Data Recovery, recovering Hard Drive data, RAID data recovery

Need Our After-Hours Emergency Service?

Deleted SSD Files … Gone Forever?

Posted on

It wasn’t long after the introduction of the PC that computer enthusiasts figured out that if you deleted a file on your hard drive, it could generally still be recovered. This was possible because deleting a file only deleted its index entry while the file itself remained intact and undamaged. Armed with this knowledge, many IT professionals rescued deleted files and won the accolades of their panicked customers in the process. But the rules have changed with the modern SSD or Solid State Drive and in most cases, if a file is deleted from an SSD, the file is deleted forever!

data recovery Ontario
To understand why, it helps to understand a little more about SSDs.

Unlike a hard drive which can simply write over existing data, an SSD must 1st erase existing data before it can write new data. The process of erasing a data block is very slow in comparison to writing or reading a data block, and as a result 1st generation SSDs became considerably slower over time. To address this concern, newer SSDs started preemptively erasing recently freed blocks during their idle time. This process is referred to as garbage collection and is found in all current SSDs.

However, initially SSDs did not understand or communicate with operating systems like Windows, consequently when Windows deleted a file and marked the space as free for re-use, the SSD knew nothing about it. As far as the SSD was concerned, this space was written to and was thus in-use. To overcome this build-up of unknown and thus unavailable space, SSD manufacturers introduced a feature called TRIM. TRIM allows the operating system to communicate and inform the SSD of free data blocks as they become available. The SSD will then add these blocks to its list of blocks to be preemptively erased. Unfortunately in the real world, these blocks are erased and prepared for re-use almost immediately. Consequently, a deleted file is now totally unrecoverable within moments of being deleted.

Even if you do a quick format on an SSD, the data will be gone almost instantaneously and forever! Previously with hard drives, it was still possible to recover the original data files even if you formatted your hard drive. See our Recovering Data After a Format blog post for more information on that topic.

There are exceptions where deleted SSD data can still be recovered. This is usually because the SSD, operating system or storage configuration does not support TRIM. Below are some examples where TRIM is not supported and hence, deleted files may still be recoverable:

  • Using an older 1st generation SSD or Solid State Drive
  • Running Windows versions before Vista and MAC OSX versions prior to 10.6.8
  • Using an SSDs inside an external USB or Firewire enclosures, and most NAS boxes.
  • File system has become corrupted and the volume is no longer recognized or accessible.
  • SSD formatted with FAT16 or FAT32
  • PCI Express SSDs generally do not support TRIM
  • Encrypted volumes do not usually support TRIM
  • SSD RAID arrays do not typically support TRIM.

Solid Sate Drives are becoming much more common as the prices comes down and their benefits become apparent, but as always, there are tradeoffs, and understanding the implications is always important. If we can help resolve your data loss situation or if you just want a second opinion, please don’t hesitate to contact us at 1-800-MEMOFIX or [email protected].

 

MacBook Air SSD Failures

Posted on
MAC Air SSD
SSD removed from a MacBook Air

Over the last 5-6 months we’ve received an influx of inaccessible Solid State Drives (SSD) from MacBook Air laptops. Apparently Apple is aware of this problem and they are replacing them under warranty. The laptops effected were sold between June 2012 and June 2013.

Once removed, these SSDs are easily identified by the large “Toshiba” controller chip residing on the left side of the SSD as shown in the picture below. However Apple considers the removal as something not do-able in the field.

As for data recovery from these units, you had better get your wallet out. Typical costs for us to recover your data range from $2000-2500. Costs could be even higher depending on the nature of the data required, and due to the complexity of these recoveries we typically require 3 weeks or even more. We are getting faster but the rebuilding of SSD devices is very labor intensive.

If you have one of these Solid State Drives in your system, we suggest you keep all your important data backed up to at least one additional storage device or hard drive.

 

Hard Drive ECC Errors!

Posted on

Recovering data, whether it’s important engineering data for a Hydro Electric company or the family pictures for a young family, is very rewarding on a personal level. Of course there is the enjoyment of helping someone in need. But the real reward for a good data recovery technician comes from the satisfaction of solving problems others can’t.

However, not all data recovery cases are solvable and that’s hard for my techs and our clients to hear. One of the most frustrating data recovery scenarios involves uncorrectable read errors. We see a lot of these cases.

In this typical scenario we receive a small 2.5” laptop hard drive for data recovery. We evaluate the hard drive and deem it functional enough to start creating a sector by sector image. But as we image off the drive it encounters more and more Error Check & Correction or ECC errors; to the point that there is at least one unreadable sector for every 5000 sectors we read. When a disk drive encounters a read error it will attempt to read the same sector at least 10 times. This slows the imaging process to a crawl and as a result it’s not uncommon for the imaging to take months to complete. Besides the time delay, the image is also riddled with unreadable sectors located randomly across the entire data area and in close proximity to each other, making it difficult to find large contiguous blocks of error free data. This means many larger files may be damaged beyond being use-able and often the majority of the good data will be restricted to smaller sized files. Depending on the size of the files the client needs, this may be acceptable or not.

What is most frustrating is the fact that there is little that can be done. These errors are the result of data not being written properly to the drive in the first place. Bad in equals bad out!

It helps to understand where these errors are triggered. When a hard drive reads a sector of data, it also reads a 50 byte ECC code that resides just after the real data. When the data was 1st written to the sector it ran a sophisticated algorithm on the 512 bytes of sector data and this resulted in a unique ECC code which can only be replicated by reading the exact same data. When a sector is read later, the drive attempts to validate the data by running the same algorithm on the data and comparing it to the previously stored ECC code. If the code doesn’t match, the disk drive produces an error code and prevents the transfer of the data. The hard drive will normally attempt to re-read the data up to 10 times as it tries to match the ECC code and this process slows the drive down considerably.

With our hard drive expertise we are able to disable the retries and other housekeeping chores that slow the drive down. But even with these shortcuts, it is not uncommon for hard drives with this problem to take weeks or even 2-3 months to completely read off every readable sector, especially if the drive is 1TB or larger.

We do have the capability to use special read commands to bypass the ECC error checking but the data is usually garbage or at the very least, it can never be trusted 100%. We will do this for a few key sectors of data if the situation warrants it.

So what cause these ECC errors to proliferate? ECC errors can be the result of many different causes.

If a weak head is having problems writing data, ECC errors can often be created. The head appears to be stable when it writes the data and even passes the ECC check initially. But when it attempts to read the same sector later the ECC check fails and the request is aborted.

lf a hard drive is running under extreme heat conditions, for example if a laptop gets extremely hot while you are working from home by the swimming pool, the hard drive which is a mechanical device made of many sorts of metals will expand. Writing data while the drive is in this state may cause problems later when trying to read the drive in a cooled down state as the positioning will affected ever so slightly. This shouldn’t normally cause problems but extremes of operability are always unpredictable.

BUT the number one reason for the proliferation of ECC errors in our opinion is a bad memory chip whether on the hard drive or more likely inside the desktop or laptop.

If your storage device is riddled in read errors, we can help and are usually successful in recovering the majority of a user’s data. Costs for these types of cases are typically in the $400-700 range depending on the severity of the errors and the capacity of your hard drive. Please give us a call today to discuss your data loss situation.

and the Winner is ….

Posted on

Memofix Data Recovery Services recently ran a data recovery survey on our corporate web site. In appreciation for completing the survey we entered all participants (except my Mom) in a draw for a free 2TB External USB drive.

Yesterday the draw was held and we are pleased to announce the winner is;

Alexandre Lemoine of ALTech Info located in Saint-Hyacinthe, Québec

Congratulations Alexandre!

We would also like to thank all participants for completing the survey. Your input was both valuable and greatly appreciated.

Laptop, Notebook, & Netbook Data Recovery

Posted on

Toronto GTA, Ontario, Canada. Data recovery from laptops, notebooks and netbooks is not that much different then recovering data from desktop systems. The most noticeable difference lies in the size of the storage device or hard disk drive being used by each computer. Most modern desktop computer systems uses a larger 3.5” HDD or hard disc drive while a typical laptop or notebook style computer will use a smaller 2.5” HDD. Additionally many newer notebooks and netbooks are starting to use SSD or Solid State Drives. This discussion will focus solely on hard drives.

While most people assume it’s tougher to recover data from a smaller 2.5” laptop hard drive versus the 3.5” desktop drive, it is actually the opposite in most circumstances. When data is lost due to a physical or mechanical issue with a hard drive, our historical statistics clearly show that 2.5” laptop or notebook hard drive owners have an almost 10% better chance of seeing their data again versus 3.5” desktop drives owners. In my previous life at another recovery company, this same statistic also held true. Hmm … seems strange, especially when I see some data recovery service companies adding a surcharge for dealing with laptop hard drives.

So why are we more successful with 2.5” hard drive recoveries? First 2.5” hard drives sustain less damage when they do crash and second they are more accepting of standard data recovery procedures.

Laptops, notebooks, netbooks AND 2.5” hard drives are designed to take more physical abuse then your typical desktop computer or hard drive. By design and virtue of their tiny mass, 2.5” hard drives can absorb anywhere from 3-5 times as much shock as a typical desktop drive. Portable computers also use shock absorbing mounting brackets to further isolate the hard drive from any external bumps or drops. These damage saving features decrease the severity of damage due to crashes.

Laptop and other portable computer manufactures are also concerned with decreasing the energy consumption and heat dissipation of their products. Fortunately, both of these pursuits provide additional benefits for preserving your data. For example, most laptops save energy by spinning down the hard drive when the laptop is not used for a predetermined period of time. And because hard drives are much more susceptible to damage when they are spinning, this energy saving feature can really save data. 2.5” laptop hard drives take it even a step further and use ramps to lift the heads physically off the disk surface when the drive is spun down while many 3.5” hard drives continue to land the heads on the surface of the disks or platters. Once again an energy saving feature that helps prevent damage to the disk. And there is also some validity in the argument that saving energy creates less heat which in turn causes less drive failures.

Laptop, notebooks and netbook drives are also much more tolerant of data recovery techniques. Head xplants or the process of replacing a bad head assembly with a good head assembly is one of the more commonly used data recovery techniques, but because each hard drive’s head assembly is ever so slightly different and the hard drives electronics were tuned to work specifically with the original head assembly, xplants are often not successful. However this procedure is much more successful when attempted between two 2.5” hard drives versus between two 3.5” hard drives.

Because 2.5” hard drives are principally used in portable devices that by definition will operated while the user is mobile, they are designed to deal with harsher conditions and recover from a larger range of off track data situations then a typical 3.5” hard drive. Consequently they are more accepting of new heads with their slight differences. You can compare it to a racing car and a jeep. The racing care is tuned for high performance and is capable of going very fast and taking corners at incredible speeds as long as the road is smooth. But when the road turns too dirt and mud the racing car gets stuck. On the other hand, the jeep may not go as fast but when the road gets rough, it’ll keep on going.

Media damage, whether disk or platter damage, head crashes, or rings forming on the disk are always a problem. And once again, we find 2.5” hard drives are just more tolerant of damage. As a method of preventing damage in the first place, 2.5” hard drives fly the heads at a greater height above the disks then 3.5” hard drives. This allows a laptop or notebook drive to take more physical abuse or impact without having it’s heads coming into contact with the disk surfaces. This design also allows them to float above damage that would impede the positioning or even damage the heads of a typical 3.5” hard drive and thus giving us a much better chance of recovering data.

So even though your laptop hard disk drive may be smaller then it’s big brother the desktop drive, it’s still the leader in data loss prevention and the better drive to be using should you ever need the services of a professional data recovery company, like Memofix Data Recovery Services. http://www.memofixdatarecovery.com/

… David Foster

Remote Data Recovery

Posted on

Toronto GTA, Ontario, Canada. Recovering data remotely is a service presently being offered by several of the larger data recovery companies. It sounds so convenient, no shipping, no computer disassembly, no risk, just call someone up and they remotely connect to my computer, and “poof” my data is restored. If only it were so simple. In reality it’s much more of a marketing ploy then a realistic recovery option. The complexities and dangers of offering remote service seem to counter the very pillars of data safety.

First you must consider that for a remote data recovery service to be successful the hard drive must be functioning properly; otherwise there is a serious risk of causing further damage. If the drive has physical problems and is beginning to fail, there may only a short window before the damage becomes insurmountable. As every data recovery company will advise, if the data is important, shut it off immediately and do nothing. So unless you’re knowledgeable enough to determine the condition of your hard drive or you don’t mind a 50/50 chance of doing further damage you may want to reconsider a remote data recovery service.

Furthermore, this service requires the user to have some technical computer skills as the original hard drive must be removed and installed in a second web attached computer along with possibly an additional hard drive to copy the recovered data to. Some assistance will also be required to setup and establish the remote link. And while some users may feel comfortable with these tasks, the real concern is with the increased risk of causing further damage whether due to physical handling, static shock, or the unintended running of automatic drive utilities like chkdsk.

It is our policy and that of most other professional data recovery services to create an exact image or mirror of the original drive. The original drive is then put away for safe keeping, while any alterations to the file system structures or running of utilities are completed on a copy of the copy. In a remote data recovery situation, you do not have the luxury of having a backup copy in case things go wrong.

We also see many cases of apparent file structure damage where the storage device or hard drive initially appears to be operating fine but as we attempt to image it we discover read errors or the drive starts failing in some other way. In instances like this there is a strong chance the file structure damage was actually caused by the physical issue. Attempting to recover data from a drive like this will just aggravate the situation and risk further damage to the storage device or filesystem.

In my past life, I worked for one of the larger data recovery companies that considered offering a remote recovery option. At the time we had multiple lab locations across the USA and we were already using remote connections to share the data recovery expertise spread throughout our different labs. Our more senior data recovery engineers essentially used remote access to evaluate and direct a more junior tech in how to proceed with a difficult data recovery. Prior to us offering the service to the general public, we investigated our competitors offering by conducting a secret shopper campaign where we attempted to engage their remote data recovery services. Surprisingly, we were repeatedly met with opposition when we requested a remote recovery. They tried to sell us data recovery software, followed by in-lab service before reluctantly agreeing to only attempt a remote recovery IF we approved a minimum of $1500 for the recovery if successful. And this was without ever looking at the media. It’s readily apparent that the entire concept was being used to get you to call them so they could then attempt to try and talk you into shipping the case to their lab.

Remote data recovery has most of same limitations and capabilities as that of a good data recovery software program. The drive must be functional and it must be connected to a working computer system. In many situations a data recovery program will perform as good as a remote recovery service. In fact, the remote recovery tech is more then likely going to be running utilities as part of the effort to salvage your data. So why pay for someone to hook up remotely and run utilities on your system. You can do that yourself and with less complications and time wasted establishing a safe connection.

There are a few occasions where remote data recovery does makes sense, where due to the isolation of the location there is no other option, but for those cases that can be delivered to a full service data recovery lab you would be very unwise not to take advantage of the hands on experience of a data recovery specialist. https://www.memofixdatarecovery.com/ … David Foster

Got Your Data Back, Now What? … Re-Integrating Your Data

Posted on

Toronto, Ontario, Canada. If you’ve had the misfortune to experience a data loss situation, whether because you accidentally dropped your laptop, your brother-in- law insisted on reformatting your hard drive or perhaps a passing lightning storm drove a voltage spike through the heart of your system, then you know getting your data recovered is just the first step in getting your computer back in order.

In recovery cases where the original hard drive was found to be defective, it will need to be replaced with a new drive. In cases where the only problem was a LOGICAL issue, you may be able to re-use the original hard drive, BUT we do not recommend this as some logical problems may be the result of intermittent problems with your hard drive. Regardless of your situation, once a reliable storage device has been physically installed in your computer, you need to install & configure the operating system and install all the various programs or applications you may use. In most cases you will require the original licensed installation diskette(s), CD/DVD(s) or USB flash stick.

Once you have your system setup and bootable, the storage device with the recovered data (typically a USB external hard drive) can be attached to the new system. Identifying where to locate and copy the recovered data to is determined by the operating system and what your original username was.

For example, in Windows XP there is a folder in the root directory or top level folder called “Documents and Settings”. Within the “Documents and Settings” folder you will see a folder named for each user set up to use the system. There will be folders with names like “Administrator” and “All Users”. Among these folders you should also see a folder with the same name as your previous login name. So if you previously logged in as JoeUser you should see a folder called “JoeUser”. This is the default location for storing all your personal data. Some advanced users may have chosen a non-default location for some of their data files but such users should not require this article to reintegrate their data. Once inside your personal “JoeUser” folder, you will see some standard data folders with names such as “Desktop”, “MyDocuments”, MyPictures”, and “MyFavorites” . If you were to open the “Desktop” folder you should see all the items that were previously on your desktop. To copy this folder to your new system so your desktop looks just like it was before, simply drag and drop the “Documents and Settings/JoeUser/ Desktop” folder into the “Documents and Settings/JoeUser” folder on the new system. The new system will prompt you for permission to overwrite the “Desktop” folder and once approved your data will be copied. Repeat this procedure for each additional folder you may wish to copy. By default much of your data will be stored in the “MyDocuments” folder.

If you use Outlook for your email under Windows XP, you can find your .pst data files in the default \Documents and Settings\%username%\Local Settings\Application Data\Microsoft\Outlook\ folder. In Vista or Windows 7 the default is \Users\%username%\AppData\Local\Microsoft\Outlook\.

The default location for storing your data in Windows Vista or Windows 2007 is very similar except the “Documents & Settings” folder has been renamed to “Users”. So if your login name was JoeUser, your data would be located in the “Users/JoeUser” folder. It’s interesting that this also happens to be the location of your data files on a Apple or MAC system. Apple also uses a top level folder called Users which contains a folder named for each user and within each user folder you will find that user’s data. Drag and drop the data folders into the same locations on your MAC drive and you’re done.

… David Foster