Data Recovery, recovering Hard Drive data, RAID data recovery

Need Our After-Hours Emergency Service?

Choosing a Data Recovery Service Before You Need Them

Posted on

Today’s blog features a guest post from Larry Shulman, our Business Development Manager and a veteran of the Canadian computer industry.

IT managers have a tough job today. Most are dealing with demand for expanding data storage capacity, keeping a complex computing infrastructure running with less dollars and planning for disaster recovery and business continuity. Memofix, drawing on our experience as an extension of our customer’s IT department, has some suggestions on what to look for when choosing service partners for specific challenges.

Too often our clients come to us in the midst of an emergency. They may have a hardware failure and require an immediate turnaround on a repair or replacement unit. Perhaps a hard drive or RAID system has crashed and the data is critical to their operation. At that point in the crisis customers may not have the luxury of worrying about the security of the data contained on those devices or about how to solve a complex technical issue. Memofix is known for their responsiveness in these situations but we can’t help think that a small amount of research would also give our customers added confidence that they are not put at undue risk.

When it comes to data recovery we think our customers, both IT managers and technology resellers, need to look deeper at the service partner they are considering. A prospective data recovery partner will have access to sensitive data that only they can access. Therefore don’t just rely on technical ability to recovery data in a timely manner. You need to partner with someone who takes privacy and data security as seriously as you do. Therefore we think you should do the following:

  • If you’re looking for data services of any kind, do a back ground check. If you are sending storage devices or media to a supplier, for repair or data recovery services, can you trust them to ensure proper security measures are taken? Memofix recommends that you ask for references and check them out thoroughly. We regularly sign NDAs (non-disclosure agreements) for our customers and our technicians that work on any data device are subject to an extensive background check before they are hired.
  • Tour the supplier’s facilities and talk to their management and employees. You want to make sure that your potential partner has an efficient operation and that their staff is motivated to solve problems on behalf of the customer. Memofix has an open door policy for potential new clients or existing customers and we’re more than happy to let you visit.
  • Ask for a demonstration of the services you are looking for. For data recovery it’s easy to demonstrate how to solve simple problems but the supplier should be able to walk you through the process of rebuilding a drive or extracting data from a failed RAID. Memofix can address any specific types of devices that you need to support and we’ll even provide some advice on how to avoid having to call us.
  • Make sure that a prospective partner has invested in areas that support your requirements. Memofix has made a significant investment in our data recovery lab, in our technicians and in stocking over 20,000 hard drives for spare parts.

Memofix has every confidence that we will meet or exceed the scrutiny that we recommend. We provide depot work for some of the largest storage OEMs in the industry which means we’ve passed stringent audits and assessments. Make sure that you put any prospective data recovery partner through a similar process before handing over any storage device or media. Or simply contact Memofix and come by for a visit.

Data Recovery & Encryption, foe or friend ?

Posted on

Toronto, Ontario, Canada.

To most of us, the word “encryption” conjures up images of spies and secret disks containing information that must be guarded at all costs. Few of us realize that we all rely on and use encryption almost every day in our normal lives. Whether making a cell call, sending an email, buying something with your debit card, or accessing the web wirelessly, we are using and being protected by this not so simple process.

What is encryption? Encryption is the process used to transform and disguise data so that it is unreadable or undecipherable to anyone without a pre-determined secret code or password. Basically, the data to be encrypted is sent through an elaborate algorithm using the secret code or password to scramble the data into indistinguishable rubbish.

Please note, that password protection is NOT encryption. Password protection “may” prevent access to the data, but it does not alter the actual data. Password protection can be easily bypassed.

Encryption has also become common place for protecting data on computer based storage device like hard drives and USB flash sticks. Encryption can be used to protect an entire volume, a folder or even a single file. There are several distinct implementations available:

  • SOFTWARE, Users can buy or use free encryption programs that make it possible to encrypt files, folders or even their entire hard drive or flash device using software routines to intercept and modify the data on the fly. The entire encrypting and decrypting process is handled by your computer’s CPU or processor. Popular examples include SafeGuard, SecureDoc, PGP, TrueCrypt and Safeboot. Starting with XP Professional, Microsoft includes a built in folder and file encryption feature called Encrypting File System or EFS for short. Software encryption methods are popular as they are inexpensive and can be implemented on any existing storage device. However, they are generally much slower, typically 20% slower than hardware based methods.
  • HARDWARE, There are external hard drive devices that use a standard hard drive connected through a “hardware based” encryption interface board. In many cases this encryption process is performed without the user even being aware. Many Western Digital external boxes use this method allowing 100% data protection if the drive is ever removed from the enclosure and its encrypting interface board. Hardware techniques are considerably faster than software methods.
  • SELF ENCRYPTING, Users can now buy hard drives and SSDs that utilize on-board hardware to encrypt and decrypt the data on the fly. These devices encrypt the entire contents of a storage device and are referred to as SEDs or self-encrypting devices or drives. These drives carry a premium price tag but are the ultimate in safety and speed. Some hard drive manufactures such as Seagate may also refer to this self-encrypting as FDE or Fixed Disk Encryption.

Why use encryption? Most of us have heard a story or two about personal financial data falling into the wrong hands due to a corporate laptop being stolen or lost. Or the often recreated news story about reporters picking computers out of the trash and finding “valuable” info left abandoned. Yes it does happen, as someone who regularly buys previously used hard drives can attest. But just how many of us actually have super sensitive data on our computers in the first place? If you are one of the few that must keep your data from prying eyes, then by all means encrypt away. But if you don’t need to … DON’T!

Besides the potential loss in performance, there are several other reasons not to use encryption.

  • LOSS OF PASSWORD OR KEYFILE: If you can’t remember the password or can’t find the keyfile you made 3 years ago, you will NOT get your data back, period. While there are numerous recovery techniques for decrypting or accessing encrypted volumes, they all require some form of a username/password combo or a special key file created by the encryption software.
  • OPERATING SYSTEM FAILURE: If an encrypted drive’s operating system becomes corrupted, perhaps due to a simple virus and the drive is no longer bootable or accessible, there is no easy way to repair the file system and regain access. To resolve the issue you must first decrypt the entire volume. Again you will need a user/password or keyfile (and specialized programs) to perform such an operation. Once the volume is decrypted, the file system damage can then be repaired using the file system’s own repair utilities, i.e. chkdsk.exe
  • READ ERRORS: Over time storage device can easily develop read errors and if these read errors affect the operating system files or an area used to store pertinent encryption parameters, it can become impossible to access your data. As above, complicated procedures will be required to decrypt the volume and access the data. A single read error can stop everything.

Is encryption breakable? Theoretically, with enough computing power and enough time, any encryption scheme can be broken. But if the process takes a thousand years, the value of the data may be very limited. And fortunately the increase in computing power to break the key is easily outstripped by the exponential increase in difficulty by adding an additional bit to the encryption key. Presently, most credit card companies recommend transactions using 128 bit encryption keys. 128 bits keys are considered by the experts to be safe until about 2030 although some recommend 256 bit keys due to the advent of the “quantum computer” where theoretically the difficulty may be halved.

There are 2 basic ways of breaking encryption. The hacker either breaks the password by guessing the password or the hacker uses crypto analysis to guess the message based on the natural frequency and composition of the characters in a given language. To guess a password is often very easy as people tend to use real words and they are often chosen from an individual’s personal life or interests. Even brute force using a pre-created word list is often successful. To be sure your password can’t be compromised in your lifetime it has been recommended that your password should be at least 20 random characters. Of course few of us can remember such a long sequence.

In the real world, getting around the encryption is often much easier than either of these methods. Keyboard recorders are simple to install devices that can be used to record all the keystrokes of a user including their passwords. Or perhaps a hidden camera could provide the same results. Another technique can be utilized if a user leaves their computer unattended, as the contents of RAM memory are not encrypted and there are ways to dump the RAM contents and retrieve a password. Additionally, a group of researchers/hackers recently discovered that the contents of RAM memory do not disappear as soon as the power is removed. In fact if the RAM chips can be kept cool, the data may be retained for 10 minutes or longer. Theoretically reading the RAM contents could be possible even if the power is turned off. But this isn’t really so much about breaking the password as it is about stealing the password.

Can Memofix recover your encrypted data? Usually YES, but we need your keyfile or username/password combo … PERIOD. If we could recover your encrypted data without these credentials then what would be the point of using encryption in the first place.

We regularly recover data encrypted with PPG, Safeboot, SafeGuard, SecureDoc, EFS and most other software encryption programs. We are also very successful recovering hardware encrypted hard drives where the encryption is performed by an interface board separate from the storage device. i.e. the popular Western Digital My Book.

However, SEDs or Self Encrypting Devices present a real problem. It is estimated that by 2017 over 80% of all hard drives and all SSD or Solid State Drives will be SED or self-encrypting devices. There are NO decryption methods available for these SEDs and if consumers and businesses are to adopt these new SEDs, this concern must be addressed by the manufacturers.

Encryption is here to stay whether you need it or not. If you do choose to encrypt your data, we suggest you always create a key file and store it in a secure location. Additionally, record all usernames and passwords in a secure location and until the SED manufactures create a solution for authorized decrypting, we suggest you steer clear of their products or be sure to regularly backup.

As always, when things don’t quite go as planned remember your friends at Memofix https://www.memofixdatarecovery.com/ are always willing to help!

Got Your Data Back, Now What? … Re-Integrating Your Data

Posted on

Toronto, Ontario, Canada. If you’ve had the misfortune to experience a data loss situation, whether because you accidentally dropped your laptop, your brother-in- law insisted on reformatting your hard drive or perhaps a passing lightning storm drove a voltage spike through the heart of your system, then you know getting your data recovered is just the first step in getting your computer back in order.

In recovery cases where the original hard drive was found to be defective, it will need to be replaced with a new drive. In cases where the only problem was a LOGICAL issue, you may be able to re-use the original hard drive, BUT we do not recommend this as some logical problems may be the result of intermittent problems with your hard drive. Regardless of your situation, once a reliable storage device has been physically installed in your computer, you need to install & configure the operating system and install all the various programs or applications you may use. In most cases you will require the original licensed installation diskette(s), CD/DVD(s) or USB flash stick.

Once you have your system setup and bootable, the storage device with the recovered data (typically a USB external hard drive) can be attached to the new system. Identifying where to locate and copy the recovered data to is determined by the operating system and what your original username was.

For example, in Windows XP there is a folder in the root directory or top level folder called “Documents and Settings”. Within the “Documents and Settings” folder you will see a folder named for each user set up to use the system. There will be folders with names like “Administrator” and “All Users”. Among these folders you should also see a folder with the same name as your previous login name. So if you previously logged in as JoeUser you should see a folder called “JoeUser”. This is the default location for storing all your personal data. Some advanced users may have chosen a non-default location for some of their data files but such users should not require this article to reintegrate their data. Once inside your personal “JoeUser” folder, you will see some standard data folders with names such as “Desktop”, “MyDocuments”, MyPictures”, and “MyFavorites” . If you were to open the “Desktop” folder you should see all the items that were previously on your desktop. To copy this folder to your new system so your desktop looks just like it was before, simply drag and drop the “Documents and Settings/JoeUser/ Desktop” folder into the “Documents and Settings/JoeUser” folder on the new system. The new system will prompt you for permission to overwrite the “Desktop” folder and once approved your data will be copied. Repeat this procedure for each additional folder you may wish to copy. By default much of your data will be stored in the “MyDocuments” folder.

If you use Outlook for your email under Windows XP, you can find your .pst data files in the default \Documents and Settings\%username%\Local Settings\Application Data\Microsoft\Outlook\ folder. In Vista or Windows 7 the default is \Users\%username%\AppData\Local\Microsoft\Outlook\.

The default location for storing your data in Windows Vista or Windows 2007 is very similar except the “Documents & Settings” folder has been renamed to “Users”. So if your login name was JoeUser, your data would be located in the “Users/JoeUser” folder. It’s interesting that this also happens to be the location of your data files on a Apple or MAC system. Apple also uses a top level folder called Users which contains a folder named for each user and within each user folder you will find that user’s data. Drag and drop the data folders into the same locations on your MAC drive and you’re done.

… David Foster