Slashdot Mirror
A Walk Through the Hard Drive Recovery Process
Fields writes "It's well known that failed hard drives can be recovered, but few people actually use a recovery service because they're expensive and not always successful. Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing. Geek.com has an article walking through a drive recovery handled by DriveSavers. The recovery team did not give away many secrets, but they did reveal a number of insights into the process. From the article, "'[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage. Seagate considered it dead, but I didn't give up. It's actually pretty amazing that they were able to recover nearly all of the data. Of course, they had to do some rebuilding, but that's what you expect when you send it to the ER for hard drives.'" Be sure to visit the Museum of Disk-asters, too.
A hard drive shaped freezer.
"It's well known that failed hard drives can be recovered"
[Citation Needed]
Wouldn't backing your data up be cheaper?
--
http://vancouvercondo.info
-
then you fucked up your backups...or you don't have one...or you don't give a shit - which is my issue. If it's important I have a piece of paper, an electronic backup, and another electronic backup somewhere else...and then some...
...but are flash drives prone to the same sort of catastrophic failures disc drives are? And are the same recovery techniques workable with both? My gut tells me it's not nearly that simple.
a slashdot advertorial?
In my professional career, I've sent around 10 drives out for recovery, (various companies) and none of them were able to be successfully recovered. I think that most of these companies use some variation of R-Tools so that they can quote amazing statistics on their websites. (Over 99% of all data is recoverable!)
Sure, I suppose if the drive has bad electronics AND the head hasn't crashed, you might have some luck, but I never seem to get any of those cases. As far as people accidentally formatting their drives or deleting files, I can recover that stuff myself.
-Arthur
Cave ne ante ullas catapultas ambules
Having read the article, I can't help but think that it doesn't really read like an article of "Oh, this happened, and then this happened" especially considering that it is about hard driver recovery.
:(
Short of "sending in a zip lock satchel" and "using methodology" what exactly did this article cover in regards to recovering hard drive information? Not a lot. Sorry to be a bit of a drag here, but considering that the company was mentioned more than once, with links and so forth, it just made the whole thing read like a glorified infomercial with the added bonus of being surrounded by advertising.
Moved to http://soylentnews.org/. You are invited to join us too!
The summary says Be sure to visit the Museum of Disk-asters too. and I did. It is pure advertising. Zero facts, instead boring emotional angle with mom and pop hugging as all their iMac data got recovered.
That stuff on the front page? Bahh! Instead of 15 modpoints twice a week give me 5 article mod points to vote this one down to -1 overrated.
605413? Yes, it's a prime.
I'm sorry, but that was the most content-free load I've read on /. in a while. And no, I'm not new here - I just usually don't RTFA. ;-P
Video of the talk:
Defcon 14 - Hard Drive Recovery
Basically it talks about making a clean box and how to change out the read heads or the PCB from a drive that is the exact same model. Really cool stuff!
Recovering hard drives is a 3 step process:
1) Mumbo Jumbo
2) Put drive platter into otherwise identical drive
3) proprietary secret stuff (sound like they used Windows to get the data off and then burn to DVDs.
Now you don't have to read the article.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
"There is no there there." Why post it at all ? Shouldn't the editors read the stories before putting them on the front page ?
Are there any *REAL* guides out there that will show you how it's done through purchasing hardware from a store? It'd be nice to be able to do this all yourself if you have the right tools...
Well I for one now know what Driver Savers is (since I RTFA), but the whole thing lacks details. A story in /. should have more details than a glorified advertisement for a hard disk recovery job. There is a company down the street from me that does similar work for NASA and thus I don't think this is a unique field that no one on /. has ever heard of.
/. worthy if you (submitter) bought an identical harddisk and tried to swap platters etc and tried the recovery on your own. I've seen people do this and it's not hard to recover data even if you have physical damage on the drive.
Here is what I'd like to see (to submitter), maybe you should have gone to the corp with your drive (since you did spend 2k on recovery.. why not fly over?). Then you should have taken pictures of the whole process and even a video (instead of using stock images), and most of all you could have avoided all this by using backups.
But this story would have been truly
Here it is. Nothing helps a hard disk recovery like 500 Gigs of mirrored backup goodness.
I know these people handle very delicate cases (i.e. physically damaged media beyond all recognition).
As for simpler situations (accidental reformatting, not-so-extreme disk failure), the are some useful Open Source utilities like MondoRescue, GParted, fdisk (or cfdisk) and dd ("disk dump").
The most simple rescue method implies mounting the damaged partition onto another media, for instance an external hard drive, using Knoppix.
I recall having rescued a NTFS data partition using this method (the hard drive had spun very badly due to an electrical outage).
"Nature is indifferent to our values, and can only be understood by ignoring our notions of good and bad." (B. Russell)
on where you are, and that determines how hard condoms are to come by... (Careful... I'm watching my prepositions, and not necessarily the pre-positions....)...
But, in the vein of hard drives, i guess a not having protection can cause a bunch of thrashing about in the end... (buns, umm, PUNS intended...)
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
I've done a few platter swaps and have had good luck if I can find the right donor drive. So far I've gotten data off most of the disks I've tried but sometimes the recovery rate can be as low as 25%.
I recommend that people buy drives in pairs. That way you have a good drive to use as parts once the data has been moved off to a newer drive.
I do repairs in my house so there isn't a clean room in sight.
If the board is fried, a board swap tends to do the trick but the bad sectors are stored on the board so the mapping will result in some bad data.
I start with the hard drive in the freezer (using a external firewire case) trick first. That tends to get noisy bearings about 3 hours which is enough to copy data over.
If that doesn't work, I do a platter swap. I disassemble the drive and I've found that normal printer paper works great for lifting out the platters with out scratching them. Just make sure you put them in the donor drive in the same order and don't flip them. Once the platters are in, it appears that the drives have a few days to live before they stop working. With head crashes, you might want to consider only putting the good platters in. I have yet to find a good cleaning solution so with crashes you have a very limited amount of time but head crashes seem to be rare these days.
Once you can read the disk, use DD to copy the data to a new disk. Don't try to mount it to look for a specific file unless you only need one file and mount it read only. For data file recovery, I use a mac program Data Rescue by Prosoft which is good except it sometimes is too good and pulls out the internals like pictures out of flash and office docs.
If your going to do this at home, take apart a few older disks first. Keep in mind they designed these things to be assembled quickly so there is a way to retract the heads completely off the platter so hunt around for it. There are some people who use vacuum cleaners to try to remove dust and others will use a shower to steam up a bathroom and wait until the steam clears with the hope of taking the dust away. I just open the drives on my computer desk.
A little light on content as others mentioned :(
:( One head crashes and causes a chain reaction after the aluminum shavings clog the filters or interfer with the others. Luckily the software forced you to backup on the removeable platter each day. Only loss was a couple software mods (that the writer had a copy of) cause the system platter backup was kinda old, had to added back in.
:)
Nothing as interesting as the crash on our old mini-computer ages ago either. One of those 12" drives with 4-5 platters had a head crash and repurposed itself into a metal lathe quick nicely one weekend. At least it didnt burn down the building but it left several pounds of aluminum confetti all over the computer room after it blew out the filters on the drive. It seems you just can't filter air by the pound
Needless to say, that had a zero chance of recovery. Only time a insanely overpriced maintainence agreement ever paid off...Drive was almost $20k to replace plus cleanup and setup on 200lb drive.
Only other one that might have required a recovery service turned out to be electronic issue only and i sacificed a matching computer for the HD circuit board to repair the 'server' from a remote warehouse. Only some memos and spreadsheets and stuff and not worth the huge quote for recovery so i got to try it and fixed it the next day
PS. always found it interesting the the edge speed was the same as current drives at around 105mph. The head hit a platter going between 50 and 105 mph.
This article is such a blatant fake / advertisement, how could the moderators let that be published on the front page ?
As noted by many, no real technical information. Whoever wrote it might have tried to sound 'grassroot', but the whole thing still reads very much like a marketing material... 'Be sure to visit the Museum of Disk-asters too' ? Especially when such page contains nothing but marketing stuff ? Give me a break !
And how many people would go pay 2000$ just to get back some music and photos of the family ???
Slashdot needs a system so that people can RATE THE MODERATORS, because anyone who lets something such blatant fake-grassroot marketing material on the front-page should not be in that position.
The whole thing is just an insult to our intelligence
The big issue is that you cannot take the word of hard drive manufacturers about drives' reliability at a face value. Google's study (PDF) and CMU's study show much higher real-life HDD failure rates than you would get from manufacturers' MTBF claims. RAID 1 or higher is not the full solution - multiple failures, controller failures or data corruption can still occur. Your drives will most often fail without any warning.
Of course if only the USB interface chips are broken, you could potentially unsolder the flash part off the bad unit and onto a good unit and recover it.
Engineering is the art of compromise.
regardless of what some are saying about this article being more about advertising, the hard drive recovery process is very interesting and something people should take the time to learn about. Not cheap by any means, but I will say that I am a DriveSavers partner and their work is superb. For being a reseller/partner they give you 10% of the data recovery fee for anyone you refer. And on top of that, they also give your customer a 10% discount as well for the referral. Well worth it for those people who drop their laptops in the ocean or those careless DJs that have the tendancy to spill their beers. Not to mention they can recover encrypted data and respect people's privacy. Mostly government agencies. And I mean c'mon, they rescued JIMMY FREAKIN BUFFET'S DATA! Now THAT'S saying something!!! well.. maybe they shouldn't of done that.. we could have dealt with one less Jimmy Buffet album.. damnit why the hell did you recover that data!!
*plays the Apogee theme song music*
About eight years ago, I used one of these data recovery companies [can't remember which, I'm afraid] and I was not impressed. I had a dual boot windows/linux machine whose hard drive died. They managed to recover almost everything from two different windows partitions but ***nothing*** from any of the six linux partitions. I was never convinced that they even tried to get stuff from those partitions. Perhaps their software was FAT orientated, but I don't know.
I dont care who you are, but that there's funny.
No, I'm New Here
Make a clean box, swap the platters, dd the data to a file, run various types of fsck on loopback until you get it right, mount loopback file, read data.
/meh
3. Profit.
I want to delete my account but Slashdot doesn't allow it.
So in exchange for clicking the link and getting a full page video ad before getting to the article, I learned some amazing things about hard drive recovery like...
/. did a good job at helping him recover all 1900 of those dollars spent...
1) First they take it into an ultra-cool clean room.
2) They do something to it. Must be ultra cool.
3) Recovered for $1900!!!
I'm sure
For everyone else, don't bother with the link, my summary really is all there is to the article.
It's well known that failed hard drives can be recovered, but few people actually use a recovery service because they're expensive and not always successful
... much like this article.
.. err .. mechanical and electrical? You mean the reciprocator was caught in the optical refraction? Now that's worth $1500.
Yep. The article helpfully points out the $1500 charge for a medium sized hard drive. It might have been more interesting if the article demonstrated a time when it wasn't successful.
Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing.
So, just like this article? Got it. Something involving putting old platters into new drives by people wearing bio-hazard suits.
The recovery team did not give away many secrets, but they did reveal a number of insights into the process.
Wowsers. You can say that again, but insights? I defy anyone to name any insight that wasn't in their last press release
[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage.
Doesn't "elctro-mechanical failure" describe anything that could be wrong with a device that is
It's a good thing space on the interwebs is free. Someone should run this past the kids that edit airline magazines.
I actually use a number of drive recovery companies, and thanks to this slashvertisement I will never use this company nor will I read Geeks.com
The sad part is that I rarely even read Slashdot anymore since it is a sad shell of what it was... Pitiful.
http://teasphere.wordpress.com - A little spot of tea
That is a nice theory but there is no oil in the bearings of a Hitachi (formerly IBM) drive. They ride on an air bearing. I have heard of faulty temperature sensors being reset through the freezing method, but whatever the reason I have seen the freezing method suggested by several sources. For me I believe that it has to do with moving the drive. Shorts or binds will often be resolved by moving the drive around.
When I worked for IBM I did a fair share of data recovery. My favorite drive that I saved was a laptop drive with a stiction problem. It would get caught during spin-up. I put my ear to the drive and would listen to it and kept rebooting and shaking the drive until it finally got past the rough spot. Recovered all the engineers data who was extremely happy he didn't have to waste $500 bucks with Ontrack.
--
So who is hotter? Ali or Ali's Sister?
I found an unusually large proportion of the follow up comments here to be (+1, Informative) and (+1, Interesting). TFA itself was total infomercial-tastic tripe, however.
Please stand clear of the doors, por favor mantenganse alejado de las puertas
Has anyone tried recovering data by putting the platter under an AFM and using a magnetic tip?
I did surface probe microscopy for a living for many years and to me it seems trivial. You can rent time at a university on a decent AFM and you should be in business though it might be slow going.
Has anyone tried it?
I've done something similar but somewhat less extreme than this. I had a laptop hard drive that wouldn't return any data in the laptop. It would identify, but that was it. In the external case it worked for a couple of minutes then stopped. Drive temperature seemed unusually high to the touch. Reasoning it was most likely a heat failure I pulled the drive out of the external case and put it, the usb-to-ide converter electronics and associated cabling in front of a Real F'ing Big Fan (tm), turned to high. Drive stayed cool to the touch, and worked perfectly for the half hour it took me to image it.
WTF? Adverts for disk recovery companies and bicycles than launch floppy disks. Thanks /. Have you jumped the shark?
As for recovering data, and as many, many, many people have said here. If you don't have a backup, you are a complete tool. And I don't mean archiving to optical media, because you're just asking for trouble there.
As for recovering data, short of mechanical failure, if you're trying to recover data from a drive or RAID array of some sort, I can't recommend the stuff from Runtime Software (runtime.org). RAID Reconstructor and GetDataBack have saved my arse more than a few times (Because yes, the first time I was a tool and didn't have a backup. The second time I still didn't have a backup, cause "That won't happen again". The third time I had a backup, but it wasn't automated, so it was out of date. The fourth time I didn't have sufficient capacity). So basically it just boils down to me being an idiot, but Runtime's software got everything back each time. The last instance just took three weeks (Long story). So now I have an automated backup, backing up the NAS to a RAID array of sufficient capacity.
Look at the normal ceiling tiles and door that aren't air tight. Even the small (3 employee) company I work for has a better clean room than that. Their outfits were just for show.
Seriously. Who pays $1,900 to recover "all of his music and all of the photos that his family has taken of their two year old son"?!
From how it's worded in the article, this isn't information that would make or break daily life. Maybe if the music was one-of-a-kind stuff, or if the pictures were of a dead family member, and said pictures have only been stored on this one hard drive - that might justify the expense.
More than likely, this guy only had run-of-the-mill mp3's (that could either be re-downloaded or re-ripped from the source), and all the important pictures have probably been sent to family members, friends, and/or uploaded to all the social networking websites you can think of. I've been through data losses like this (in that I lost a boatload of disposable media) more times than I'd like to admit, but I could never see my personal, non-work-related data ever being worth $1,900.
I am surprised at the amount of voodoo and misconception on this topic, in a land of geeks who probably should know better. Having been in the data recovery business for several years, I have noticed that nobody gives your the real truth: Most data loss is the result of small corruption that fouls up your $MFT, or formatting, and as a result your drive is not recognized by "most" operating systems. This is what we classify as logical errors (not enough damage to warrant open case recovery) This is about 85% of all drive we see, and we only charge $80-160 on average. The ones we can't recover, we send to the SHOP, and they ARE 100% effective, so far. So most of what I read is crap, it is NOT reality, at all. But it is really hard to determine what is real in this VERY secretive industry, we are like the CIA......I am probably gonna disappear after this post. I AM NOT planning to commit suicide............
I've disassembled crashed drives (ceased) to temporarily free the platters. Aside from removing the platter (so they could get to more then 25% of the data, WTF?) it didn't really read like they actually did much. Maybe part of the reason that they are all smoke-and-mirrors about the work (some proprietary software, you mean like something they paid for?) is that when you get right down to it the work *most* of these shops do simply isn't rocket science.
Quack, quack.
Great, no new information, just an advert for a drive recovery company.
I'm going to have to train Adblock to parse Slashdot for this sort of rubbish now!
Can SSD disks also fail without any prior notice?
Is there any company able to recover data on a damaged SSD disk yet?
{{.sig}}
This was an advertorial, pure and simple. Advertising masquerading as editorial content. In UK newspapers and magazines, such content must be labelled as an advertisement. Seems that this does not apply to websites in less civilised nations.
I was just waiting for the bit where a HDD caught fire and they managed to recover 90% of the data from a reflection of some of the smoke in a bystander's eye, as captured in a photograph on a mobile phone. Or the example of the parent whose little darling brought home a "kewl new game" from a friend at school which, after trying it out on the family PC with several generations' worth of photographs, home movies and so forth, turned out to be DBAN -- but DriveSavers recovered everything and even managed to render Grandad's old scanned sepiatone photographs into 48-bit colour.
Hint: IT professionals, with a very few exceptions where it is genuinely relevant, do not use Adobe Flash content on their websites.
Je fume. Tu fumes. Nous fûmes!
What about non-hardware failures? Anyone able to provide any info about how to recover files where it appears to be just a loss of the file/index? I had a 320GB external Firewire/USB2 drive that had about 90 GB of mixed photos, music, text, office, etc that appears to have lost the ability to see content. It's all (mostly) there, as I can tell by the available memory display on the front, but the drive doesn't see it. Mac and PC same, appears empty. I've been looking at varied software to recover online, and haven't found anything that's really useful unless rediculously expensive. One was charging by the MB, and most don't recover file names or any sense of file organization. Honestly I can ignore the music, as I've got 99% of that on CDs that I'm too lazy to reimport, but the photos and possible some of the old docs are important to me. It burns me more than anything that there just doesn't be any actual damage beyond the machine lost it's index (thanks to an Apple Airport Airdisk update that messed up names of USB attached drives).
Any good suggestions of where to go from here?
... and they needed to change chips on the PCB to get further? "We had to replace the actuator assembly and components on the printed circuit board. By performing these actions, we were able to image about 25 percent of the drive." and "In my case they restored approximately 80 percent of the drive and put it on a new external hard drive" Maybe you should have, sorry maybe your brother in law - should have just reversed his truck over it coz according to their Museum of Disk-Asters they can get 100% data from that or 1700 degree infernos.
Lame attempt as counter-measure to the popularity that ontrack gets from http://science.slashdot.org/article.pl?sid=08/05/07/1834224
No, that is because of the complexity that goes between mapping actual data to physical sectors.
Because of various caching / read ahead / abstraction layers that each have different block size (physical is usually 512bytes, Linux software RAID is userconfigurable, but usually 64KiB by default, LVM partitions have usually 1MiB per bloc by default, most file systems use 4KiB blocs) / etc... you end up reading 1 single byte of data and the harddrive pulling several dozen or even a hundred of sectors.
Thus the "bad sectors" utilities and built-in functionality in most file systems dramatically overstates the amount of damaged space.
Manually using DD with all bufferings and caching disbaled might be a tad more reliable.
What actually works is to read the drive's SMART logs to find which drive sector is reported as damaged, then using DD with all caching/buffering/etc. disabled to overwrite that single sector (you might want to try read that sector and the previous one, again with no buffering, to be sure if you can reproduce the flaw and if you correctly found the damaged sector).
Then again retry the drive (best is to ask the onboard firmware to do a full scan using SMART), find other damaged sectors, and repeat.
The SMART is the most precise tools, as you get the raw numbers as the harddrive is encountering them. There's no huge layer of abstraction which could lead to some sector being accessed even if it wasn't the initial intention.
---
Also another possibility is that the drive didn't actually fail, but that some data was damaged.
The drive reads the sector happily (no clicking noise of death or whatever), but some checksum fails along the line (either in the driver controller, and therefore SMART is reporting a bad checksum, not a unreadable sector - or in some other level in the OS)
Writing new data force all the checksums to be updated with the new or corrected data, and everything is back to normal.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Hard drive companies never guarantee or warranty the data on your hard drive - ONLY the physical drive itself!
Even if you send the hard drive back to the company, and the hard drive is under warranty, you always get a blank drive in return.
Your data means nothing and the hard drive company wont recover or pay for recovery of your data even if they are at fault and the drive fails under warranty.
Your only course of action to save money is to always buy two identical drives and always back one up to the other and keep it off line.
I forgot the other important factor:
Backups must be tested
If anybody wants some fairly good information, then check out this site:
http://www.actionfront.com/ts_whitepaper.aspx
They have white papers on the subject. If you disregard the glorification the company allows themselves at the end of each paper, it gives some insights about what the data recovery services (usually) aim for and some basic stuff about hard drives.
For the life of me every time that I have had this talk with other people they said that you can not bring back a hard drive, well girls and boys they would not have the Robot in lost in space the star of the the show when will get in trouble. Now that we can bring all Robot's back to life we will have some fun.