A Walk Through the Hard Drive Recovery Process

Fields writes "It's well known that failed hard drives can be recovered, but few people actually use a recovery service because they're expensive and not always successful. Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing. Geek.com has an article walking through a drive recovery handled by DriveSavers. The recovery team did not give away many secrets, but they did reveal a number of insights into the process. From the article, "'[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage. Seagate considered it dead, but I didn't give up. It's actually pretty amazing that they were able to recover nearly all of the data. Of course, they had to do some rebuilding, but that's what you expect when you send it to the ER for hard drives.'" Be sure to visit the Museum of Disk-asters, too.

Comments

That's not an article, it's a long ad :(

[Fluffeh]

Having read the article, I can't help but think that it doesn't really read like an article of "Oh, this happened, and then this happened" especially considering that it is about hard driver recovery.

Short of "sending in a zip lock satchel" and "using methodology" what exactly did this article cover in regards to recovering hard drive information? Not a lot. Sorry to be a bit of a drag here, but considering that the company was mentioned more than once, with links and so forth, it just made the whole thing read like a glorified infomercial with the added bonus of being surrounded by advertising. :(

Defcon 14 had a talk about this

[thule]

Video of the talk:

Defcon 14 - Hard Drive Recovery

Basically it talks about making a clean box and how to change out the read heads or the PCB from a drive that is the exact same model. Really cool stuff!

Re:Defcon 14 had a talk about this

[v1]

While we don't swap heads/platters, we have had from time to time needed to swap the onboard controller card. We keep ALL removed hard drives that the customers don't request back, in case we can use the card to recover another drive someone else brings in. The quantums were really nice that way, they had a habit of setting a part on the board ON FIRE and not working anymore. Swap cards, poof, working hard drive. Needed to be the same capacity though and same attachment to the hard drive body.

Last week we recovered 26gb of a customer's data, full recovery, in about 10 sessions of using rsync. We'd let rsync run until the drive "hung up" on us, then cancel it and into the freezer to cool back down for 10 min, repeat.

That chirp he heard is a failure of one of the windings (or the driver IC) on the spindle motor. It's a stepper, and so if a winding goes out, it can't step, and it just resonates at the stepping frequency, and makes a very noticeable "chiiirp". (it's trying to move the head, stepping at an audible frequency, which is why you can hear it) This is followed by a loud click as the drive determines it can't read anything and resets itself, one step of which is to move the read head all the way to the parking track. It does this regardless of where it's at currently because it can't read track information to tell, so it moves it the full distance, and slams into the hard stop and makes the loud noise like a free ball in a pinball machine. Most drives will make 3-6 hard reset attempts before shutting down, but some will go forever.

I've dealt with several dozen Seagate 2.5" HDDs lately, and they just give a loud TAK-TAK-TAK...TAK-TAK-TAK and that's it, you can't hear the chirp. Most of the 3.5" drives do the cyclic chiiirpTAK...chiiirpTAK...chiiirpTAK and then power off. Either way, as far as WE are concerned, dead drive. We refer customers to drivesavers, and due to cost, very few send it in, but a few do. (maybe 5%) So far they have had success with all the people we have referred.

TotalRecall is another company that does this sort of work, but I don't have any experience with them. One nice thing with drivesavers is if they can't recover ANYTHING from the drive, you don't get billed. (but shipping I think)

The OP's article was mighty light on details. I think I just provided more info than they did... :P

Summary of Article

[WK2]

Recovering hard drives is a 3 step process:

1) Mumbo Jumbo
2) Put drive platter into otherwise identical drive
3) proprietary secret stuff (sound like they used Windows to get the data off and then burn to DVDs.

Now you don't have to read the article.

Re:Any *REAL* information out there?

[postbigbang]

There's tons of information out there. We'll omit details about how your data should have been backed up. The rest of it's pretty simple, and it depends on your filing system, but marginally.

1) find out what's wrong with the drive (logic board or drive motor board)
2) get an identical drive; put the old platter assy into the new drive's guts, or just move the good drive's electronics over
3) use a sector editor to find the FAT, journal, or whatever, or restore the MBR and use your fav OS (Kunbuntu, here)
4) painfully gather files (actually, go out back while they're retrieved for you)
5) collect fat (as in BIG) check with lots of kudos, thank yous, and appreciation
6) repeat

You don't have to backup, as long as you have a fat wallet.

p.s. TFA really does sound like a commercial.

Re:Their secret revealed...

[AgTiger]

I had a primary hard drive fail in a linux file server I have at the house. The backup hadn't been taken in a while (yeah, I got lazy), and I really needed the updated files.

A friend of mine told me this method, so I tried it; it worked. I got more than 30 minutes of operation out of the drive, enough to pull ALL of the files off (30 gigs of data) successfully.

1. Put masking tape over the data and electrical connectors of the drive.
2. Immerse the drive in a ziplock bag of minute-rice, with the data/power connectors sticking up. This can't be regular rice, it MUST be minute rice. This acts as a poor man's silica gel later in the process. Close the zip-lock.
3. Freeze the bag of rice with the hard drive in it in the deep freeze for 24 hours. You want it completely frozen, patience is a virtue.
4. Remove the bag from the freezer, and take it to a pre-prepared computer where the drive is ready to be received and plugged in (longer data cable, longer power cable, etc...) You should have another big data drive in the system ready to receive the data from the frozen drive.
5. Leave the drive immersed in the minute rice except for the data/power connector. Remove the tape. Plug in the data and power cables. Try to re-seal the zip-lock bag as much as possible so you don't have rice grains escaping.
6. Orient the drive so it's laying in as natural of a position as possible with as much frozen rice around it.
7. Fire up the system, and try to access the frozen drive. This is the moment of truth. If you're lucky, it'll identify and respond, and you'll have access to the file system.
8. You now about 20 reliable minutes to copy data. You may get more if you're lucky. Copy copy copy. Note: The drive WILL be slow at first, and will speed up as it starts to warm.

Why the minute rice? It performs two functions: First, it keeps the moisture from condensing on, and in the drive's metal parts. Moisture's the killer when you power up a frozen drive. Second, it provides an additional thermal block of "cool" to help keep the drive at a lower temperature while you perform the copy.

After I got the data, I scrapped the original drive I froze (literally, out came the platters and they sit in my stack of platter-shame.) No sense courting disaster a second time.

I've since used this method 2 more times successfully with other people's hard drives. I suspect the recovery specialists use a similar trick, only they'd be smart to use a sub-zero frozen room with no moisture to do their "cold start and copy" process.

Re:Never had any luck with recovery

[mkiwi]

My father had a failed hard drive many years ago and we sent it to Drivesavers. To say the least, I was not impressed. Not only did they manage only to recover 1/100 of his important powerpoint presentations and research, but they used Norton Utilities to do it. I know this because a few months later I bought Norton Utilities (Mac) and only the types of files recoverable from Norton were present. Also, the icons in the resource fork of each file had the exact same (some non-standard) icons for things like .doc, .pdf, etc. It was against the Norton Utilities EULA to use it for commercial purposes like these guys did. He was using a PowerBook and Mac OS X so maybe they didn't know what to do at the time.

Needless to say, I was disappointed with the experience and in hindsight we should have never spent several thousand dollars to get almost nothing back.

Now I have my dad's computer hooked up to an external hard drive using Time Machine. Unless our house burns down, which would be far more catastrophic than a hard disk failure, I don't anticipate having ever to do that again.

Sorry if this comes off as overly negative, but as this article essentially an advertisement and people need to know customer experiences.

Re:Their secret revealed...

[turing_m]

A better version of the poor man's silica gel is crystalline kitty litter (which is just rebranded silica gel).