Slashdot Mirror
Data Recovery - Put to the Test
Kurtis Kronk @TheTechLounge writes "Today we get a close look at perhaps the leader of this industry, ACR Data Recovery. I worked closely with Doug Roberts of ACR to find the answers to questions you might ask. Not only did I ask Doug an array of questions, I also received a sample of their Media Tools Professional 2003 to see for myself if it really works, and moreover, how well. Check out this article for the full story."
reminds me of an old program i actaly payed for,
McAfees 'Lost and Found'
it only relay had two options at recovering,
but at the time it was the best avible,
I bought it cause of a review i read and a
sample they gave out with the cd, good stuff
too.
Damm shame when 2K came out Lost and foudn was pritty much droped, or compleatly renamed and hiden.
You have 5 Moderator Points!
Which Helpless Linux zealot/MS basher do you want to mod down today?
I've been swashdotted -- Elmer Fudd
I just served as an expert witness for a software theft case. Data recovery was vital in proving when and where the software was copied. ...and yes, the interview seemed a bit like a self-promo piece.
Is that the same Kurtis Kronk that posted inane comments on this forum?
Surely there can't be that many people in the world bearing the same name.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
When I destroyed a fat16 hard drive lately, A friend of mine and myself didn't like the tools we found, so we wrote our own. http://www.mit.edu/~raindel/ This tool: puts together 2 fat tables to make one. searches for fat chains. locates directories and builds whatever directory structure is available. sooner or later I will get around to make a general purpose free software tool out of this, but I have other stuff to do first. Me. P.s Backup is simply not enough.
Right, but thats only half the battle. You also need a drive head with the same tolarences as the original drive and drive electronics and firmware which is identical to the original (How a drive stores blocks on a disk is upto the drive, after all) I remember that there was a Slashdot article on this subject a few months back. A guy had a drive with fried electronics, so he tracked down and purchased a drive of the exact same model and swapped the boards. Except they wern't the identical models, and batch the new drive had a different layout and newer firmware. It didn't work, and he had to track down a different drive with the same electronics. Even then he still had to re-flash the firmware with the exact same version as his original drive, before he could read any data.
So "just put the platters in another drive" is a niave and just plain wrong "solution"
"Use our software, it was made in DOS, and works Real Good (tm)"
I want to hear about how you get data of a drive that's been shattered, or shot, or burned in a fire, not how amazing your marketing department is.
Weak.
CIA Industries - Running the world for fun and profit
We make constant backups; we have two disk arrays that are mirrored in real time between two sites in concrete bunkers 1/2 mile apart.
So, what you're saying here is that even a small nuclear explosion will take out both of your data centers? Poor planning!
I'm only a little sarcastic. The last company I worked for contracted with... who was it? Genuity? Somebody who ran data centers all over the world. Anyway, they contracted with somebody to have two storage arrays in two data centers on two different continents. One was in America, in Denver I think, and the other was in Singapore. They were giant HDS 9900 arrays with a dark fiber circuit between them running whatever they call their hot-mirror software for real-time mirroring. The idea was that something like an earthquake wouldn't be sufficient to take out both data centers at once.
Yeah, it was a bank.
Is there any particular reason no one's mentioned recovery using SystemRescueCD? (GNU GPL2 licensed)
Though not 'marketed' as a Data Recovery suite, it's got enough bits, parts and tools to handle %99 of what most of us run into in the field.
It's done near magic a time or two for me here.
http://www.systemrescuecd.org
It started off as a hobby, sort of. I used to work for the old WordPerfect corporation where we had customers that sent in floppies that had "REALLY IMPORTANT" documents on them that had become corrupted or partially deleted, one way or another.
Data recovery tools weren't as advanced as they are nowadays so it was a much more arduous task. I had to scour the floppies and pull off as much data as possible, mostly using the old debug command under DOS. I was mostly doing it for fun as the WordPerfect corporation didn't want to become file recovery experts. I was just into it for the challenge and to offer a nice service to our customers.
I recovered data off a floppy that had a pencil stuck through it, floppies that had been formatted (easy) partially erased by magnets (tough), and various methods of corruption and deletion - including accidentally saving a blank document over the top of an existing document... OOPS!
I was once asked "How do you recover the data?" and I had a tough time answering, as each case was different from the other. I just told them that "Performing data recovery is like running a sausage mill backwards to manufacture pigs." What comes out of the process doesn't look pretty, but its better than starting from scratch.
I then went on to recovering data from hard drives. After WordPerfect I became a 'consultant'. One Monday morning, one of my customers had their WIN NT 3.51 server hard drive crash. It was a head crash, you could hear the heads riding the platter. An awful noise that once you hear it, you know you're screwed.
I spent 16 hours pulling data from that hard drive, and once I was done (I had pulled as much data as I could) we opened up the drive to discover that the head on the bottom platter had fallen down, and had been riding there over the weekend. It had etched away at the platter for so long that the platter had actually fallen down and was sitting in a pile of HDD shavings at the bottom of the drive. Sheesh!
Over the years I collected numerous utilities for data recovery, but I started getting out of it once LBA mode drives came out and the actual hard drives were being managed internally, rather than by the OS. Not that it made it more dificult, but you saw fewer and fewer hard drive errors because MS was finally removed from their management position over the HDD data.
Anyhow, back to work...
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
ACR Data Recovery Media Tools Professional 2003. Really! I got one of those terrible deskstar drives, and recently it started going whiirr-click. When I tried booting Win2k it decided it needed to check for integrity and after about a 1/2 hour of "fixing" rendered my hard drive unbootable and fdisk showing no partitions! I tried 4 or 5 of the "big" software solutions to no avail. Media Tools was the 1st one that actually worked. I was able to rewrite the partition and fat information and "gasp" mount my hardrive! Much of the information was corrupted but at least I got some/most of it. The only thing that really sucked was Media Tools 25 drive licence, I used 5 of my licences just to get my data back from 1 drive. I am now using a highpoint 404 controller to mirror my new drives. Less than $200 for a drive mirroring solution. I learned my lesson!
Swear to god, this was just a strange coincidence.