Data Recovery, recovering Hard Drive data, RAID data recovery
Sometimes the data is just not going to be recoverable! Here is an example of a badly crashed hard drive we received for data recovery from a disappointed Toronto client. Less then 5% of the hard disk drives we receive for data recovery purposes are in a similar condition. Typically this degree of damage begins with a lot of noticeable noise (clicking hard drive sounds) and escalates quickly into a total disaster!
North York, Ontario, Canada.
Everyone once in a while we get an interesting case that makes you scratch your head. We recently had a client that had re-formatted her hard drive and re-installed a bunch of programs before realizing that over 5 years of digital photographs were inadvertently forgotten. In a panic she arrived desperate for some advice or assistance in retrieving her photos. We quickly calmed her fears and assured her if there were photographs left intact on her hard drive, we could recover them.
Once in the lab we discovered that her actions had only overwritten a small portion of the drive’s file system and we were able to provide her with 85% of her pictures intact and in their original folders. We also recovered hundreds of orphaned photos which we gathered and put into a separate folder. She was ecstatic and went on her way happy to have her pictures.
A few days passed and we received a call from one very unhappy client. Apparently, we have included photographs which do not belong to her and they are of a very racy nature. She is irate and offended. Of course her husband denies any knowledge of these pictures, nobody else has access to her system, and the people in the pictures are not familiar to her or her husband.
I’m at a loss to explain how this could happen. My only thought is that the target drive we imaged her drive to, was not erased prior to us using it, and we have recovered images from what is left of some former client’s data image. But our target drives are always prepared in advance with a pre-determined pattern written on every sector, and we are extremely meticulous in these processes. We quickly pull out our virgin image of her drive, which we retain for 30 days, and we confirm that the areas of our drive not used by the present image are still filled with our pre-determined pattern. Ok so what the heck?
In order to get to the bottom of this issue we had the client once again send in her original hard drive. Our image was then compared with the original and not one byte was out of synch. It’s pretty clear that the mystery pictures were on her original drive before she ever brought it to us. A conversation ensues with the client as to the history of the computer and the hard drive inside it. She reveals that the original hard drive was filled to capacity several years ago and her son-in-law upgraded her to a larger drive. Uh-huh … I think we’re getting somewhere. Where did the son-in-law purchase the “new” drive? “Oh it wasn’t so new, he purchased it on eBay.” The pieces quickly merge together as we realize that the images have survived several formats and at least 2 years of constant computer use. Who took the pictures originally and who the cute girl is, we may never know, but we do know there is one husband who is very happy not to recognize her.
Toronto GTA, Ontario, Canada. Data recovery from laptops, notebooks and netbooks is not that much different then recovering data from desktop systems. The most noticeable difference lies in the size of the storage device or hard disk drive being used by each computer. Most modern desktop computer systems uses a larger 3.5” HDD or hard disc drive while a typical laptop or notebook style computer will use a smaller 2.5” HDD. Additionally many newer notebooks and netbooks are starting to use SSD or Solid State Drives. This discussion will focus solely on hard drives.
While most people assume it’s tougher to recover data from a smaller 2.5” laptop hard drive versus the 3.5” desktop drive, it is actually the opposite in most circumstances. When data is lost due to a physical or mechanical issue with a hard drive, our historical statistics clearly show that 2.5” laptop or notebook hard drive owners have an almost 10% better chance of seeing their data again versus 3.5” desktop drives owners. In my previous life at another recovery company, this same statistic also held true. Hmm … seems strange, especially when I see some data recovery service companies adding a surcharge for dealing with laptop hard drives.
So why are we more successful with 2.5” hard drive recoveries? First 2.5” hard drives sustain less damage when they do crash and second they are more accepting of standard data recovery procedures.
Laptops, notebooks, netbooks AND 2.5” hard drives are designed to take more physical abuse then your typical desktop computer or hard drive. By design and virtue of their tiny mass, 2.5” hard drives can absorb anywhere from 3-5 times as much shock as a typical desktop drive. Portable computers also use shock absorbing mounting brackets to further isolate the hard drive from any external bumps or drops. These damage saving features decrease the severity of damage due to crashes.
Laptop and other portable computer manufactures are also concerned with decreasing the energy consumption and heat dissipation of their products. Fortunately, both of these pursuits provide additional benefits for preserving your data. For example, most laptops save energy by spinning down the hard drive when the laptop is not used for a predetermined period of time. And because hard drives are much more susceptible to damage when they are spinning, this energy saving feature can really save data. 2.5” laptop hard drives take it even a step further and use ramps to lift the heads physically off the disk surface when the drive is spun down while many 3.5” hard drives continue to land the heads on the surface of the disks or platters. Once again an energy saving feature that helps prevent damage to the disk. And there is also some validity in the argument that saving energy creates less heat which in turn causes less drive failures.
Laptop, notebooks and netbook drives are also much more tolerant of data recovery techniques. Head xplants or the process of replacing a bad head assembly with a good head assembly is one of the more commonly used data recovery techniques, but because each hard drive’s head assembly is ever so slightly different and the hard drives electronics were tuned to work specifically with the original head assembly, xplants are often not successful. However this procedure is much more successful when attempted between two 2.5” hard drives versus between two 3.5” hard drives.
Because 2.5” hard drives are principally used in portable devices that by definition will operated while the user is mobile, they are designed to deal with harsher conditions and recover from a larger range of off track data situations then a typical 3.5” hard drive. Consequently they are more accepting of new heads with their slight differences. You can compare it to a racing car and a jeep. The racing care is tuned for high performance and is capable of going very fast and taking corners at incredible speeds as long as the road is smooth. But when the road turns too dirt and mud the racing car gets stuck. On the other hand, the jeep may not go as fast but when the road gets rough, it’ll keep on going.
Media damage, whether disk or platter damage, head crashes, or rings forming on the disk are always a problem. And once again, we find 2.5” hard drives are just more tolerant of damage. As a method of preventing damage in the first place, 2.5” hard drives fly the heads at a greater height above the disks then 3.5” hard drives. This allows a laptop or notebook drive to take more physical abuse or impact without having it’s heads coming into contact with the disk surfaces. This design also allows them to float above damage that would impede the positioning or even damage the heads of a typical 3.5” hard drive and thus giving us a much better chance of recovering data.
So even though your laptop hard disk drive may be smaller then it’s big brother the desktop drive, it’s still the leader in data loss prevention and the better drive to be using should you ever need the services of a professional data recovery company, like Memofix Data Recovery Services. http://www.memofixdatarecovery.com/
… David Foster
Toronto GTA, Ontario, Canada. Recovering data remotely is a service presently being offered by several of the larger data recovery companies. It sounds so convenient, no shipping, no computer disassembly, no risk, just call someone up and they remotely connect to my computer, and “poof” my data is restored. If only it were so simple. In reality it’s much more of a marketing ploy then a realistic recovery option. The complexities and dangers of offering remote service seem to counter the very pillars of data safety.
First you must consider that for a remote data recovery service to be successful the hard drive must be functioning properly; otherwise there is a serious risk of causing further damage. If the drive has physical problems and is beginning to fail, there may only a short window before the damage becomes insurmountable. As every data recovery company will advise, if the data is important, shut it off immediately and do nothing. So unless you’re knowledgeable enough to determine the condition of your hard drive or you don’t mind a 50/50 chance of doing further damage you may want to reconsider a remote data recovery service.
Furthermore, this service requires the user to have some technical computer skills as the original hard drive must be removed and installed in a second web attached computer along with possibly an additional hard drive to copy the recovered data to. Some assistance will also be required to setup and establish the remote link. And while some users may feel comfortable with these tasks, the real concern is with the increased risk of causing further damage whether due to physical handling, static shock, or the unintended running of automatic drive utilities like chkdsk.
It is our policy and that of most other professional data recovery services to create an exact image or mirror of the original drive. The original drive is then put away for safe keeping, while any alterations to the file system structures or running of utilities are completed on a copy of the copy. In a remote data recovery situation, you do not have the luxury of having a backup copy in case things go wrong.
We also see many cases of apparent file structure damage where the storage device or hard drive initially appears to be operating fine but as we attempt to image it we discover read errors or the drive starts failing in some other way. In instances like this there is a strong chance the file structure damage was actually caused by the physical issue. Attempting to recover data from a drive like this will just aggravate the situation and risk further damage to the storage device or filesystem.
In my past life, I worked for one of the larger data recovery companies that considered offering a remote recovery option. At the time we had multiple lab locations across the USA and we were already using remote connections to share the data recovery expertise spread throughout our different labs. Our more senior data recovery engineers essentially used remote access to evaluate and direct a more junior tech in how to proceed with a difficult data recovery. Prior to us offering the service to the general public, we investigated our competitors offering by conducting a secret shopper campaign where we attempted to engage their remote data recovery services. Surprisingly, we were repeatedly met with opposition when we requested a remote recovery. They tried to sell us data recovery software, followed by in-lab service before reluctantly agreeing to only attempt a remote recovery IF we approved a minimum of $1500 for the recovery if successful. And this was without ever looking at the media. It’s readily apparent that the entire concept was being used to get you to call them so they could then attempt to try and talk you into shipping the case to their lab.
Remote data recovery has most of same limitations and capabilities as that of a good data recovery software program. The drive must be functional and it must be connected to a working computer system. In many situations a data recovery program will perform as good as a remote recovery service. In fact, the remote recovery tech is more then likely going to be running utilities as part of the effort to salvage your data. So why pay for someone to hook up remotely and run utilities on your system. You can do that yourself and with less complications and time wasted establishing a safe connection.
There are a few occasions where remote data recovery does makes sense, where due to the isolation of the location there is no other option, but for those cases that can be delivered to a full service data recovery lab you would be very unwise not to take advantage of the hands on experience of a data recovery specialist. https://www.memofixdatarecovery.com/ … David Foster
Toronto, Ontario, Canada. Hard drive manufactures provide a warranty on their disk drives that will provide you with a new drive should yours happen to fail within the warranty period. However, none of these warranties can protect or replace your data should it become inaccessible or lost as a result of a failing hard drive or accidental damage. And in fact, the drive manufactures go out of their way to distance themselves as far away as possible from any liability for the data that is stored on their product. So why hasn’t someone offered insurance on the data that resides on your hard drive or other digital storage device. Simply put, it isn’t possible! Data is not always recoverable, no matter how much money one is willing to pay.
A few companies have attempted to sell “data recovery” type insurance but none would ever be so bold as to guarantee your data. Instead the few twisted souls that have ventured into the data recovery insurance game have chosen to repackage a similar type of insurance under the name of a data protection service.
About 5 years ago one of the laptop hard drive manufactures partnered with a data recovery company in offering this type of insurance. In such a plan, you are charged a small premium to cover the cost of “attempting” to recover your data should such a disaster befall you. There are no guarantees they will recover your data, only a promise to give it their best efforts. And if they’re not successful, there are no pay outs or compensation of any sort, other than possibly offering to insure your new replacement drive for free. Personally, I fail to see any incentive for the underlying data recovery company to give it much of an effort or expend any serious resources.
Many of us already have a home owner’s insurance policy that may provide coverage for data recovery services should you lose the PERSONAL data on your home computer. I was surprised to see my policy covers such losses up to $1500. Unfortunately there was a $500 deductible but at least I am covered for a serious recovery attempt at a relatively low recovery cost. You may want to check your policy or ask your insurance agent if you have coverage.
There is one external hard drive manufacture that I don’t have much experience with, but who does offer data recovery insurance on their products as a standard offering. The company is ioSafe http://www.iosafe.com/ and they specialize in manufacturing disaster proof external hard drives. Protecting your data is what their products are all about and guaranteeing them with a warranty to cover up to a $1000 of data recovery services should make you take them seriously.
I also remember working at ActionFront Data Recovery Labs in the early 2000s and we provided the recovery services to support a data recovery warranty for Belkin surge suppressors. Basically if you lost your data as a result of their product failing to protect your hard drive they would pay for the cost of recovering your data. There were no limits as I recall and the plan was based on our best efforts. We didn’t get paid unless we were successful so the client really did get a 1st rate recovery attempt.
While any item can be insured for cash compensation should that item be destroyed or lost, there are some things that just can’t be replaced with cash and perhaps your data is one of them. There are no guarantees that your data can be recovered so do what you can to prevent a data disaster in the first place. Protecting your data isn’t expensive, it’s priceless! … David Foster
