Hard Drive Substitutes or Data Killers?

May 3rd, 2012

Since shortly after the inception of the hard drive into the PC or personal computer, there have been doubters! Even as hard  drives grew larger, faster and more reliable, there have been those who constantly called for its replacement. No other product has improved at a faster pace in every measurable specification than the hard drive, and yet it still gets no respect!  The hard drive is still here and still going strong after more than 50 years. Has the time come for a new champ?

data recovery toronto

Back in 1985, I repaired my first hard drive. It was a 5MB hard drive made by Seagate called the ST506. The ST506 had actually been introduced a few years earlier at a list price of $1400! It was the 1st hard drive mass produced for the emerging personal computer market and its interface quickly became the world’s standard … well at least for a few years. The ST506 hard drive had 156 tracks or concentric rings of data on each disk surface. In comparison todays modern hard drives have over 200,000 tracks, can hold up to 4TB or 4,000,000 MB and often cost less than a $100. For a visual comparison, I dug up an old ST506 out of our inventory and took a picture of it along with a modern 500GB laptop hard drive.

Today we have two contenders trying to put the old disk drive out to pasture: the SSD or Solid State Drive and Web Based Storage. Both are worthy contenders offering advantages a hard drive just can’t compete with. An SSD offers lightning fast access times and the reliability of no moving mechanical parts. Web based storage offers the convenience of having your data available around the world 24/7, 365 days a year and the perceived reliability of virtual storage. But are these storage methods the end and be all?

Contender#1 … SSDs or Solid State Drives with their blazing speed and growing capacities appear to be a fantastic replacement for the hard disk drive, but be aware they are far from being the perfect digital storage device.

SSD data recovery

These early days of Solid State Drives, reminds me a lot of the hard drive industry as it was first developing. In those early days there were over a hundred different manufactures of hard disk drives. Now there are just 3, Seagate, Toshiba, and Western Digital. Similarly, today we find well over a hundred companies manufacturing SSDs. And just like the hundreds of early hard drive manufactures, each one is trying to distinguish it’s technologies as the best and capture the most market share. Some of their ideas will be fantastic and will be quickly adopted as standards. Other not so good ideas, may result in the demise and eventual death of many of these companies.

A quick search on the web uncovers hundreds of complaints regarding the early failure of various models of Solid State Drives. The point is … there will be a weeding out process where the weaker products and companies are culled from the herd. And as a consequence it is still a little too soon to know which SSDs and technologies to trust, and which to avoid.

There is also an ongoing debate over the life expectancy of SSDs and whether they can withstand the same amount of lifetime write cycles as a typical hard drive. And while I don’t believe this is, or will remain a problem to be concerned about, there is another rarely mentioned quirk with SSDs. If you copy data to an SSD and detach it from any computer or power source, the data will eventually disappear!  This is because SSDs use electronic components which are “charged” to represent a digital 1 and over time this charge leaks out and all the bits return to digital zeroes. So if you think you can copy your precious baby pictures to an SSD and put it away for 10 or 20 years, think again!  Actually, just how long the data will be retained is open to argument and something no manufacture appears to mention. I have heard data retention times as low as 1 or 2 years and perhaps as high as 10 years from some authorities. So be careful, or be sure to periodically attach your SSD to a computer or power source so that the data will be refreshed. By the way, I have connected and booted up an old 20MB Seagate ST225 hard drive that has been sitting on a shelf for just under 20 years and all the data was intact and readable.

Contender#2 … Online or web based storage really does promise perfection, or at least so it appears on the surface. But what guarantees do you really have that your data will be there when you need it? Everything is out of your control. And if the web is down or inaccessible, then you basically have no data.data recovery Ontario

To illustrate my concerns, a recent experience of mine may help. Having used Google’s Gmail for almost 10 years with never a problem, I recently persuaded my wife to open her own Gmail account for her own personal emails. Then six months after the switch, her emails suddenly disappeared. Of course it was my fault for persuading her to switch over to Gmail, so I was tasked with getting her emails back … What I found was rather discerning; there is no real process, and definitely no person to help you recover your mailbox data should such a calamity bestow you. Google basically says “Oh well, what do you expect when something is free?”  To which what can one say?  Of course the solution is to use an email agent like Eudora and download your emails to your local machine. But then doesn’t that defeat the purpose of on-line storage?

Not to pick on Google, (they should be prepared to defend their “web only” cheerleading),  but I have another example based on their product, Google Docs. It is touted as a web based replacement for MS Office. It allows a user to create, edit and store MS Office type documents on the web. But after my experience with Gmail, I must wonder what recourse there will be if suddenly all your documents go missing?  I hope this problem of no accountability for the safety of a user’s data is isolated to those offering free storage services. But with Google setting the precedent of giving storage away for free I am afraid other web based program providers will do the same.

 

 

Tags: , , , , , , , , , , , , , ,
Posted in General | 1 Comment »

Top 5 Worst Mistakes A HDD User Can Make!

April 13th, 2012

Or Mistakes I See Every Day That Can Be Easily Avoided
A Diatribe by Rob Armstrong, Memofix Data Recovery Engineer

Every day in Data Recovery labs across the globe, hard drives (HDDs) are received from people who were convinced they knew what to do when their HDDs failed. Unfortunately, most have been horribly misinformed by friends, family, sweaty nightmare, rumor and/or innuendo, or even worse poor Search Engine results written by non-professionals who think they know HDDs inside and out. The truth is, I have been in the Data Recovery industry for close to seven years, and I learn more about hard drives and each manufacturer and model EVERY DAY. It is not a simple or straightforward undertaking, and is unfortunately one of those things in life that is best left up to the professionals…for no other reason than most, if not all, Data Recovery Labs have a free evaluation service. If you attempt to “fix” your HDD at home, you could conceivably damage the drive beyond the point where it can be recovered – even by an accredited lab.
So here is the advice of a Data Recovery Tech who just wants the public to be better informed as to what they should do when the unthinkable happens (and yes, I am aware that if people heed my advice, we will be receiving fewer cases for recovery):

1.  If the HDD is Dropped or Physically Traumatized in Any Way

Whether the device is running or not, once dropped, you should not apply power again. If you are truly concerned with not losing your data – send it in to a data recovery lab right away. Some would advise to apply power just once to see if you can get access – even for a short window of time – to copy off everything on there before it fails for good. Here’s the problem with that thinking: if you dropped the drive and the heads inside the drive physically bent due to the impact, then when you apply power, the heads now come into physical contact with the platters (whereas before the trauma they floated above the surface by several microns) and your data is scraped off at 7200 rotations per minute – becoming unrecoverable.

2.  If You Have Sporadic Access to Your HDD

While working, you see the “hourglass” icon come up…too many times…or it takes waaaay too long to save, or sometimes your HDD boots to Windows OK, sometimes it doesn’t. Your HDD defaults to the “blue screen of death” sometimes – but not every time – you boot. These could be indicators that your drive is failing either physically or logically as bad sectors proliferate (reported as “Read Errors”) or your hardware may be slowly failing. In any case, the next time you have access to your HDD, COPY IT! All of your critical files and folders, profiles, e-mail documents, anything you deem important. You may never get another chance, and I’ve heard of many instances where consumers just kept rebooting until they had access – then did not back up once they have it. And no – putting your HDD into a refrigerator is not going to help.

3.  If a Drive Fails in Your RAID Array

Hard drives can fail at any time without any type of warning (I know – you didn’t want to hear that), and therefore quite often, one drive in a RAID array will fail well before the others. Obviously, the way in which the data is written to a RAID makes it extremely simple to rebuild should one drive fail (with parity, each drive’s contents are re-buildable using the other drives). However, when multiple drives fail simultaneously – send the array into a Data Recovery lab. Once again, you will get a FREE evaluation, which will determine EXACTLY what is wrong with the RAID and what it will take to recover the data. Too many times have we seen RAID arrays where the consumer has replaced too many drives, kept the power on damaged drives too long, or “accidentally” reformatted the whole RAID after rebuilding didn’t work right away. Again, how important is your data?

4.  If You Use One External for Both Mac and PC

Stop it. You just stop that right now. In this day and age, external HDDs are cheap enough to buy one for each of your O/S’s, and moving your HDD from one system to the other and back can cause your HDD to fail. In the end, it comes down to filesystem difference and the incompatibility of the two O/S’s. The way data is stored and written in a Mac environment is VERY different from the way a PC writes, and most systems have a difficult time resolving both O/S’s. You can’t mount a Mac drive in Windows (unless using a third-party program), and vice-versa, so you shouldn’t be using the same HDD with both systems. I’m sure some of you will yell and scream after hearing this advice, and have used one external HDD for both Mac and PC without any problems – but if the possibility exists that you will lose everything, isn’t it worth two externals?

5.  If You Use Your USB Device for Storage

Again, stop it. Years ago, I assisted a Data Recovery company with customer service while also working in their lab, and many an argument was had with consumers over the definition of a “backup”. A backup is a secondary copy of your data. That means it exists not only in two locations or folders, but on two completely separate drives. This is the only way to become completely secure in the knowledge your data is safe from loss. As such, USB devices (aka thumb drives, USB sticks) should be used only for transferring data from one HDD to another immediately. Too many USB devices have been received that were smashed because it ended up forgotten and on the bottom of the purse, or lost and chewed up by the family dog (no, really). Do not store any data on your USB device that is critical for any extended period of time – unless you have a true backup on another HDD.

So there you have it. The early days of Data Recovery were a lot like the introduction of Science into public discourse hundreds of years ago. There were scientific methods we were using along with basic computer know-how to recover data – proven methods – but there was also a “fringe” element to recovery, mixing science and…guesswork. We would adjust the lid on a drive, believing that by doing so, the airflow inside the drive or magnetic field would affect the voice coil to get better results. I even remember sitting at my workstation all day and holding a drive, because I believed that if I let go of the drive it would stop working – some superstitious nonsense about my personal electromagnetic field affecting the HDD. Basically if the method worked for one person, we would all try it – regardless of how little sense it made. That was then.
Now, we as Data Recovery Technicians know exactly how to recover data from any HDD, using proven scientific method – no more guesswork. And that is why you should ignore rumor and poor forum scuttlebutt when it comes to the recovery of your critical data, and just send the drive in for a free evaluation. When the unthinkable happens. Which it shouldn’t, now that I’ve given you 5 ways to avoid it!

Tags: , , , , , , , , , ,
Posted in General | No Comments »

RAID Data Recovery and Physical Damage

February 15th, 2012

One of our best Toronto data recovery partners recently had a RAID data recovery case involving eight hard disk drives configured in a RAID 5 setup. As you may know, RAID 5 allows the failure of any 1 hard drive and can be rebuilt with no data loss. But unfortunately in this RAID data recovery situation, there were two defective hard drives.  Further investigation revealed that one one of the hard drives had actually failed 5 months ago and the stale data residing on it was of no value to the client. This left our data recovery partner with all their hopes pinned on the one remaining defective disc drive which had apparently just failed and was the ultimate reason for their RAID failure.

When they contacted Memofix later that morning, we asked them if there were any loud clicking or other unusual noises coming from the hard disk drive. They said no, but they noted that the hard drive model was not being reported properly by the SCSI BIOS at boot up. The model was displayed properly, BUT the capacity was indicated as 0 bytes!

After conferring with a few of our RAID data recovery techs we advised the client that the problem was most likely a corrupted module in the hard drive’s “system area” and we suggested we could fix it very easily. The “system area” is a storage area on the hard drive reserved by the drive itself for storing unique settings required by the hard drive to function. If a hard drive can’t read some of the modules, it often reports a zero byte size which prevents any access to the stored data.

As we are located in the Toronto area, the partner packaged up the defective hard drive and brought it immediately to Memofix for further analysis. When we first hooked up the drive, there was a very light, almost indecipherable ticking noise. It did not sound serious and in fact our data recovery experts  still believed the problem was related to a corrupted system area. However our attempts to repair the module were unsuccessful as the hard drive could not write back the changes we made. It appeared we had an issue with the hard drive’s head assembly that would need to be fixed first.  So we opened up the hard drive under class 100 conditions in our Toronto data recovery lab to get a better look. And boy did we get a better look … see the picture we took below. :-(  Notice the heavily crashed area where the smooth platter surface has been roughed up severely as well as an additional ring of damaged at the inner hub of the platter.

There will be no data recoverable from this crashed hard drive! It just goes to show you that even the best data recovery specialists can be fooled as it’s not always possible to hear severe damage with your ear.

By the way, even though this 8 drive RAID array had two bad hard drives, Memofix was still able to rebuild the RAID  with the one stripe being bad throughout the RAID. This results in the recovery of 5 good chunks of data , followed by 1 bad chunk of data through out the volume.  The RAID data recovery results may not be exactly stellar but the client was able to regain many smaller document type files.

raid recovery toronto

badly crashed SAS or Serial Attached SCSI hard drive

SAS SCSI Drive involved in a terrible crash

Tags: , , , , , ,
Posted in General | No Comments »

Toronto Data Recovery

January 30th, 2012

As the morning sun peeks through the skyscrapers of downtown Toronto and the warmth of its rays tickle your face, your world seems so safe, so tranquil, so at peace. You press the power on your laptop computer and are mildly surprised when the familiar beeps fail to materialize. Looking at your screen you see nothing but a flashing cursor. So with minimal concern you reset the power, gaze out over a waking Toronto and diligently wait for the familiar beeps before heading for your coffee. But unbeknownst to you, today will be a little different than the last 934 days. Today your computer won’t boot! Today you lost your data! Today you need data recovery!

Panic sets in as your brain begins to assess the gravity of the situation. You remember the 37 page proposal you’ve been working on non-stop for 3 weeks. Usually you would have copies of your data stashed on your desktop at work or even on your computer at home. But again, this time is different, there is no backup! GULP! The most important client you’ve had in years is expecting it tomorrow. If you get the contract, your worries will evaporate for months to come, maybe even years. If you don’t, well things could get really tough around here. .. 

data recovery Toronto

Toronto Data Recovery

Every day in thousands of businesses and homes across the Toronto GTA, across Canada and across the world, a similar scenario is unfolding. Data is being lost!

What would you do? Where would you seek help? Are you located in the Toronto area or close by in the golden horseshoe, perhaps Hamilton, Oakville, Kitchener, Waterloo, or even Markham?

If you’re like our Toronto friend above, Thomas McAllister, you called your IT manager for help. Once the IT manager determined that the hard drive had an operational problem, he recommended Memofix Data Recovery Services, Toronto’s oldest data recovery service provider.

Thomas called us just after 9 am Toronto time and the severity of his situation was not hidden in his voice. It was apparent he needed his data recovered by tomorrow’s sunrise or he would need to start working on his resume. To Thomas the situation was that critical. After discussing his case with him, we were able to assure him we had the parts in stock at our Toronto facility and we’re ready to attempt his data recovery within the hour of it being received.

By 11am we received his Toshiba laptop for hard drive data recovery. A quick analysis determined that one of the 4 heads was no longer functional. Within an hour we had replaced the complete defective head assembly and had the hard drive imaging, albeit with some read errors. Thankfully the disk drive was only 160GB and by 3pm our imaging of the used areas was complete. Although the data recovery had some damaged files as a result of the read errors, the most critical file was in pristine shape and was tested with no errors. Due to the small size of the file we were able to email it to Thomas at his office in downtown Toronto. By 3:30pm, Thomas was breathing a little easier and our mission was complete.

Now, not all our data recovery cases can be completed this fast, but if you’re in the Toronto area, be aware that our data recovery service lab, located in Vaughan, has the most extensive inventory of hard disk drive parts in Canada. While other Toronto data recovery service providers must wait days for parts and likely even charge more, we are often able to complete a data recovery in the same day. If time is not your friend … call on Toronto’s Memofix Data Recovery Services.

Tags: , , , , , , , ,
Posted in General | No Comments »

USB Data Recovery for Flash Drives

January 24th, 2012

Today we will discuss typical data recovery techniques for recovering data from  physically defective USB Flash Drives, also referred to as Thumb Drives, Flash Sticks, USB Sticks, USB Pens, or Memory Sticks.  This Toronto based blog will not discuss the situations in which the USB flash stick is still operational.

The typical USB flash drive is made up of two main components:  the actual memory chip or IC (integrated circuit) and the controller chip or IC.  In the diagram below we can see a typical USB Flash stick taken apart to reveal the two main components. In many instances there will be an additional memory chip on the other side of the PCB or printed circuit board.

Inside a USB Flash Drive

Inside a typical Flash Drive

There are two basic approaches to recovering the data from an inoperative or inaccessible USB flash drive. Which approach we use is decided largely on whether the data on the memory chips is encrypted or not. Unbeknownst to the average Joe,  encryption is often being implemented on USB sticks automatically and invisibly.  We see this use of automatic encryption becoming more and more common. Over the years we have learned to identify many of the flash devices that use encryption but it will always be an ongoing process as the sheer magnitude of new devices being introduced is staggering.

If there is no encryption present, we can physically desolder and remove the individual memory chip(s). These chips can then be  read in a specialized chip reader and their contents dumped to a file(s). Now the work begins as the data read from the chips is a very raw dump of every bit of data from the memory chips. The problem with flash is that there may be many copies of the same or almost the same data present on many data cells across the drive as a result of “Wear Leveling”. Wear leveling is where the Flash’s controller attempts to ensure equal wear of each data cell to ensure the device lasts as long as possible with no unreadable areas. Furthermore the controller has access to additional hidden data cells (10-15% above the advertised capacity) that can be used for relocating the data from questionable cells.  So the big problem is determining which cells are active, which have been remapped and in which order do the active cells belong.  And of course the market is new and there presently exists hundreds of manufactures all doing things just slightly differently. If we haven’t already reverse engineered a particular flash device and it’s storage techniques, we can spend literally days figuring it out. Of course, next time we come across that exact device it will be easy .. but the majority of the cases we see are unique!

Alternatively if we suspect that the controller chip  is bad and we are able to source an exact same controller, we can simply replace the defective controller and gain access to the device. But finding the correct controller is often impossible as USB flash devices become obsolete over night and the innards of two identical flash devices are often quite different.

If encryption is present it does no good to simply read off the memory chips as the data will still be encrypted.  In these cases, we must repair the flash device (replace controller or other discrete components) OR source an exact replacement USB flash drive and then xplant the memory chips onto it.

Regardless of what technique we use, if you require Toronto USB data recovery on a physically defective Flash Drive it can be time consuming and relatively expensive. Be prepared, be secure, and ensure your USB Flash device is always backed up.

Tags: , , , , , , , ,
Posted in General | 1 Comment »

Warning: USB Flash Devices FAIL!

January 19th, 2012

There exists a belief that USB flash drives, also referred to as USB flash sticks, memory sticks, thumb drives, or USB jump drives,  are  robust, reliable and a very secure alternative for storing your data!  But every month we routinely service dozens of data recovery cases involving USB flash devices from the Toronto area, so we can tell you from experience that this belief is just plain WRONG!

recovering data from USB flash sticks

Do you need Data Recovery for a USB Flash drive?

Perhaps it is the knowledge that these USB flash devices use solid state flash memory chips for storing the data and consequently there are no moving parts to become defective. Or maybe people just don’t treat them with the same respect and care they would with a hard disk drive.

I know I often use them for bringing home files I plan to work on over the weekend. And yes I throw them in my pocket, carry them for days, forget about them, take them motorcycling or fishing in the rain for a weekend , and even have the wife wash and dry them, as I forget to remove them from my pocket on wash day, (YES,  my wife refuses to check pockets).  Sometime they work after and sometime they don’t.

But and its a big BUT, I never store anything on them that I haven’t already backed-up on some computer. And that is the correct way to use these USB flash devices; as temporary storage locations used to move existing data from one location to another. They are NOT intended to be long term storage devices and they should NEVER hold the ONLY copy of anything!

Besides deleting files or formatting your flash device, the USB flash devices we receive for data recovery suffer from either physical or ESD (electro static discharge) damage. Typical scenarios may include;

  • USB device has been inserted into a running computer and someone comes along and inadvertently bumps into the USB flash device and causes it to physically break off
  • OR in the same scenario as above, it bends enough to cause some of the connections to touch each other and short out electrically
  • Users often try to force an incorrectly oriented flash stick into a USB connection and cause physical or electronic damage
  • USB flash devices are often stepped on or even run over with a vehicle.
  • Flash devices are often accidentally dropped or immersed in liquids ie. coffee cups, toilets and washing machines.
  • Carry a USB flash drive in your pocket can often cause static electricity to build up and it can discharge causing electronic damage.

Canadians in need of our services can click here  for our Toronto USB data recovery services.

Or if the topic interests you further, please wait for my next post where we will discuss the challenges in recovering data from USB flash devices and why the process is so complicated and not always even possible. To ensure you don’t miss any of any of my new posts be sure to subscribe to the Memofix data recovery blog.

Tags: , , , , , , , ,
Posted in General | No Comments »

Data Recovery for Dr. Dell in Haiti

January 11th, 2012

Data Recovery is often a thankless business. We can spend hundreds of dollars on parts and many late days attempting to recover someone’s critical data files. And in the end, if we are unsuccessful, we don’t get paid and rarely do we get a thanks for our efforts, no matter how hero like our recovery efforts may have been. So when we receive a great big thank you and some pictures showing the fruits of our labour in use, we really like to soak it up. :-)

“Hi Bob,

 you probably remember me from a few months ago. I had the hard drive from an X-ray machine in Haiti that had failed due to a power surge. I though you may be interested to know that thanks to the drive your company recovered the machine is now working again. I’ve attached some pictures for you from the mission in Haiti including pictures of the C-arm being used during a knee operation. The surgeon in the picture is Dr. Dell who covered the cost of the recovery. This surgery to implant a plate in a patient’s damaged knee would not have been possible without a working x-ray. I thought your team would appreciate seeing the results of a job well done.

 Thanks and Blessings,  Geoff “

The Real Doctor of Recovery, Dr. Dell doing his thing in Haiti

Back in August, Geoff, an associate of Dr. Dells asked if we could recover data from an old Quantum hard drive being used in an older X-ray machine in Haiti. It was a 52 MB hard drive, yes 52MB or .052GB or .0000052TB, small by today’s standards that’s for sure. As the disk drive was very old and few data recovery companies other then Toronto’s Memofix Data Recovery Services had the experience or parts to deal with it, we were asked to attempt the hard drive recovery in Toronto.

As it turns out the hard drive had been damaged by a power surge and it’s printed circuit board or PCB was fried. Additionally and more detrimental to our data recovery efforts, the surge damaged a small pre-amp chip that is located on the head assembly inside the sealed disk drive compartment. The chip is used to amplify the signals from the individual heads to the PCB and without its proper operation, no recovery would be possible.

On a current modern hard drive, we would simply replace the entire head assembly but this older Quantum hard drive used a unique hybrid positioning  system  for controlling the heads and it could not be simply replaced with a new one if the data was to be recovered. This hybrid positioning system used a combination of an optical encoder for rough head positioning and an embedded servo system for fine positioning. As a result the relationship between the two positioning methods was critical and could not be altered or replaced with anything but the original mechanical parts.

With Memofix’s grey haired experience in repairing legacy hard disk drives we were able to replace the pre-amp chip on the original head assembly and restore the hard drive to an operating state. We then created an exact image of the entire original hard drive onto a new Quantum 52AT hard drive. Interestingly enough, we had a new Quantum hard drive sitting in our stock, still sealed in a bag we received directly from the now defunct manufacture in the early 90′s.

Sometimes it’s good to be a pack rat that’s been around forever!  Especially when our efforts in Toronto help a good doctor spread heath and healing through a country that really needs everyone’s help. May the forces of good be with the people of Haiti!

 

Tags: , , , , , , , , ,
Posted in General | No Comments »

Data Recovery after a MAC Format

January 4th, 2012

In my last post we discussed the consequences of formatting your hard disk drive using Windows XP, Windows Vista or Windows 7 and whether data could be recovered after such an event.  In this post we will shed some light on how Apple implements formatting on the MAC, and the implications of their methods on data recovery.

First it should be noted that Apple does not use the standard Windows terminology when referring to formatting a hard disc drive. Apple calls their format process “Erase”,  but in essence it perform the same tasks as a Windows Format command.  The hard drive is re-initialized to appear as a fresh and empty drive volume with all of the disk space free for use.

Mac’s Disk Utility can be invoked from the  “Go-> Utilities” tab. A screen shot of the disk utility can be seen below. When a hard drive is selected you can then choose the type of  Volume Format and a name for the new drive volume.

MAC Erase and Format Utility

 

If you were to now press the Erase button, the drive would be formatted or erased according to the Security Options that are set.  To see what options are selected, press the Security Options button and you will see the screen shot below.

By default, an Erase is set to the “Don’t Erase Data” option. This option overwrites all the directory information used to find and access a file. It does not however erase the actual data. In this case, data recovery should be possible. This option is equivalent to a quick format on a Windows based PC.

Secure Erase Options on the MAC

 

The use of any of the other options will result in permanent data loss. Whether you overwrite the data 1 time,  7 times or even 35 times makes no difference in the real world of data recovery. The data will be gone, so be careful.

Tags: , , , , , ,
Posted in General | No Comments »

Recovering Data After a Format

December 13th, 2011

For many years it’s been common knowledge among the more technically savvy computer enthusiasts, that even if you format your hard drive, the data can be recovered. Any simple data recovery software program and even most computer stores with a service department should be able to quickly restore your hard disk drive data after a format. And while this rule has been true for many years, there’s now a new sheriff in town, and he plays by different rules. With the advent of Vista and Windows 7, formatting your disc drive may now permanently destroy your computer data. Read on for the details …

In Windows, there are two types of formats that can be implemented; a quick format and a regular format. In the picture below, a quick format is selected, while un-checking the box would perform a regular format.

Data Recovery Services

Windows Format Screen


On older versions of Windows, up to and including Windows XP, a quick format overwrites the beginning of the MFT or Master File Table. The MFT is an index of all the files stored on a volume. Formatting re-initializes the MFT to appear to contain no data files by truncating the length of the known MFT. However, the orphaned index entries from before the quick format are still intact and can be used to recover all the previously existing files. With older versions of Windows, a regular format does exactly the same but it also tests for bad sectors across the entire drive. This test is non-destructive and does not overwrite any other data areas, so again all data files should be recoverable.

On newer versions of Windows, from Vista on and including Windows 7 and 8, a quick format does the same as with older versions and the data should be recoverable. BUT the regular format has changed substantially. It now overwrites “every” sector on the hard drive and as a result no data will be recoverable once this command is executed.

So why would Microsoft change the regular format to now erase every trace of data? Personally I believe it is in response to the increased awareness over data security and in particular the news coverage of personal data being discovered on tossed computers (see this interesting story on one couples adventure with leftover data files). Now, with just a simple regular format, Microsoft allows an end user to effectively do a complete and secure erase of all your hard drive’s personal content.

With new power comes new responsiblity, so be sure you know what you’re doing before formatting any hard disk drive, because even your friends at Memofix Data Recovery Services may not be able to help you.

Tags: , , , , , , , ,
Posted in General | No Comments »

Data Recovery Second Chances

December 1st, 2011

Here is a story that our head of client services in Toronto wishes me to tell. It’s a story that happens just a little bit too often …

A few weeks back we had a gentleman drop by with a Western Digital hard disk drive for possible data recovery services. The client was quite anxious so we did a while-u-wait evaluation and quickly discovered the disc drive couldn’t spin up because it had a defective PCB or printed circuit board. After reading off the original NVRAM memory contents* and transferring them onto a compatible PCB we soon had the drive spinning again. However we still couldn’t access the client’s data and further analysis revealed there was a second more complicated problem with the drive’s SA or “system area” modules, (kind of a secret operating system stored on the drive’s disks or platters and for its own exclusive use). After some attempts to repair the damaged SA modules it became apparent that it would take further research and time to solve the corruption. We did however believe we had enough information to quote the customer and we proceeded to do just that.

With multiple hard drive problems we don’t typically charge twice as much but we do add a premium and this recovery was quoted at $800. And as often happens, the client was aghast at the figure and decided to decline our data recovery quote. Fair enough, we realize the real value of the data can only be determined by the owner so we packed up the case and handed it back to the gentleman. See this older blog post “Data Recovery Pricing and Why were not the Cheapest”  to better understand the data recovery pricing process.

A week or so goes by and we get another visit from the same gentleman. This time he is ready to agree to our quote and he leaves the drive with us. However, once we get the disk drive back into the lab, we see stickers on it from one of our competitors, the largest data recovery company in the world ! And worse yet, the drive’s bubble or sealed environment where the disks are located had been opened.

Oh oh, why would they open the drive? Our initial evaluation revealed no problems with the actual disc media or the read/write heads, so we better take a look. Under class100 clean room conditions we open the hard drive and find a crash forming on the top surface minimally. The crash has formed a ring and can only be created by continuing to operate a crashing hard drive. We then remove the head assembly and inspect each head for damage and contamination. This process reveals additional crashes have developed on the lower disk surfaces. The damage is so severe; the odds are against us recovering anything of value!

We contact the client who admits he did bring it to a competitor BUT he swears it was only for another evaluation and quote. He was trying to find a better price. After “evaluating” his hard drive recovery for 2 days, the other data recovery company told him it was unrecoverable!

This is where the illusion of two totally different outcomes must be addressed and the difference in data recovery processes exposed! Here’s what happened …

The world’s largest data recovery company receives a hard drive for data recovery. The drive is received and they immediately attempt to recover all the data possible. If they can’t recover any data they declare it unrecoverable. If they can recover some data they send the client a list of what they can recover and a firm quote. The recovery is already attempted, the results are already in. There is no proper “do no harm” evaluation or diagnosis. There is little chance of anyone doing any better once they are finished with it. Any  2nd chances are effectively destroyed!

What makes matters worse is what happened with this case. What would have been a 99% chance of a successful recovery with Memofix Data Recovery Services turns into a 100% unrecoverable situation. Whether the new damage was caused by mishandling during its transportation or whether it occurred during our competitors “evaluation” cannot be said, BUT I can tell you the result is the same. Somebody is not going to see their data ever again.

IF a data recovery company can’t give you an evaluation without doing further harm to your hard drive then they don’t know what they are doing, period!  Memofix stands by every evaluation we perform and furthermore our processes do NO harm. Consequently if you get a 2nd opinion after a Memofix diagnosis it should confirm exactly what we discovered.  Of course actual  data recovery pricing  for the same diagnosis may differ between competitors, especially in Toronto.

IF a data recovery company uses a process where they attempt to recover the data immediately from any data recovery case they receive, don’t use them. Even if they successfully recover your data, their attempts may have denied anyone else a chance of recovering your data AND consequently they can hold you over a barrel as they have the last obtainable copy of your data in the world.

Remember, the 1st attempt at recovering data from a hard disk drive is typically the most successful. The longer a failing hard drive is operated, the worse your chances of seeing your data again. Choose a data recover provider with the same care that you would use to choose a surgeon, your data may depend on it.

*PCB swapping on most HDDs is not a straight exchange (even with an exact firmware PCB),  as the PCB stores settings specifically tuned for its original set of disks and heads. .

 

Tags: , , , , , , , , , , ,
Posted in General | 1 Comment »

Memofix Professional Data Recovery Services offered at NCIX

November 21st, 2011

Professional Data Recovery "Made in Canada"

 

 

 

 

 

Tags: , , , , ,
Posted in General | No Comments »

Toronto and Vaughan RAID Data Recovery

November 16th, 2011

Enterprise level RAID arrays often use SCSI or SAS (serial attached SCSI) hard disk drives.  Compared to PATA and SATA IDE hard drives, SCSI and SAS are not as common. And as a result few data recovery companies have much experience with them.

Fortunately, Memofix (located in Vaughan, Ontario) has been around for so long that we still remember when all servers and RAID arrays used SCSI hard drives.  I too have been “around” for a long time and during my 12 years at ActionFront and Seagate Recovery Services I was the “go to guy” for SCSI recoveries.  By the end of my career at these Toronto GTA  based recovery companies, I was full-time management with the exception of working exclusively on cases that used SCSI hard drives. As a result,  I became thee expert at resurrecting dead SCSI and SAS drives. And as they were most often used in RAID arrays, my skills at rebuilding and recovering RAID data was also very good.

At Memofix this expertise has been passed on, but I still personally monitor every SCSI, SAS and RAID array we receive. I believe we are the best in the industry whether that RAID is used on a MAC. Windows, Unix or even a Solaris operating system. If you need some expertise on your failing RAID call the professionals. http://www.memofixdatarecovery.com/data-recovery-raid.php

Tags: , , , , , , , , ,
Posted in General | No Comments »

« Older Entries