Dataquest

Data Recovery You Can Trust

Tag: Hard Drive

  • Why Computers Always Guess the Wrong Copy Time

    In the previous part of this series, I explained why small files take longer to copy than large ones. This can make for unpredictable results when you copy a mixed batch of files. I decided to track the time estimates for such a copy and see how wrong the time estimates really are.

    Let’s kick off with another animation. I took a series of screenshots when copying files to another disk. I then tracked the estimated time to complete vs the actual completion time. I have also included the raw numbers at the bottom of the page.

    Why Computers Always Guess the Wrong Copy Time
    Why Computers Always Guess the Wrong Copy Time

    How wrong was the original estimate?

    The original time estimate was off by almost two hours! 1:59 to be precise. After 9 minutes, the estimate was off by an hour. After around 50 minutes copying, the estimate was only off by 1 minute.

    We can’t really use this data to extrapolate much, as it is specific to the data being copied. You’ll notice that the data toward the end of the copy was mostly media files. What the data does show quite clearly is that you cannot trust the time estimates.

    General Guide

    • Large media files – Fast copy, Accurate time estimate
    • Small office / text files – Slow copy, Accurate time estimate
    • Mixed data – Mixed copy time, Inaccurate time estimate
    Remaining
    Estimated Finish
    Actual Finish
    Wrongness
    03:45:00 17:16:00 15:17:00 01:59:00
    02:35:00 16:15:00 00:58:00
    01:00:00 15:18:00 00:01:00
    00:40:00 15:17:00 00:00:00
    00:04:00 15:17:00 00:00:00

    This is the second post in a mini-series about copying files. 

    Read Part One here about copying small vs large files.

    Read Part Three here about copying a failed disk

  • Why Small Files Take Longer to Copy Than Large Files

    Have you ever noticed that it takes longer to copy 200MB of small text files than it does to copy a 200MB video file. This can seem a bit strange, but there is a simple reason for it.

    Metadata

    Every time you copy a file, the system must also copy over some metadata. Things like the filename, creation date, modification date, filesize etc. When you copy a large file like a video, this information is copied once, and then all the data blocks are copied into place. With tiny text files, new metadata needs to be transferred for each and every file.

    In real-world examples, I’ve seen disks capabale of copying at 100MB/s get as low as 1MB/s when copying small files.

    This is easier to see in simple animations. In the images below, the metadata is represented by the blue container and red block. The data blocks are shown in green.

    Copy Large Video Files
    Copy Large Video Files

    Copy Tiny Text Files
    Copy Tiny Text Files

    This behaviour also leads to one of the most annoying things about copying files. The crazy time estimates! If you copy a mix of large and small files, the computer can’t figure out how long the copy will take, so just adjusts the estimate as it goes along.

    Data Recovery Time Remaining

    This post assumes you’re copying the files in ideal conditions. In the real world you also need to account for slow networks, slow connections, failing disks and countless other things that can slow down a transfer.

    This is the first post in a mini-series about copying files.

    Read Part Two here about why computers always guess the wrong copy time.

    Read Part Three here about copying a failed disk

  • Fake Seagate Samsung Hitachi Drive

    Over the past decade, hard drive companies have been endlessly bought-out and then re-sold. At this point I’ve pretty much lost track of who manufactures which brands now. Since all this restructuring, it’s quite common to see portable Seagate branded drives with Samsung disks inside & vice versa. There are also Maxtor branded versions of those same drives in some markets.

    Fake Seagate Samsung Hitachi HDD
    Seagate Samsung HDD. Seems legit.

    So what’s wrong with this disk?

    Here’s a list of some of the problems with this disk:

    • Unfinished labelling (the white edges are usually peeled off)
    • Mismatched serial numbers
    • Wrong PCB for a Seagate / Samsung disk
    • Wrong capacity
    • Misspelled Regulatory as Reaularory (see image below)
    European Reaularory Address
    European Reaularory Address

    I’ve never seen a disk quite like this. It’s from a Samsung external case with a Samsung logo on the front label. It also uses a Seagate model number ST1000LM024. Normal enough so far, however the label shows one serial number while the label opposite the SATA connector shows a different one. Also a third different serial number is reported electronically to the system when the disk is attached.

    Hitachi Edge Code Serial Number
    Hitachi Edge Code Serial Number

    The label at the end of the disk is actually a clue to the true identity of this disk. It features the familiar Hitachi / IBM style with two separate stickers & barcodes. The disk is actually a Hitachi HTS5432L9 which suggests a much older 320GB disk that was likely destined for the scrapheap in a former life. Funnily enough, these Hitachi disks had their own strange history of mislabelling.

    Fake?

    I originally thought this disk may have been a white-label or grey market disk. Some disks get refurbished and are then sold under different brand names in other markets. After a bit more investigation I think it may actually be more sinister than that. This is more like a fake or fraudulent disk, designed to dupe somebody into thinking it is a larger disk than it really is. It appears to the computer as 1TB however only contains 320GB of usable space. This is very similar to the fake flash drives we’ve seen before. The problem with fake capacity disks is that when you exceed the genuine size, the rest of the data usually becomes inaccessible. Also depending on how the disk handles the problem, it could damage the existing data when it fails.

    Recovery

    Fortunately for the owner of this disk, they had not yet used up 320GB of the disk. In fact this disk failed when the USB connector fell off. Maybe another sign of the poor build-quality of this fake. Once we figured out what we were working with we were able to recover all data. It took a combination of Hitachi firmware repair, careful imaging, and then exFAT reconstruction.

    Fake Seagate Samsung Hitachi

    Contact Us Now…

    For a fast reply from a real person.
  • Fusion Drive Data Recovery

    Fusion Drive Data Recovery

    Urgent Warning: Fusion Drive always consists of two separate disks. If you want your data back you must get both parts. We’ve heard a number of reports that users with failed Fusion Drives are only given the Hard Disk back when receiving Apple repairs. On its own, the hard drive is not enough to recover all data in original condition. This is especially true if FileVault encryption is used.

    HDD + SSD = Fusion Drive
    HDD + SSD = Fusion Drive.

    What is Fusion Drive?

    Fusion Drive is Apple’s version of a hybrid solid state & mechanical disk. It combines a small fast SSD with a large slow hard drive to achieve a balance between cost & performance. Frequently used files are moved to the SSD, and old stale data is sent to the slow hard drive. This is all taken care of automatically behind the scenes. Unless you dig into the terminal, you wouldn’t even know you had two separate disks inside the Mac. Fusion Drive is  part of Apple’s Core Storage system. It is somewhat similar to Linux LVM as a volume management system.

    What Fusion Drive is not

    Fusion Drive does not use the SSD as a cache for files but actually moves data from one disk to the other. This is important, as both disks are required for full recovery.

    Why does Fusion Drive exist?

    At launch, and even now, the cost for large capacity SSDs is way higher than the cost of an equivalent hard drive. The problem is that SSDs offer huge benefits to the user experience. When you use an SSD, you hardly ever have to wait for things to load. The computer boots up within seconds.

    Hybrid drives aim to bridge the gap between solid state and mechanical disks. An iMac with a 3TB Fusion Drive comes with some of the benefits of SSDs, but much less cost. As the cost of SSDs fall, the need for Fusion Drive will eventually disappear. Apple has shown with their current lineup that they’d much rather go all-SSD where possible. Current iMac Pro & MacBook Pro both use 100% SSD internal storage.

    Anecdote Corner

    We’ve had two recent cases where a user has brought a “Fusion Drive” to us for recovery, but actually only had the hard drive part. Apple had given the damaged hard drive back after replacement, but reused the SSD when creating a new Fusion Drive. This user only had a few GB of data so the Hard Drive hadn’t even been used yet. All the data was stored on the SSD which was now overwritten.

    The majority of Fusion Drives we’ve seen have a Seagate ST3000DM001 3TB hard drive combined with a 128GB blade SSD.

    If you need help with a Fusion Drive:

    Contact Us Now…

    For a fast reply from a real person.
  • First, Do No Harm

    First, Do No Harm

    The maxim “first, do no harm” is a great first rule for data recovery, and is at the heart of our whole approach. If you’ve lost data, it’s only natural to panic, but the safest thing to do is stop and get advice. It’s usually best to switch everything off, but there are rare times where you wouldn’t want to do that either.

    When you should switch off a failed disk

    If the drive has failed completely and you can’t access the data, definitely switch it off. If the disk is clicking, or making strange noises, switch it off. Certain types of hardware failure will get worse if you leave the drive powered on. If the heads have been damaged, they could scrape all the magnetic storage coating from the disk. When the heads are stuck on the disk, they can be wrenched off and take a chunk of disk with them.

    If you’ve accidentally deleted some files from a disk, switch it off. You might not realise but as your computer sits there idle, there are all sorts of processes, downloads, updates and other background tasks that will be writing to your disk. Also  a system task could attempt to repair the disk, or reset the computer and overwrite your files. All of these issues are avoided if the device is turned off. Your computer will happily reuse the space where your deleted files are, so once files are deleted it’s crucial to stop the computer accessing the disk. Once data is overwritten it really is gone for good despite what anyone tells you.

    If you have a cloud service setup, you should download the data using another computer & disk. Make sure you check the downloaded data thoroughly before writing it back to your original disk. If you write the cloud data straight back to your computer, you’ve lost any chance of getting more data back if there’s something missing.

    When you shouldn’t switch off a failed disk

    If the data shows up at some point, copy it straight off. Hard drives are complicated machines, but sometimes the stars align and give you one last chance to access the files. Make sure you have enough free space on another disk, and make a copy of your files while you still can. There is a chance that if you power the disk down it might never show up again. Don’t waste that chance!

    ⚠️ If you start copying files and the speed goes down, while the time remaining goes up, you should stop and get advice. The hard drive could thrash itself to pieces trying to read the files and make recovery much more difficult. You don’t want to leave the disk unattended during this process, as it could fail and need to be switched off.

    Contact Us Now…

    For a fast reply from a real person.

  • Meltdown and Spectre Data Recovery

    Meltdown

    More than enough has been written about the Spectre & Meltdown CPU vulnerabilities so I won’t go over them directly here. If you’d like more info, I’ve included some links at the end.

    My interest is more with the trouble caused by the intended fixes. Despite CPU manufacturers testing the fixes for some months, in certain circumstances they are causing random reboots, and other performance problems.

    Safely Remove

    Spectre
    To “Safely Remove” a disk is standard practice to avoid filesystem corruption. In simple terms, the computer stops writing to the disk and then you’re safe to unplug it. In the case of a random reboot, the computer doesn’t get the chance to finish with the disk.  A crash at a critical moment can damage the filesystem and render the machine un-bootable. Even if the system can recover itself, if you crash enough times your chances of trouble increase. It’s hard to trust a system that could randomly reboot at any moment.

    A Solution?

    Until we get fixes from the manufacturers, there’s not much else we can do. Now would be a really good time to make sure your backups are working and up-to-date. These fixes could take a while to stabilise, and in the meantime you could be one random reboot away from data loss.

    Sources

  • Mislabelled Apple Hard Drives MK3253GSX MK1653GSX

    I have a particularly nerdy Apple rabbit hole to share with you today involving the labels on Apple hard drives. At some point around 2007-2008 Apple started re-labelling the hard drives used in their computers. I’m pretty sure the hard drives in black & white MacBooks were standard white labels with an Apple part number (655-XXXX) printed on them. Now disks feature a black label with white text. Not particularly exciting, but maybe somebody (Jony?) wanted the disks to match the fancy black circuit boards now used in all Apple hardware. That’s the sort of attention to detail we’ve come to love from Apple devices. Whatever the reason, this has resulted in a batch of Toshiba drives in circulation with incorrect information printed on them. I assume these are the result of a simple ⌘+C, ⌘+V error. My speculation is that after printing the labels for the 320GB disk nobody remembered to change the text for the 160GB version.

    For reference MK3253GSX is 320GB and MK1653GSX is 160GB. In Apple’s world, both disks use MK3253GSX on the label, even though the correct number is shown when you check Disk Utility or About This Mac > System Information.

    This wonky number business all came to a head ? when we were looking for replacement parts for one of these disks. We needed the double headed 160GB drive, not the four headed 320GB.

    Mislabelled Apple Hard Drives MK3253GSX MK1653GSX
    Mislabelled Apple Hard Drives MK3253GSX MK1653GSX

    When I was trying to research this, I was quite suprised to find an old blog post of ours that shows the same problem with Hitachi drives manufactured around the same time. I’ve not found any other mention of this labelling fault, so thought I’d post it up here for future Mac Archaeologists to find.

  • Why You Should Never Open A Hard Drive

    See our video below to find out why you should never open a hard drive.

    Transcript

    Instead of a needle, hard drives use tiny magnets to read and write data. The heads don’t actually touch the disc.

    But you’d only see that if you got close

    Super close

    The heads float just three nanometers above the disk

    In comparison, a spec of dust in the air is 166 times bigger than the gap.

    It would be like trying to kick a football through a gap the size of an ant

    So if that giant spec of dust can’t fit through the gap, it will hit the read head

    Bouncing it into the disc spinning at over 100mph

    And scraping away chunks of disc within seconds

    Up close the tiny scratches look like mountains

    The heads can’t get past the damage so just scratch it even more

    Until there’s nothing left but dust

    This is what we call a head crash

    Why You Should Never Open A Hard Drive

    And This is Why You Should Never Open a Hard Drive! (Unless You Have a Cleanroom)

    Contact Us Now…

    For a fast reply from a real person.
  • How To Troubleshoot Western Digital Elements External Drive

    How To Troubleshoot Western Digital Elements External Drive

    Elements is the basic brand of external drives from Western Digital. These no-frills disks are usually great value, but when they fail have a few quirks that can make recovery a little awkward. For example the small pocket sized drives usually have a soldered USB port that cannot be removed. There is also automatic encryption, even if you’ve never set a password.

    Symptoms of WD Elements Failure

    • LED permanently lit / blinking
    • LED not lighting at all
    • Clicking / ticking noise
    • Disk is not formatted. Do you want to format it?
    • Unable to see your data in Windows or macOS
    • Unable to copy or read files

    Troubleshooting Ideas

    If you have problems with a WD Elements drive, you should make some checks to see if you can narrow down the fault. Be aware that opening the external drive case will probably void your warranty with Western Digital. If there is important data on the drive you should seek professional data recovery advice before you try anything.

    That’s the warning out the way, so lets have a look at some troubleshooting.

    1. First check all cables are plugged in securely, and not damaged or frayed. If you have an identical spare cable you can try it, just be gentle.
    2. If trying a different power supply, make sure the voltage matches exactly. Amps can be higher but not lower.
    3. There is little point dismantling a WD Elements drive, as there is usually no SATA connection inside. Even if you manage to bypass the USB Port, your data will be encrypted.
    4. It’s worth plugging the external drive into another computer. If it seems to work you should copy the data off straight away. The drive could still be faulty & fail again soon.
    5. Whatever you do, don’t dismantle the actual hard drive. Hard drives are built in controlled clean-air environments and even the smallest spec of dust can cause permanent damage to the drive.
    6. These external drives are quite unique in the way they work. It is not possible to replace the circuit board (PCB) on these disks, as your PCB contains important encryption keys. On the offchance that a replacement PCB worked, your data would be scrambled anyway without access to specialist decryption tools.

    If you are looking for a data recovery service for your external hard drive have a look at our external drive recovery services.

  • Troubleshoot WD My Passport External Hard Drive

    Troubleshoot WD My Passport External Hard Drive

    Unlike most external hard drives, WD (Western Digital) My Passport drives are more than just a simple wrapper around a regular hard drive. WD have integrated the USB port straight onto the main circuit board. This means if your external drive fails, you can’t easily remove it to attach to a PC.

    Symptoms of WD MyPassport Failure

    • LED constantly flashing / blinking
    • LED not lighting at all
    • Clicking / ticking noise
    • Disk is not formatted. Do you want to format it?
    • Unable to see your data in Windows or macOS
    • Unable to copy or read files

    Troubleshooting Tips

    If you have problems with a WD My Passport drive, you can make a few checks to see where the fault lies. Be aware that opening the external drive case will probably void your warranty. If there is important data on the drive you should seek professional data recovery advice before you try anything.

    That’s the warning out the way, so lets have a look at some troubleshooting.

    • First check all cables are plugged in securely, and not damaged or frayed. If you have an identical spare cable you can try it, just be gentle
    • There is no point dismantling a WD MyPassport drive, as there is no SATA connection inside.
    • It’s worth trying the external drive on another computer. If it seems to work you should copy the data off straight away. The drive could still be faulty & fail again soon.
    • Whatever you do, don’t dismantle the actual hard drive. Hard drives are built in controlled clean-air environments and even the smallest spec of dust can cause permanent damage to the drive.
    • These external drives are quite unique in the way they work. It is not possible to replace the circuit board (PCB) on these disks, as your PCB contains important encryption keys. On the offchance that a replacement PCB worked, your data would be scrambled anyway without access to specialist decryption tools.

    If you are looking for a data recovery service for your external hard drive have a look at our external drive recovery services.