It’s always interesting to see how a complex manufacturing line can be run from such old hardware. In this case we were sent a custom PC from a machine that is used to fill and cap bottles.
The first problem was trying to get the case open to remove the hard drive. There is no ifixit guide for this thing!
Inside I found a 20GB Seagate laptop drive (dated 2007) running Windows 2000 along with the programs that control the machinery. The hard drive was connected to a proprietary motherboard that in turn connected to the machinery via serial ports.
In this case, data recovery was not enough. What the client needed was a full working copy of the failed disk to reinstall into the system. The aim was to get the kit up and running and return it to the customer so they could carry on with work as soon as possible.
We’re set up to handle exactly this sort of problem, so I got this recovered and returned within two days.
If you’ve had a disaster during the Windows 10 Upgrade, don’t panic. Chances are your data is fine, but whatever you do next could change that!
If You Have a Backup
If you made a backup of the data before the upgrade then check the backup files on another computer. If the backup is good, the safest way forward is to restore the backup onto a fresh drive. Then if you find a problem with the data later, or if the restore fails, you still have the original “broken” drive to send to us for recovery. A common mistake is to restore the backup onto the failed disk, but if that goes wrong you’re left with nothing!
If You Don’t Have a Backup
If you don’t have a backup you need to be really careful what you do next. If you send / bring the computer or disk to us, we can safely recover the data using the techniques we’ve developed over the last 15 years.
Whatever you decide, give us a call first, and we can warn you against doing anything that could harm the data.
For the last few years, newer editions of Windows have the ability to encrypt the whole disk with bitlocker. This means far more users are experimenting with encryption. We have seen an increase in recoveries from drives secured with bitlocker.
Is Data Recoverable From Bitlocker Drives?
In many cases the data is recoverable. It is important that we get the recovery key or password, as bitlocker security has not been compromised.
The most common problems we see with bitlocker encrypted drives are when the disk starts to fail, or when Windows becomes corrupt. This can prevent the built-in decryption process from working correctly and leave users locked out of their data. These drives can fail like any other, but the encryption adds an extra layer of complexity to the recovery process.
If using bitlocker on your drive, it is important to keep a copy of the decryption keys in a safe secure place away from the computer. It is also extra important to keep a constant and regular backup process. Although recovery is usually possible from a failed bitlocker drive, it could take a number of days. You probably wouldn’t want to live without your files for that time.
If you have a failed bitlocker drive that needs recovery, (and if you have the recovery key) get in touch.
This OWC external enclosure is a common sight on the desks of Mac users with big storage needs. It’s a pretty standard 4-bay box, styled somewhat like a cousin of a PowerMac G5 or 1st generation Mac Pro. Inside are the usual options of RAID 0 to RAID 5 with a few additions like JBOD & RAID 10 thrown in for good measure. There are a few variations of this device but the back panels commonly have USB, Firewire, and eSATA ports for direct connection to a PC or Mac. There is no ethernet port on these drives which makes the Qx2 a DAS (Direct Attached Storage) rather than NAS (Network Attached Storage).
Aside from massive name, the OWC Mercury Elite Pro Qx2 also comes with a potentially huge amount of storage. Currently up to 32TB on the OWC store, but also available diskless or BYOD (Bring your own disks). With so much storage space, these drives often become the one and only repository for vast lumps of important data. The benefits of RAID give a false sense of security that the data is safe from drive failures. Unfortunately, there are a number of reasons why the RAID array alone will not protect from certain failures. Most of these failures can be overcome by us in our workshop, but they are not one-button fixes. It is helpful to understand why a seemingly rock-solid platform can be even more risky than a simple external USB drive.
Under common settings, the Qx2 will use RAID 5 for the array. With four 2TB drives this gives you a 6TB volume on a Mac or ~5.5TB on a PC, and can cope with a single disk failure. There is a lot of debate about how good RAID 5 really is for such large drives. In our example this means that if a single disk fails, it will need to be replaced, and then the new disk rebuilt with 2TB of data calculated from the other disks. This will take many hours, even under optimal conditions, but if anything goes wrong before it completes the array could stop showing up all together. At this stage, the data is probably recoverable but don’t panic. One wrong move and the data could be gone for good.
If the data is crucial then get assistance from a RAID recovery service now and you should get back all or most of the data.
If any disks are removed or replaced at this point the array could get reinitialised and either make the recovery more complicated or wipe the data completely.
Aside from all the problems with a RAID setup, the volume could also fail in the same ways that a standard hard drive can. There could be deleted files, a reformatted or corrupt partition, or even the RAID controller failure. RAID cannot protect against those types of failure at all.
Our first step would be making read-only copies of each disk in the array. This protects against further disks failing, and also allows us to work from copies without risking the original disks. In fact, once the disks are copied, we put the originals to one side and don’t touch them again until all the data is recovered and supplied back to the user.
Once we have our copies, they are loaded into our own hardware where we recreate the RAID in a virtual environment. Again, we don’t use the original hardware, as that may have been the root cause of the problem.
When the virtual RAID has been loaded and all the data extracted, the files are supplied back on whatever alternative storage is suitable, (not the original device!) Once the data has been delivered to the user, and backups made, the old unit can then be destroyed, or returned and reused.
Anyone using RAID on a regular basis should know that RAID is not a replacement for backups. If anything, the increased number of disks makes failure more likely. This needs to be addressed by either making backups to another device, or an online service (preferably both). You ideally want backups that keep historic versions of the files, so that inadvertently deleting a file or changing a file by mistake will not also replace the backup version.
If you are having problems with an OWC Mercury Elite Pro Qx2, give us a call or send a message via the form on this page. We give free advice and could help you avoid permanent data loss.
1. Macs now use 1000 bytes for 1KB but PCs use 1024 bytes.
2. Even RAID 6 does not solve the long time required to rebuild a disk, even though it allows for two disk failures.
Once again we had an enquiry from a customer who was at her wits end and wanted a second opinion. She had spilt coffee on her laptop that had all her family photographs. She had taken it to PC World where she had originally bought it. They advised her to use their internal recovery process, and sent it off for analysis. She was eventually told that there was no chance of recovering her data from the liquid damaged hard drive. But fortunately for her, against the advice she received, she decided to search online for another data recovery company. This is where we came in. Although the hard drive was covered in sticky coffee and damaged by the liquid, we were able to overcome the problem and recover all of the data for the customer. Once again another happy customer as a result of a second opinion. This is becoming a habit.
PGP WDE is an encryption tool that uses a boot loader installed on an internal hard drive. This utility launches before Windows and prompts the user to input their password. Without the password you cannot gain access to the data.
This utility is widely used by IBM personnel and is now part of IBM’s process that has to be adhered to by end users. Prior to this utility IBM hard drives were restricted access by a low level ATA hard drive password setup by the internal IBM IT department. As computer systems advanced and maybe as a result of a reduced IBM IT department, IBM adopted the user friendly PGP encryption process.
We regulary receive these hard drives from IBM, and we find that the major problem is related to the PGP boot sequence. PGP does not like a hard drive that is suffering from bad sectors, especially within the partition table. It results in the user being unable to load their access code on startup, or in some cases the code is accepted but does not boot correctly due to bad sectors further along.
We have a lot of experience recovering data from PGP whole disk encrypted hard drives and as a result our data recovery process has a very high success rate.
Now in a new 7mm slimline form factor, and Advanced Format specification, the HTS5450 hard drive is proving a popular choice for vendors with limited space. The drives are especially popular in Ultra thin laptops and slim portable external cases. Now being manufactured by Western Digital under the brand name of HGST, the 500GB boasts just a single media platter to store all that data. Part of the redesign also brings Advanced Format to these drives. Certain older operating systems such as Windows XP require the use of the HGST Align Tool provided by Western Digital. Users of the latest OS X systems and Windows 7+ do not require the use of this Tool.
Advanced Format has been introduced to cram more data on a single platter. To do this the manufacturer has increased the standard 512 byte sector size to a 4096 byte sector. This format design also incorporates better data integrity, hopefully giving the customer all round better performance and reliability.
When you boot up your computer, you expect to see all your familiar files on the desktop, or maybe in the documents folder. What you may not realise is that those folders are actually a bit harder to find if you look at the disk externally. It depends what operating system you use so below is a general guide of locations for Mac & PC users.
Windows Operating System
All user data should be stored within the user profile folder, which is created when the PCs is first used. This is usually located in the following locations depending on the version of Windows:
Windows 95, 98, NT, 2000 & XP
Local Disk C:\Documents and Settings\User ( for example C:\Documents and Settings\John )
C:\Users\User ( For example C:\Users\John )
In systems earlier than Windows 7, some software may be stored in the “Program Files” folder in the root of the drive. This was considered bad practice so in Windows 7 any Program Data should be found in the “Program Data” folder on the root of the drive and not in “Program Files.” Sage Accounts can often be found within the C:\Program Files\Sage\ folder.
Macintosh Operating System
All user data should be stored within the user folder, which is created when the Mac is first used. This is located in the following location:
Macintosh HD/Users/user ( for example Macintosh HD/Users/john )
In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.
The Filing Cabinet
The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.
This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.
Overwritten / Deleted Data
We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.
The Problem With SSDs
Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.
In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.
If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.
The Important Bit
If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.
We have just completed a complex data recovery, where a Mac system had been inadvertently overwritten with Windows. The Mac drive originally had over 500GB of data, so we expected to get most of it back, we just didn’t know how good the structure would be.
It helps to visualise the layout of the data on the disk. before it was overwritten, the data would have looked something like this:
Although the fresh Windows system is much smaller than the original data, it prevents you from seeing any of that old Mac data.
Once we made copies of the drive, we were able to reconstruct the missing parts of the Mac data, and could see all the original files and folders, with their original structure.
Luckily nobody had tried to fix the problem with this drive. Often the fixes people attempt are worse to recover from than the original problems.