Slashdot Mirror
A Walk Through the Hard Drive Recovery Process
Fields writes "It's well known that failed hard drives can be recovered, but few people actually use a recovery service because they're expensive and not always successful. Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing. Geek.com has an article walking through a drive recovery handled by DriveSavers. The recovery team did not give away many secrets, but they did reveal a number of insights into the process. From the article, "'[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage. Seagate considered it dead, but I didn't give up. It's actually pretty amazing that they were able to recover nearly all of the data. Of course, they had to do some rebuilding, but that's what you expect when you send it to the ER for hard drives.'" Be sure to visit the Museum of Disk-asters, too.
In my professional career, I've sent around 10 drives out for recovery, (various companies) and none of them were able to be successfully recovered. I think that most of these companies use some variation of R-Tools so that they can quote amazing statistics on their websites. (Over 99% of all data is recoverable!)
Sure, I suppose if the drive has bad electronics AND the head hasn't crashed, you might have some luck, but I never seem to get any of those cases. As far as people accidentally formatting their drives or deleting files, I can recover that stuff myself.
-Arthur
Cave ne ante ullas catapultas ambules
Having read the article, I can't help but think that it doesn't really read like an article of "Oh, this happened, and then this happened" especially considering that it is about hard driver recovery.
:(
Short of "sending in a zip lock satchel" and "using methodology" what exactly did this article cover in regards to recovering hard drive information? Not a lot. Sorry to be a bit of a drag here, but considering that the company was mentioned more than once, with links and so forth, it just made the whole thing read like a glorified infomercial with the added bonus of being surrounded by advertising.
Moved to http://soylentnews.org/. You are invited to join us too!
Video of the talk:
Defcon 14 - Hard Drive Recovery
Basically it talks about making a clean box and how to change out the read heads or the PCB from a drive that is the exact same model. Really cool stuff!
Recovering hard drives is a 3 step process:
1) Mumbo Jumbo
2) Put drive platter into otherwise identical drive
3) proprietary secret stuff (sound like they used Windows to get the data off and then burn to DVDs.
Now you don't have to read the article.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
There's tons of information out there. We'll omit details about how your data should have been backed up. The rest of it's pretty simple, and it depends on your filing system, but marginally.
1) find out what's wrong with the drive (logic board or drive motor board)
2) get an identical drive; put the old platter assy into the new drive's guts, or just move the good drive's electronics over
3) use a sector editor to find the FAT, journal, or whatever, or restore the MBR and use your fav OS (Kunbuntu, here)
4) painfully gather files (actually, go out back while they're retrieved for you)
5) collect fat (as in BIG) check with lots of kudos, thank yous, and appreciation
6) repeat
You don't have to backup, as long as you have a fat wallet.
p.s. TFA really does sound like a commercial.
---- Teach Peace. It's Cheaper Than War.
I had a primary hard drive fail in a linux file server I have at the house. The backup hadn't been taken in a while (yeah, I got lazy), and I really needed the updated files.
A friend of mine told me this method, so I tried it; it worked. I got more than 30 minutes of operation out of the drive, enough to pull ALL of the files off (30 gigs of data) successfully.
1. Put masking tape over the data and electrical connectors of the drive.
2. Immerse the drive in a ziplock bag of minute-rice, with the data/power connectors sticking up. This can't be regular rice, it MUST be minute rice. This acts as a poor man's silica gel later in the process. Close the zip-lock.
3. Freeze the bag of rice with the hard drive in it in the deep freeze for 24 hours. You want it completely frozen, patience is a virtue.
4. Remove the bag from the freezer, and take it to a pre-prepared computer where the drive is ready to be received and plugged in (longer data cable, longer power cable, etc...) You should have another big data drive in the system ready to receive the data from the frozen drive.
5. Leave the drive immersed in the minute rice except for the data/power connector. Remove the tape. Plug in the data and power cables. Try to re-seal the zip-lock bag as much as possible so you don't have rice grains escaping.
6. Orient the drive so it's laying in as natural of a position as possible with as much frozen rice around it.
7. Fire up the system, and try to access the frozen drive. This is the moment of truth. If you're lucky, it'll identify and respond, and you'll have access to the file system.
8. You now about 20 reliable minutes to copy data. You may get more if you're lucky. Copy copy copy. Note: The drive WILL be slow at first, and will speed up as it starts to warm.
Why the minute rice? It performs two functions: First, it keeps the moisture from condensing on, and in the drive's metal parts. Moisture's the killer when you power up a frozen drive. Second, it provides an additional thermal block of "cool" to help keep the drive at a lower temperature while you perform the copy.
After I got the data, I scrapped the original drive I froze (literally, out came the platters and they sit in my stack of platter-shame.) No sense courting disaster a second time.
I've since used this method 2 more times successfully with other people's hard drives. I suspect the recovery specialists use a similar trick, only they'd be smart to use a sub-zero frozen room with no moisture to do their "cold start and copy" process.
A better version of the poor man's silica gel is crystalline kitty litter (which is just rebranded silica gel).
If I have seen further it is by stealing the Intellectual Property of giants.
Have a look at this photograph.
The chip on the left is memory. That's where your data hides. The chip on the right is the memory controller. If that chip fails, but the memory chip is intact, your data may be recoverable.
Surface mount chips are hard, but not impossible to swap out.
"I've got more toys than Teruhisa Kitahara."
get an identical drive; put the old platter assy into the new drive's guts, or just move the good drive's electronics over
That's the hard part. "Identical" means not only model, but often revision as well. Once I did get lucky and find another drive from the same batch, and successfully trade circuit boards. But a couple of other times I failed to find the same rev. number, and the transplant didn't work.
I've been successful a few times freezing the drive (sometimes extending runtime with a can of freeze spray, an aerosol like canned air but gets a lot colder, intended to help techs find thermal problems). And mechanically abusing it (twisting it to start the platter spinning, or just whacking it.
Always have everything ready to go, if you do get it started it may work for ten minutes and quit. Maybe you'll get it started a second time, maybe not.
When the problem has (apparently) been data corruption rather than a hardware problem, I've been successful with software a few times. Once with OnTrack EasyRecovery, several times with File Scavenger. Including once where the problem was obviously a head crash, the drive made a horrid screeching sound. Couldn't get all of the data, but got some of it.
There's a pdf at http://www.hddrecovery.com.au/ that's got some other suggestions. (I have never tried that company's recovery software so have no opinion on it.)
I've never had anybody who was willing to pay to have the data recovery pros do it. But often they'd be willing to go a few hundred bucks for me to have a shot at it. Sometimes we get lucky. Sometimes we don't.
....Or, better yet, set up those two drives as a RAID mirror ...
For Macs with 10.5 that has become easier because of Time Machine. A 2x1000G RAID box connected to an Apple Extreme wireless router does backups for 6 Macs over the network.
If one of the drives fails, the RAID device makes an audible alarm and indicates which of the two drives has died. A new drive can be installed without shutting down the RAID system. Once the new drive is plugged in, the controller in that box automatically copies all the data from the still working drive.
So far, there have been no glitches or hiccups. Our lone PC user has to copy important files manually to the RAID box.
All theory is gray
Not necessarily true. You just need to locate another identical flash drive, and swap over the memory chip (the one with two rows of pins spaced stupidly wide apart). Be careful with the unsoldering and soldering, for fear of ripping the tracks off the board -- these devices tend to be built on FR4, which is not renowned for its copper-to-substrate adhesion. Use plenty of flux (if you can breathe, then you aren't using enough).
It still might not work if the controller failure took out the flash memory with it, but in practice this is rare.
Je fume. Tu fumes. Nous fûmes!
I tried Drivesavers once in the distant past. $1200 later, they hadn't recovered more than a megabyte of data off of an 40gb server drive -- and it was all OS files, none of the actual data files we wanted. They claimed the files were too fragmented on the drive, and the failure was too extreme, that nothing else could be recovered. I doubted this because the server ran a defragging routine during downtime.
But it taught me a lesson. I had been on vacation for a couple of weeks, leaving the tape backup system in the hands of someone else. They dutifully swapped tapes on schedule, but never checked the console to determine that the tapes were full and needed to be replaced with new (or newly-erased) tapes. So for six days, no tape backups occurred -- and of course, that department just happened to do a lot of valuable work during that time because it was approaching a deadline. That team valued the work at over $50K. *sigh* After that, I overhauled that server to include RAID, plus a secondary server which cloned all the data from the first server nightly, plus put an autoloader on the tape drive.
$nice = $webHosting + $domainNames + $sslCerts
Fluid Dynamic Bearing Spindle Motors: Their future in hard disk drives
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
Hard drive companies never guarantee or warranty the data on your hard drive - ONLY the physical drive itself!
Even if you send the hard drive back to the company, and the hard drive is under warranty, you always get a blank drive in return.
Your data means nothing and the hard drive company wont recover or pay for recovery of your data even if they are at fault and the drive fails under warranty.
Your only course of action to save money is to always buy two identical drives and always back one up to the other and keep it off line.