshiba and Western Digital: Provides smaller indicators of recertification, with small text on the regular label

    https://serverpartdeals.com/blogs/blog-posts/new-vs-recertified-hard-drives-a-comprehensive-comparison

    So that’s all well and good, Seagate kindly put a big green stripe around the edge of their recertified labels. The problem is, when you put that recertified drive into a black plastic case, you can no longer see the label.

    Due to some unknown Amazon economics, when I checked today, the recertified drive actually costs more than the equivalent one from the disk manufacturer itself. Who knows if the Seagate one also contains a recert drive too? (- I’ll let you know when I see inside one)

    As if there wasn’t enough to worry about buying storage, you now have to wonder if your brand new disk has been used before.

    Amazon search for “14TB External Drive” (yes, the results are both 16TB 🤷‍♂️)
    A nice new case, but what horrors lie within?
    Recertified drive from a UnionSine External case.

    Buyer Beware!

    Footnotes

    1. Ai generated? UnionSine, ezekers, Meyritech, ModusTech, fanxiang ↩︎

  • You Can’t Win Them All

    We often get called Saviours or Magicians. But sometimes the magic wand just doesn’t work. This unfortunate drive had serious media damage on both discs and both surfaces. You can see the scratches are so deep they’re down to inner glass layer.

    The drive in question is Seagate Ultra Slim Portable. The damage maybe not be as bad as some we have seen in the past, but it’s still bad enough to prevent recovery.

    Click here to see more about Media Damage and other types of Failures.

  • Helium Hard Drives – Data Recovery Challenges

    A Bit of Background

    A helium hard drive is a mechanical hard disk drive with an internal enclosure filled with helium gas instead of oxygen. The enclosure is then hermetically sealed to slow the escape of gas. Helium creates a unique low density environment where the internal hardware can operate more efficiently resulting in less turbulence compared to air. With less rigidity in platter thickness required, this allows manufacturers to increase hard drive capacity by adding more slimmer platters into the same amount of space.

    The Data Recovery Challenges

    Less turbulence means less resistance so ideally opening a helium hard drive would be carried out in a helium filled environment. We have been successful in carrying out internal rework to allow access and attempt data recovery from helium hard drives in our clean room environment by using a strict and controlled process.

    Cutting Open a Helium Hard Drive

    Helium hard drives have a sealed aluminium top cover that is welded to its outer casting, so needs to be forcibly removed using a sharp implement. Some videos online show people using CNC mills, or saws to open the case, however we found1 that these allow small particles of metal to find their way inside the enclosure. This top cover keeps the helium gas trapped inside the hard drive. Once the external aluminium cover is removed the hard drive can then be taken into our clean room for decontamination. The internal cover can then be removed to carry out any internal rework required and then replaced once complete. The process of accessing the helium hard drive for data recovery uses the same hardware and technology as with standard hard drives. ie. Mapping used sectors, cloning to a working disk, and then extracting the files.

    Parts

    Helium filled disks are some of the largest on the market, so donor parts can work out expensive. In some cases the parts can cost as much as the recovery itself, especially when we need to match a certain revision or date of manufacture.

    The Outcome

    Recovering data from a helium disk is often a challenge, but something we’re happy to take on. Now if only all hard disks had a welded top cover, we’d never have to worry about people opening disks outside of the cleanroom any more!

    Contact Us Now…

    For a fast reply from a real person.

    Footnotes

    1. In testing, not with customer disks! ↩︎
  • The Death of Undelete

    Deleting files and formatting disks just got a whole lot more dangerous!

    Are you sure you want to permanently erase the items in the Bin?
You can't undo this action.

    Back in the good old days1, before fast SSDs, and multi Terabyte disks, if you accidentally deleted a file, you could be fairly confident that you could get it back. In classic Mac OS, it wasn’t uncommon to have Norton UnErase running every time your Mac shut down, to show a list of deleted files for you to optionally restore.

    Not to be overdramatic, but those days are pretty much gone.

    If you have deleted data or a formatted disk, power it off and get in touch with us right away. There is a small window of time where recovery is possible in some cases. The process requires specialist tools and equipment that costs thousands per-year, and any other type of access will erase the data for good!

    Contact Us Now…

    For a fast reply from a real person.

    What changed?

    With modern disks you cannot run a quick undelete to recover files. In fact, even powering on a disk after you deleted some files could actually destroy those files permanently.

    For various technical reasons2, disks now need to keep track of which sectors are in use. This allows them to carry out background “housekeeping” tasks to keep the disks running smoothly. Modern operating systems issue a TRIM command when you empty the recycle bin, to let the disk know which sectors are no longer in-use. The disk will then erase those sectors and add them back to the pool of available sectors.

    An example of some disks that likely wipe out deleted / formatted data

    • Western Digital (WD) My Passport drives from 2TB+
    • Seagate external drives from 2TB+
    • SD / microSD / SDHC / SDXC cards
    • m.2 SATA SSDs
    • m.2 NVMe SSDs
    • SATA SSDS
    • iPhones / iPads / Android phones & Tablets
    • + Lots of other variations of the above!

    If you’re unsure, you should safely unplug the disk ASAP, and get in touch. We’ll hopefully be able to let you know the chances of recovery.

    Conclusion

    If you accidentally delete some files, or accidentally format a modern disk, your chances of recovering those files are greatly reduced. Act fast and turn off the disk ASAP. You may prevent the data being lost for good, but it will likely need to be recovered by a professional. If that happens, you must let them know the situation, so they can handle it properly.

    Good luck!

    Footnotes

    1. Before 2008 for MacBook Air users, with SSDs instead of HDDs ↩︎
    2. Cheap / dense storage chips, or SMR hard drives ↩︎
  • WD My Cloud Problems

    WD My Cloud Problems
    WD My Cloud Cannot Login

    In the last few days, we’ve heard that hard drive manufacturer Western Digital have suffered a major outage with their web services. Unfortunately due to the way these NAS drives use a web service to login, it means when the web service is down, you cannot login to your own device.

    Nobody knows if WD can bring the service back online at some point, or how long that could take. In the meantime, we’ve now recovered a few of these drives, so if you need access to your data, get in touch.

    Contact Us Now…

    For a fast reply from a real person.

    Affected Models:

    • G1C BGEJRA 3718Q
    • WDBVXC0040HWT-00
    • My Cloud Home
    • WDBVXC0020HWT-00

    Cannot Login to My Cloud

  • Fake HDD Data Recovery

    The saga of fake eBay and Amazon products continues. This latest instalment was supposedly a 1TB USB External Hard drive that had failed. The client didn’t suspect anything unusual about the drive until it failed, so sent it to us for diagnosis. When we removed the drive from the generic external case, we found a drive with an extra plain label over the usual manufacturers label. This is not unheard of, but is unusual, and made us a bit suspicious. We peeled back the plain label, and underneath was a 120GB hard drive, that looks like it was pulled from an old HP laptop.

    Upon connecting the drive to our diagnostic kit, the drive had a problem in the firmware area and couldn’t reach a ready state. In other words, the data was not accessible. After a lot of head scratching and tweaking around with the firmware, we found the fault and got the drive into a ready state. That’s when we noticed the model number didn’t match the label. Also the hard drive was identifying itself as 1TB, even though we know it was only 120GB.

    RealFake
    ModelST9120822ASST1000LM024
    Capacity120GB1TB
    Real vs fake drive info

    There were a few bad sectors during the image process, but that’s not surprising when you consider it had possibly been in use since around 2007. All customer data was successfully recovered.

    As usual, our current advice when buying storage drives online these days is as follows: Go for brands you know. Check you’re not getting too-good of a deal. If possible, fully test the device using a manufacturer’s tools before you trust your data on it. Most manufacturers provide free tools to test their own drives.

  • Why It’s Impossible to Give a Meaningful Time Estimate When Cloning a Failed Disk

    Our data recovery process almost always begins with a copy process. Otherwise known as cloning or imaging, we attempt to copy every data block from the failed disk to another disk.

    With a normal disk, we can record how long it takes to copy a block, then multiply by the total number of blocks to calculate how long the process will take.

    Cloning a Disk
    Cloning a Normal Disk

    With a faulty disk, this is not possible. A faulty disk will often read different blocks at different speeds depending on how bad the problem is. Until we read the block, there’s no way to know how long it will take. This is illustrated in the animation below. (Sorry, the GIF below is quite large so may take a while to load.)

    Cloning a Failed Disk
    Cloning a Failed Disk

    With a faulty disk, we have to keep copying blocks until we get all the data. You can see from the animation above that it’s impossible to know how many slow blocks are coming up, versus good blocks.

    This is the third part of a mini-series about copying data.

    Read Part One here about copying small vs large files.

    Read Part Two here about why computers always guess the wrong copy time.

  • More Second Opinions

    We recently posted on Facebook about a pair of disks that we recovered. Both had been sent around the market a little bit, so I thought they’d be worth writing about in a bit more detail.

    We never like seeing open disks, unless we open them ourselves!

    Disk 1 – 3TB Seagate drive from an Apple Time Capsule.

    The disk had previously been sent to another lab for recovery. It was diagnosed as having multiple damaged heads, a stuck motor, cracked head-ramp, and microscopic damage to the disk surface.

    Our Findings

    We could see the screws and seals had been tampered with on the outside of the drive. When we took the drive into our cleanroom, we found sharpie pen markings on the various components. This usually indicates that parts had been removed or replaced. Of particular concern were the markings and screws around the spindle motor. With vertical and horizontal alignment, we never want to see a disk pack disturbed. We had no way to know if the disks had been rotated independently and had their alignment destroyed.

    Although we didn’t know about the disk pack, our only way forward was to install new heads and ramp, release the stuck motor, and see how the drive responded. On power-up, the drive failed to reach readiness and we were unable to access the diagnostic mode. One tiny sliver of hope was that when we rebuilt the donor heads back into their own drive they still worked fine. This at least told us there wasn’t significant disk damage.

    We installed a different set of heads, and this time were able to bring the disk ready using our diagnostic tools. We were able to extract a small amount of data before the heads stopped reading again. This time, we confirmed that disk damage had contaminated the new heads. This gets into awkward territory. The only way forward is to keep feeding new heads into the drive, resume the procedure, and keep extracting more data. In total we used three sets of fresh heads before we’d extracted all the files. We ended up with over 95% of the data recovered successfully.

    Disk 2 – 1TB Western Digital My Passport drive.

    This one was a bit different. The user had been given a good chance of recovery from another company, but been quoted over £1300 for the recovery. If you’ve been here before, you might know that we prefer to publish our prices online. You can see the costs before you even send a disk to us. The maximum price for a similar recovery with us was £488 but it was likely to be recovered for £329.

    By the time we received this disk it had been sent to a second other company. One with a bad track record that I won’t name. They quoted an impossibly low fee but after receiving the drive raised it until it was higher than ours!

    The more places that meddle with a disk, the lower chance we have of ever figuring out what the original fault was. In many cases we need to revert all the recovery attempts first, and then start from scratch.

    This disk again showed signs that it had been dismantled so we took it straight into the cleanroom to check the internal parts. There was no sign of damage, so we rebuilt the drive and proceeded with our usual diagnostic routine.

    We found a fault with the external electronic board on the drive so replaced it with a known good one. As with most modern disks, this also meant adapting the replacement board to work with our drive.

    The drive showed some instability during imaging, but it completed successfully and allowed full data access. Why the disk had been opened during the previous recovery attempts is a mystery. It served no purpose, and just introduced the chance of contamination and misalignment that was no help to the recovery.

    As expected, we ended up recovering the data for our lower fee.

    The Moral of the Story

    We always go the extra mile with a recovery. If you know anyone that’s had to give up on getting their data back, it’s worth sending them our way. We’ll never know how many more people have resigned themselves to never seeing their files again.

    Contact Us Now…

    For a fast reply from a real person.
  • Staying on Top of Technology

    Staying on Top of Technology

    An important part of data recovery is staying ahead of new technology. It’s important that we are able to recover data from wherever people currently store their files. People once stored their most valuable data on a hard drive in their PC. Making hard drives is complicated and expensive, so only a handful of manufacturers had the resources to build them. The relatively small number of brands allowed us to became experts in the way those disks work & fail. Over time, some of those manufacturers merged or went bust. There are now just a few factories building disks. That’s not to say hard drive technology is standing still, it’s just a small enough target to keep an eye on. When Seagate release a new family of disks we scrabble around for a little while, and then ultimately find out how they work.

    Enter the SSD

    Solid State Drives have been on the horizon for a long time now. In fact, the three Macs within arms reach of me right now all have SSDs in them. The biggest problem for me, is that the barrier to entry to make SSDs is really low. There are thousands of factories in China alone with the capability to pump out millions of SSDs. Just buy some controllers and NAND chips, solder them to a circuit board — Instant SSD.

    MacBook Pro SSD

    The Numbers

    In 2018 there are only three hard drive manufacturers left. By comparison there are 35 SSD manufacturers listed — without including all the white-label, rebadged, refurbished, grey-market & clone drives in the market. If we estimate that each manufacturer produces three different product lines, you’ll get to 105 different types of SSD vs nine hard drive families. In fairness, I can think off the top of my head that some of these hard drive brands have more than three families of disk, but you get the idea. Staying on top of all those brands quickly goes from difficult to impossible.

    The Future of Data Recovery

    You’ve got to wonder if the future of data recovery will be choosing even smaller niches. Some companies may focus on recovering just one or two brands of SSD, and know that they at least have a chance of staying up to date with the latest technology.

    Dead Ends

    SSDs present a number of new obstacles to data recovery. Some of these are not challenges as much as actual show-stopping dead ends.

    Does your SSD controller use encryption, wear levelling & compression? The answer is yes for most SSDs. What happens to the data if that controller fails? In some cases this means the data is gone for good. In other cases it could mean weeks or months of manual work. You can’t just solder on a replacement controller as it won’t have the necessary encryption keys, nor will it have any idea of where the data has been stored across the multiple NAND chips.