Data Recovery

a guide by

What you Need to Know

02

What NOT to do When you Lose Data from a Storage Device

[!] Neverrunaprogramthatwritesto,oralters,astoragedeviceinanyway.

[!] Donotpowerupadevicewithobviousphysicaldamage(e.g.aharddrivethatismak-ingaclickingnoise).Persistentread/writeattemptsonadrivewithdefectiveheadswilljustincurfurtherdamageandpotentiallymakethedatarecoveryprocesstwiceascomplex.

[!] Donotactivatethewrite-protectswitchonanymemorycardsorUSBsticks.[!] Beawarethatthereisnosoftwareintheworldthatcanfixastoragedevicewithphysicaldefects.

[!] DonotruntheCheckDisk, Disk Utilityoranythird-party“diskrepair”utilities.Theyaredesignedtocorrectsmallerrorsinthefilesystem,notmoreseriouslogicalerrors.Iftherearephysicalproblemswithyourdrive,theseutilitiescanexacerbatethem.

What to do When you Suspect you Have Lost Data from a Storage Device

[!] Keepcalm–someusersgetdistressedandpanickedaboutdataloss.Insteadoftrying“quickfix”solutions,stepbackfromthesituationandmaximisetheprobabilityofasuccess-fuldatarecovery,withoutfurtherjeopardisingyourdata.Evaluateyouroptionscarefully.

[!] Diagnosecorrectly–youcanwastehourstryingtofixaharddriveproblemthatdoesnotexist,soitisvitaltodiagnosetherootcauseofthedatalossproblemcorrectly.

[!] Handleharddrivescorrectlyafteradata loss situation.Someuserspanicanddonotproperlyobserveproperharddrivehandlingprocedures.Thiscanbeamistake.Forexample,ifadrivehasmechanical issues,donotcompoundtheproblemfurtherbynotobservingproperanti-ESDprecautionsasthiswillcauseelectronicissuesonthedriveaswell.

[!] Avoidsolutionoverkill–donotbetemptedtodeploydrasticsolutions.TryingtofactoryresetaRAIDarrayonaNASdeviceinthehopethatitwillfixabrokenRAIDwillreduceyourchancesofasuccessfuldatarecovery.

[!] Sometimesthebestandsafestsolutionistotakethestoragedevicetoaprofessionaldatarecoverycompany.Experiencedrecoverytechnicianswhodealday-inandday-outwithdatalosswillhavetheexpertise,equipmentandinsighttosuccessfullyrecoverallofyourdata.

03

Myths about Data Recovery

If I remove the PCB from a failed drive and replace it with an identical one, will that fix any electronic problems with the drive?

Thisprobablywouldhaveworked10-15yearsago.Forexample,PCBswapsusedtoworkbrilliantlywithQuantumharddrives.However,timeshavemovedonintheworldofdatare-coveryand20GigabyteQuantumdrivesarenotverycommonanymore.Withmodernhigh-capacitydrives,PCBswapsgenerallydonotwork.Everyharddrive isnow“hyper-tuned”tooptimiseperformance.Thismeanseachtimeaharddrive ispoweredup,anorchestraofheads,platters,electronicsandfirmwareparametersallworktogetherinunison.Whenan “alien”PCB is introduced into theequation–whichusesa slightlydifferentvariantofPRMLreadchanneltotheoneinthefaileddrive–thedrivewillnotreadorwillnotinitialiseproperly.

To fix the heads in my hard drive, all I need to do to get the drive working again is to open up the drive quickly and reposition them on the platters, right?

Drivescannotbesafelyopenedupwithoutaclean-room.Ifyouwanttotestthis,getacleanmirrorandplaceitinastandardroomforacoupleofhours.Youwillprobablynotice,evenafteranhour,tinyparticlesofdusthavefallenonitssurface.Thesamecontaminationhap-penstotheplattersofaharddrive.Thesetinyparticlesofdustcanseverelyinterrupttheheads reading from theplatters. Remember that theaverage “flyingheight”of thedriveheadsagainsttheplatterisonly3nanometres.(Aparticleofdustistheequivalentofputtingarockonatrainline,exceptonamicroscopicscale).Donottrytorepositionthedriveheadsmanuallyas, fromourexperience, it cancause irreversibleplatterdamage.Recently,oneDublinuserbroughtusadrivethathetriedtorecoverhimself.Weopenedthedrivetofindfingerprints,dustandscratchesontheplatters.ItlookedasifEdwardScissorhandshadbeenpokingaroundinthere!Toproperlyrepairorreplaceaharddrive’sheads,aclean-room,aspecialdevicecalleda“headcomb”andyearsofexperienceareneeded.

Even if a hard drive has severely damaged heads, there must be a universal platter reader invented by someone, right?

Manycomputerusersassumetheremustbeamachineouttherethatcanrecoverdatafromallfailedharddrives.Theyimagineamagicalmachinewhereyoudropplattersfromafaileddriveintoit,andacoupleofhourslaterallthedatastartsflowingout.Generaluserswouldnotbealoneinimaginingsuchadevice.Intheearly2000s,theUSDepartmentofDefenseevenputoutatenderforadevicethatcouldreadplattersdrive-independently.Well,ifthereisauniversalplatterreaderinexistence,thegeneralpublicanddatarecoveryprofessionalshaveyettobetoldaboutit!Manycompaniesofproprietarytoolshaveclaimedtheyhavedeveloped awayof recoveringdata fromplattersdrive-independently for one-off cases.However,noneofthemhaveprovedtobecommerciallyviable.

04

When Backup Files are Useless

We have come across several data recovery cases where the user “thought” they had an up-to-date and complete backup.

But,whendata lossdoesoccur, theyexperience thepainfuldiscovery that thebackup iseithernot fullyup-to-date,notcompleteor corrupt.Abackup that is, forexample, threemonthsout-of-datecanbeuseless,asisabackupfilethatisnotcompleteorcorrupt.

TheITindustrycouldlearnalotfromtheairlineindustry,whichrigorouslyrehearsesandsim-ulatesemergencysituationseverycoupleofmonths.Emergencyequipment is rigorouslytestedsothatwhenarealemergencydoesoccur,crewsareusuallywell-versedinexecutingtheproperproceduresinacalmandefficientmanner.

Everysooften,youoryourusersshouldtestpreparednessfordataloss.Forexample,whenwasthelasttimeyoudownloadedfilesfromyourCloudbackup?Wasallyourdataintactafterdownloadingit?Arethebackupfoldersonyourexternaldriveallup-to-dateandcom-plete?IfyouworkinITsupport,encourageyouruserstotesttheirbackupfilesonaregularbasis.Agoodbackupisonlygoodifitiscomplete,hasfullintegrity(i.e.nocorruption)andisup-to-date.

05

Why New Drives have a High Risk of Failure

Even though most harddrives undergoquality con-troltestingbeforetheyleavethe factory, there are somelatent failures that do notmanifest themselves duringmanufacturer testing.Theselatent failures can happenduetosmalldefectsthatoc-cur duringthemanufactur-ingprocess.

Asyouwillseefromthegraphabove,harddrivesfailureratesfollowthe“bath-tubcurve”.Thismeansthatharddriveshavehigher-than-averagefailureratesduringthefirst12monthsoftheirlifecycle.Afterthisperiod,thefailureratesplateau.Then,afterabout6-7yearsofuse,theprobabilityoffailurerisessteeplyagain.

So,nomatterhow“new”adriveis,complacencyshouldneversetin.Statistically,anewharddrive(i.e.adrivethatislessthan12-months-old)ismorelikelytofailthana3-year-oldone.Justbecauseaharddriveorcomputerisnewdoesnotmeanthatyoucansitonyourdatabackuplaurels.

Toillustratethefauxsenseofdatasecuritywhichnewhardwarecaninstil inusers,here’sacommonscenariothatweseealot:

1) Ausergetsanewcomputer.2) Theydonotconfigureanybackuptothenewcomputer.(How could such a powerful and shiny computer lose any data?)3) Theuserbeginsusingnewsystemforacoupleofmonths.4) Thedrivefailsduetoalatentfailure(ordataislostduetodatacorruption)5) Theuserhasnobackup.6) They,ortheirITsupport,providertriestorecoverthedata.7) Ifunsuccessfulandthedataissufficientlyimportant,theybringthefaileddrivetoadata recoverycompany.

Theymighthavehadadisciplinedbackup regimewith theiroldcomputer,butwith theacquisitionofanewcomputer,complacencysetsin.Asaresult,scheduledbackupsgobythewayside.Nomatterhow“new”acomputersystemorstoragedeviceis,itisstillpronetodataloss.

06

Critical Success Factors for a Head Disk Assembly Swap

Replacing the headdisk assembly issometimes necessarywhenthereisdamageto the drive heads.Thisisanintricatetaskand time-consumingtaskwhichDrive Res-cue has performedsuccessfullyhundredsoftimes.

From our experience, a successful Head Disk Assembly swap has the followingcharacteristics:

Whenchoosingadonordrive,itmustbeanexact match for the failed drive.Itmusthavethesamemodelnumber,sameserialnumberandsamerevisionnumber.A“closematch”willnotwork,itmustbeanexactmatch.

Thehead’sflying heightmustbetheexactsamedistanceasusedbytheoldHeadDiskAs-sembly.Anincorrectflyingheightwillresultinaweakorsaturatedsignal.

Thehead stack must be aligned perfectlyinthesamepositionastheoriginalheads.Ifalignmentisoff-kilter,therewillbeexcessivehead-to-platter“eccentricity”thatcannotbetrackedoutbythedrive’sservo.

Thespacing of the headsmustbethesameasthatusedontheoriginalHDA.Ifthespacingisnotcorrect,thediskpackwillnotsuccessfullyreload.

Thecentres of the platters should line up perfectlywitheachother.Iftheyarenotinperfectalignment,theservowillnotbeabletotrackouttheirregularity.

Whenreplacingtheplattersandspacers, it is importantthatthedatarecoverytechniciantorques the retraining screws correctly. Ifnotenoughpressureisapplied,theplatterscanwarp.Thedriveheadscantoleratesmalldegreesofwarpastheyfly,buttoomuchandaccuratesyncingbetweentheheadsandplattersisverydifficult.

07

Drive Heads

Things to remember when buying and using an NAS drive

RAID 0 offers no level of data redundancy.Itincreasesdatathroughputrates,butnore-dundancy.Ifonediskfails,theRAIDarraygetsbroken.Thatdiskwillhave tobe repaired inordertofacilitatedatarecovery.

IfyouareusingaNASasafileserver,thenit is not a backup device.NASdevicesalsofail.Forthisreason,youwilloftenseeaUSBportor and E-SATA port on an NAS device. Thisenablestheusertobackuptheirfilesontoan-otherdrive.

ChooseaNASdevicethatusesactive cooling(i.e.itusesafan)insteadofpassive cooling.Thermalstresskillsharddrives.Itcausesdamagetotheelectronicsonboard,causesfailureofmechanicalcomponentsandcaninduceaphenomenonknownasthesuper-paramagneticeffecttocorruptyourdata.FromourNASdatarecoveryexperience,NASdrivesthatonlyuseactivecoolingaremuchlikelytobedamagedbythermalstress.

TrytochooseaNAS device that allows backup directly to the Cloud.Forexample,manyNASdevicesnowallowdirectbackuptoaDropboxaccount.Thismitigatesagainsttherisksoffire,flood,theftandemployeesabotage.

Try toavoidpluggingyourNASdevice intoyourmainspowersupply. If there isapowersurge,youriskturningyourNASintoanexpensivedoorstop.Instead, plug it into an Un-interruptible Power Supply.

ThesedaysmanyusershaveadesktopPCintheirofficethatisnotbeingused.ByinstallinghighcapacitydrivesintosuchaPC,youcanturnitintoacost-effective NAS solution.

08

Failed RAID or NAS – Data Recovery Process and Best Practice Tips

TheRAIDdatarecoveryprocessnormallyinvolvesthefollowingsteps:

1) DiagnosisorconfirmationofRAIDfailure

2) Carefulnumberingofalldrives

3) Imagingofalldrivesinthearray

4) DeterminationofRAIDtype

5) Determinationofmemberdisks

6) Findingoutthecorrectdiskorder

7) FindingouttheBlockSize

8) Findingoutthestartoffsetpointsoneachofthedisks

9) StartofRAIDrebuildprocess

10) Verificationofdataintegrity

11) Extractionofthedata

09

10

Raid Data Recovery – Good To Know

> IfyoususpectoneofthedisksinyourRAIDarrayhasfailed,donotcontinuetousethatsystem.Normally,youwillgetawarningerrorfromyourSCSIBIOS/BIOSoramessagefromyourNASdevice.

> DonotrunCHKDSKorFSCKrepaircommandsunlessyouhaveimagedyourdrivesfirst.

> RAIDdatarecoveryprogramsneed“tospeak”tothedrivesdirectlywithoutanyRAIDcontrollers.Therefore,eachdrivemustberemovedandmounteddirectlytotherecoverysystem.

> MostRAIDdatarecoveryprogramscannotworkwithproprietaryformats.ThepartitionmustbeNTFSorEXT2/3.Forexample,theycannotworkwithRAIDconfigurations,suchasBeyondRAIDasusedonDrobodevices.ForthepurposesofRAIDdatarecovery,thesecon-figurationshavetobemanuallyconfigured.

> BeforeyoustartremovingdisksfromafailedRAIDarray,makesurethatyouexaminetheRAIDcontrollerlogtoseewhatorderthedrive(s)failedin.Themoreinformationyouarearmedwiththebetter.> WhenyouareremovingdisksfromaserverorNASdevice,remembertonumberallthedrivescarefully,bearinginmindthatthefirstdrivewillalwaysbelabelled“0”not“1”.Neverattempttochangetheorderofthedisks.

> DonotuseUSBenclosuresforRAIDrebuilds,whichcantakehours.WhenyouusedrivesattachedviaUSBitcantakedays(evenwhenyouuseUSB3.0enclosures).> BeforeyouattempttheRAIDrebuildprocessmakesurethatyouimageallyourdrives.Itisadvisablethatyourundiagnosticsonalldrivesbeforeimagingasfailingdrivesmightnotsurvivetheimagingprocess.

> IfyouneedtofindouttheparametersofyourbrokenRAIDarrayyoucanusethefreeReclaiMetoolavailableatwww.freeraidcovery.com

11

Useful Tools to Prevent Data Loss

Your ultimate toolagainstdata loss isbyhaving a scheduledbackup to several dif-ferent backup me-diums. In turn, thisbackup is verifiedfrequently to makesure that the backupapplication(s) are per-forming the backuptaskscomprehensivelyand maintaining dataintegrity.

However,havingautilitythatpre-warnsyouaboutharddriveproblemswouldbenice. ItsavesITsupporttechniciansandend-usersthetimeandhassleinvolvedindoingacompleterestorationfrombackups.ItisthefunctionofSMARTtohelpgiveusersawarningofimmi-nentfailure.SMARTusuallyworksbycountingread-errors,writefaults,reallocatedsectorsandtemperatureovertime.

The Problem with SMART

Everytimeawarningistriggered,thedrivecanbereturnedforanRMA(returnmerchandiseauthorisation),providing it is stillunderwarranty.Asa result,manufacturershavesetex-tremelyhighthresholdsintheirSMARTfault-detectingalgorithms.IndependentstatisticalanalysisoffaileddriveshasestimatedthatSMARThasapaltryfailuredetectionrateofonly3-10%.Thankfully,third-partyapplicationscanhelpincreasethesedetectionratesbyupto50%withoutanunacceptableleveloffalsealarms.Thereisaplethoraofthesetoolsonthemarket.Notallofthemareworthyofmention.However,Hard Disk Sentinelstandsoutforitsreliabilityandaccuracy.WheninstalledonaWindowsPC,itcangivesufficientwarningthataharddriveisabouttofail.

12

Get your users or customers to remember the LOCKSS Principle

Stanford University in the United Stateshasoneof the leading researchandde-velopment laboratories in the world forInformationTechnology.

Oneoftheirstudiesinvestigatedthebestandmostreliablewaytoarchiveinformationandkeepitsafe.Thebasictenetoftheirresearchfindingsisthis:makelotsofcopiesofyourdataanddistributethemindifferentplaces.Tomakethisprincipleeasytoremember,theycameupwith a simplemnemonic: “LotsofCopiesKeepStuffSafe”or LOCKSS.Users cannowachieve remotebackupmoreeasilywith someexcellentonline storage facilities, suchastheAmazon S3 Cloud.Alternatively,youcouldsimplystoreyourdataontwoseparateharddrivesthatareplacedindifferentlocationsandverifiedonaregularbasis.

13

The Gallery Rescue Lab

RemovalofDriveSpindle

AdiskplatterandHeadDisk

Assemblyinperfectalignment

14

The Gallery Rescue Lab

DriveRescueimagingstation

Examinationof2,5inchPCB

15

Keep Informed and Stay in Touch with Drive Rescue

Have any data recovery questions or issues? Pleasefeelfreetocontactus

Email:info@datarecoverydublin.iePhone:1890571571

Forinformationonourcompleterangeofdatarecoveryservicesvisit:www.datarecoverydublin.ie

Keepupdatedandinformedaboutdatarecovery-visitourblogat:www.datarecoveryireland.ie

©Drive Rescue Data Recovery9TrinityStreet,Dublin2,Ireland

www.datarecoverydublin.ie