Data Recovery, recovering Hard Drive data, RAID data recovery

After-Hours Emergency Service (647) 448-5302

Recovering Unrecognized SD and microSD cards

SD cards and microSD cards are flash-based storage devices used extensively in cameras and phones. You can see the size difference between a microSD card and a full size SD card in the two pictures below.

SD card data recovery micro SD card data recovery

 

 

 

 

 

 

 

 

 

Both SD and microSD cards are functionally the same as USB flash drives. Both share similar components including a memory chip(s) and a controller chip to manage the memory device(s). Below is an example of a typical SD card showing both sides of the device with the plastic casing removed. On the left hand side picture you can see two larger memory chips and a smaller black controller chip.

SD card memory chips
Non-monolithic SD Card

SD card circuit side

 

 

 

 

 

 

 

 

 

SD cards can be manufactured as a device comprised of the individual components (memory and controller) like the example above OR they can be manufactured as a monolithic device like the picture below. ALL microSD cards are monolithic devices.

A monolithic device has the controller, memory chips and any other discrete components, combined and built into a single chip or device. It is one piece so you cannot break a monolithic device down into discrete components. To the eye, a monolithic device appears as just a piece of black plastic like the examples below.

microSD card data recovery
Monolithic MicroSD Card

microSD card monolithic

 

 

 

 

 

 

 

 

 

When monolithic or non-monolithic  devices become dead, inaccessible or unrecognized, they require different methods to recover the data.

With non-monolithic devices we can remove the individual memory chips and read the raw data using a standalone chip reader. However, the raw data is “very raw” and still requires extensive analysis to determine the layout of the data and customized software to put the pieces back together into a useable format. Even a flash device with one memory chip requires this rebuilding of the raw data. Some of this complexity is a result of a technique used by flash called “wear leveling” where the device tries to use all the memory cells equally so that no particular memory cell becomes worn out sooner than its neighbours. As a result, many of the storage cells will appear to have copies of the same data, but a closer inspection reveals the contents are older versions of the data waiting to be re-used with new data. Consequently, we must use the raw contents of the device to determine how it all fits together. It is somewhat like a giant jigsaw puzzle.

With a monolithic device, we cannot remove the memory chip(s) as they are all part of the same package. In these situations, we need to remove the plastic coating from the device so that we can visually see and map out the circuitry (see the photo to the right).

monolithic circuit board
coating removed

Then we need to determine how we can connect to this existing circuitry in order to gain access to the memory contents. Some connections for previously discovered microSD cards are shared and available to professional data recovery companies using a web-based database.

However, if the database does not contain details on the “to be recovered” device, the entire mapping out process can be quite tedious and can take anywhere from a 5 days to 5 weeks. Once the circuitry layout has been determined, we can use that information for future data recoveries from the exact same device. The bad news is that very few SD or microSD cards will share the exact same layout.

reading a monolith IC
Monolithic Adapter PCB

 

Having determined where we need to connect to the device, we now must tediously solder wires from the adapter board to the device. Then we are able to use a chip reader to connect to the adapter and read off the memory contents. Finally, we need to figure out the data layout as we do with the non-monolithic devices and ultimately recover the data. To the left is a picture showing our connections to access the memory devices on a monolithic SD card.

 

 

 

Our typical fees for recovering data from unrecognized SD cards that are non-monolithic range from $400-$800.

Unfortunately due to the massive amount of work required, our fees for recovering data from an unrecognized monolithic SD card or microSD card are even higher. Expect fees in the range of $700-$2500.  depending on whether we have existing layout information for your particular device.

As always, our evaluations are free and our work is guaranteed to make you happy or you don’t have to pay a nickel. To send us a new case now, please click here.

 

 

 

 

FREE Pickup Service for the Toronto GTA

 

Do you live in the Toronto GTA and don’t have the time to package, ship or deliver your hard drive or other storage device to Memofix?  We can help!

Starting September 1st, 2016 Memofix will begin offering a free pickup service for data recovery cases originating in the Toronto GTA. Initially this service will cover, Brampton, Mississauga, Oakville, Richmond Hill, Markham, Vaughan, Scarborough, North York, Etobicoke and the rest of Toronto. 

Memofix_Delivery

Our professional driver can arrive at your home or place of business within a predetermined 2 hour window between 9am-5pm Monday through Friday. Our driver will also provide free packaging to ensure no further damage is done to your device as it travels to our data recovery lab.

Requesting this new pickup service is very easy. When creating a new data recovery case you can simply choose to have your hard drive or other storage device picked up. You will need to confirm the pickup address, contact phone number and a 2 hour window where you will be available to meet our driver. You can even add special instructions, ie. meet me in the lobby of my office building.

Are you outside the Toronto GTA?  … Memofix has plans in the coming months to roll out our unique pickup service to other major and not so major city centres across Canada, so stay tuned for updates.

 

 

 

Looking for a Hero?

Memofix Data Recovery Services, a division of Memofix Hitech Services Inc. is looking for a talented data recovery specialist to fill a permanent position at our data recovery lab in Concord, Ontario. If you have a passion for problem solving, an unquenchable lust for knowledge and really enjoy helping people and businesses recover their irreplaceable data, we may have a home for you.

As a data recovery technician, you will join our team of proven data recovery professionals in our quest to become the most technically capable data recovery service company in the world. To become the greatest, we are looking for experts in many areas. We need skilled hard drive surgeons experienced in resuscitating damaged and crashed hard drives. We need PC3000 masters with in-depth knowledge of hard drive system areas (secret OS of the hard drive). And we need file system specialists with an intricate understanding of the various operating systems as well as a thorough understanding of RAID variations and rebuilding techniques.

If you have post secondary education in computers and 2 or more years of experience in the areas listed below, we want to talk to you;

  • Diagnosing and identifying hard drive problems.
  • Diagnosing and repairing of defective hard drive PCBs including NVRAM transfers.
  • Identifying defective heads and replacement techniques in a cleanroom environment.
  • Dealing with seized spindle motors.
  • Transplanting of disks into a new body and motor.
  • Using the PC3000, Data Extractor and other specialized hard drive tools.
  • Specialized techniques such as individual head imaging.
  • Performing hard drive hot swaps with a system area compatible donor drive and PCB.
  • Identifying, repairing and rebuilding file system structure damage in FAT, NTFS, MAC and Linux type operating systems.
  • Identifying striping schemes and pertinent parameters in various flavors of RAID.
  • Repairing and Rebuilding RAID arrays physically and virtually using various software tools.

Memofix offers competitive salaries, equal opportunities, a full benefits package, and a wonderful work environment for all of our employees.

If you have the skills, aptitude, and desire to join a team dedicated to becoming the best at recovering the world’s data, please send your resume to me at davidf@memofix.com.  Please reference “Hero Ad” in your email subject  line.

 

 

Canada’s Astronaut Chooses Memofix!

canadian data recoveryLast month we received a crashed 2.5″ 2TB Western Digital hard drive for recovery. We see a lot of these drives but this one was special as it came from one of Canada’s most famous explorers of space .. Chris Hadfield … Canada’s Astronaut!

Chris has a team of support people who help him make decisions and complete his various obligations. When Chris’ hard drive died, his team began reviewing and researching where to send it for data recovery. They contacted a number of their top choices but ultimately chose Memofix Data Recovery Services.

We think they made a wise decision and considering the great 5 star review he gave us, he must have too.

 

Thanks Chris, your praise and recommendation are very much appreciated.

MELTED DATA

Almost every month someone in Canada sends a hard drive that has been involved in a house fire. They often resemble burnt bricks like the picture below of a drive we recently received from a client in London, Ontario.  None of our techs were in a hurry to get their hands dirty, but as terrible as these situations look, there is often an easy recovery lurking just under the mess!

data recovery

Plastic melts easily and this external hard drive is in-cased in plastic like a pair of jeans on a teenager in the 80’s.
data recovery

 

But with a little invasive surgery we are able to free the hard drive from its prison.

But will the prisoner be able to talk?

As we have discussed various times in this blog, it is the condition of the disks that will ultimately decide if we can make this hard drive talk again. So let’s open the bonnet and have a peak under the hood …

 

 

WOW! It looks pristine. Notice the lack of any contamination due to the fire or the liquids used to douse it. We proceeded to perform a full recovery on this case by replacing only the PCB

 

 

 

 

Below is another fire victim from a client in Montreal, Quebec which was not in such great shape when we opened the lid.  In fact, it may not be recoverable  … but we’ll never know for sure as the client declined our quote.

As a general rule for data recovery purposes, fire damaged drives are not typically unrecoverable due to the heat and smoke of the fire, BUT more often, it is the excessive use of firefighting liquids that do the damage, especially if they are allowed to dry out. The drying out leaves mineral and other debris deposits on the disks which are tough to overcome.

 

 

 

And here is a look of what happens when someone applies power to a fire damaged hard drive that has had the sealed assembly breached. You can see the deep ring on the inside of the disk where the heads are. This disk drive will NOT be recoverable.

 

 

 

So if you have a sad looking case of melted data don’t give up hope, data recovery may be as easy as a PCB replacement.

 

Join us at the Canadian Imaging Conference and Trade Show

 

Memofix Data Recovery Services will be an exhibitor at the upcoming 2015 Canadian Imaging Conference and Trade Show in Niagara Falls, Ontario on April 26th and 27th. Please feel free to be our guest at this event by printing and presenting the Trade Show Pass shown below.

 

This trade show is put on by the PPOC or Professional Photographers of Canada and is part of a 4 day conference aimed at the professional photographer and imaging professional. The conference offers various educational seminars hosted by 19 well respected industry experts and is aimed at improving your artistic and technical imaging skills.

Memofix Data Recovery Services has extensive experience recovering data for professional photographers and videographers. We routinely recover data from all types of camera memory cards, as well as external hard drives, NAS devices, LTO tape and RAID storage devices. If you’ve lost your valuable photos or video, we can help.

 

 

 

WARNING – WARNING – WARNING

In my last blog I recounted how we managed to recover the data from a multiple hard drive RAID array AFTER two different European data recovery companies had failed.  In that situation, we were the white knight, coming in to save the data where others had failed. But recently, we were painted as the villain for performing similar data recovery magic right here in Toronto.  In fact, the title of this blog came from our 1st ever negative Google review as a result of this recent case.

To summarize, we received a 2.5” Western Digital WD hard drive for data recovery. The particular model drive sent in, has a USB3 interface built onto its PCB (printed circuit board) and it does not have typical SATA connections. From experience, we have found that data recovery imaging utilities (both in-house written and commercial) work terribly with USB interfaced hard drives. As a result, we don’t attempt to access or image USB3 type WD drives using their native USB PCB. Instead, we have learned how to convert a particular standard WD SATA PCB to work with these native USB drives.
best data recovery for Western Digital
So when we received this case, we immediately converted one of SATA PCBs to work with this drive. The conversion process required us to remove one small 8 pin programmable chip from the client’s original USB3 PCB and transfer it onto our SATA PCB. Once we did this, we were able to evaluate the drive fully and concluded that the drive had bad heads and likely minor disk damage.  We contacted the client and quoted them $1300, which they declined. We transferred the client’s 8 pin chip back to their original PCB and returned the drive to the client.

The client then took it to another data recovery company who claimed it was unrecoverable because we had damaged the PCB and furthermore we left solder paste around the 8 pin chip and were thus “VERY AMATEURISH”. Ok we forgot some totally inconsequential solder paste on the PCB.  But we never once applied power to the PCB so the claim we damaged it seemed unfounded.  Of course there was a chance we damaged the small 8 pin chip so we suggested the client bring it back to us. They did; we removed the chip and verified it’s functionality using a chip reader. While it was here, we re-established the fact that we could still recover the data, but again the client did not want to pay us anything and left with their drive intact but with no solder paste residue to complain about.

Apparently, the client then went to KROLL ONTRACK, “the industry leader and the largest data recovery provider in Canada and in the world”. The client claims they also declared the drive unrecoverable due to the same “damaged” PCB.

The client then came back to us, and we again re-iterated that we had not damaged anything, and we could still recover the data for him. In fact, just to keep our good guy image alive, we offered to reduce the cost by $300. At 1st the client accepted thinking we offered the recovery at $300. But when he realized we weren’t giving it away and still required $1000 to complete the recovery he declined and created his mean spirited Google complaint.

Whether this client was trying to get a free recovery or not, I don’t know, or care, but in the end I am aghast that 2 other professional data recovery companies in Toronto cannot recover the data from a situation where we regularly do.

It helps to realize, that the world wide data recovery industry has no standards, no way of knowing a company’s competency, or a company’s integrity. There are lots of bad guys waiting to take your money for very little in return and many posers issuing inaccurate statements about what is recoverable and what is not. The damage they can cause is inexcusable.  I have heard it said that something like 70% of small companies that lose their data permanently are out of business within 6 months. Don’t be one of them!

If your data is important, don’t believe the 1st “It’s UNRECOVERABLE” that you hear. Data recovery companies and technicians are not created equal. Please seek a 2nd or 3rd or 4th opinion, or maybe you should just come to Memofix Data Recovery Services first.

 

 

YES we can recover your data, even if others can’t!

As a member of a worldwide consortium called the TSC or Technical Services Consortium, we are part of a family of companies that offer many of the same services, but in different geographical areas. Because we are not competing with each other, we have developed some amazing business relationships with folks that would normally be our competitors. This has allowed us to gain knowledge in areas where we were weak and to share knowledge where we are strong. As the only member of the consortium offering data recovery services, we often get called in to help with data loss situations.

Recently one of our TSC partners in the Netherlands, Sprague Europe, was approached by a well-known University in Germany.  The University had had a catastrophic failure with a small RAID 5 server and the hard work of hundreds of students was in jeopardy. RAID server data recovery

Initially the University had contacted a well-respected but smaller data recovery company in the Netherlands to help. They were able to image one of the 3 drives used in the RAID 5 array, but unfortunately, all attempts at resurrecting either of the remaining two drives was met with failure.

With RAID 5 and it’s built in redundancy, we only needed to image one of the two non-responsive drives to be able to rebuild the RAID. Both drives had developed light rings on their disks and the heads were physically destroyed by travelling over the damaged areas and had become stuck in the head loader ramps. With each recovery attempt, these rings would increase in depth and width, and soon no recovery would be possible.  The smaller Dutch data recovery company had exhausted their supply of parts drives and realizing the chances for success were decreasing with each attempt, they advised the University to send it to Kroll Ontrack, the largest data recovery company in the world. Ontrack had a branch in Germany and off the case went.

But again, all attempts to recover the data were met with failure and the University was almost ready to concede defeat. But as luck would have it, the head of the University’s Computer Centre was an old colleague with one of our friends at Sprague and in a last ditch effort he called Sprague for advice. Our friend at Sprague suggested Memofix “may” be able to help.

Unlike most data recovery service providers, Memofix does not charge an extra fee for working on hard drives that have been previously worked on by other data recovery companies. In fact we cherish those data recovery cases because it gives us a chance to show just how good we are. Over the years we have recovered approximately 70% of the recoveries that have been previously attempted by our competitors.

western digital data recoveryWhen I first saw the request and the summary of what had been attempted, I was skeptical if we could do any better than the two professional data recovery companies that had already tried, especially when one of them was a “world leader” in data recovery and cost did not appear to be a constraint. I spoke with the original data recovery company that tried the 1st attempts. They told me that both defective drives had heads that were bent, distorted, and stuck in the head ramp loaders. They also told me that they had gotten both defective hard drives to function for a very short period of time after replacing the head assembly.  Things were looking a little more promising.

When it comes to recovering data, there is one MAJOR factor that influences the chance of recovering data and that is the condition of the disks. If the disks are in good shape, a recovery is usually going to be possible.  If the disks are badly scored and ringed, then it will be next to impossible to get a set of heads to function inside the drive without damaging them almost instantaneously. For a disk to get that badly damaged usually means the drive has been running/spinning in a crashed state for a long time. The fact that these drives had their heads stuck in the loading ramps is good news, as they could no longer damage the disks. The second fact that made us hopeful was that the drives were manufactured by Western Digital and Memofix has one of the best Western Digital data recovery techs that we have ever met and we do know a lot of data recovery techs.

So we decided that we may have a chance of successfully recovering at least some of the data and consequently the case was sent to us for a final data recovery attempt.

Our initial evaluation confirmed that we would need to get one of two defective drives imaged. After much scrutiny it was determined that one of the defective drives had shifted disks. When heads are replaced, there is a procedure for adjusting the disks which can sometimes help in getting access to a non-responsive hard drive. I suspect one of the data recovery service providers had attempted this procedure or something similar. This procedure can sometimes make things worse, so we decided to concentrate on the more pristine of the two drives.

Our Western Digital data recovery specialist got right to work. His first task was to get the drive functional enough to read off the drives system area, a normally inaccessible storage area on the drive used for its own housekeeping and the storing of drive specific settings. The system area tells the drive how many heads are present and what settings to use with each head. Without this road-map, recovery may not be possible.

bent heads comparison
Bent Heads vs Good Heads

We quickly determined that two of the disk surfaces had physical damage and we would worry about those surfaces last.  Modifying the system area allowed us to configure the drive to ignore the 2 damaged heads/surfaces. We then physically removed the 2 heads (corresponding to the damaged surfaces) from a good parts head stack. This would prevent further damage to those disk surfaces as well as preventing read interference from the heads going over the damaged areas. We then used this head assembly to get the drive to initialize and we started to image off the good surfaces.  After approximately 20 hours of imaging, the heads assembly became too contaminated with crash debris to function and we had to modify a new set of heads to continue. After two days we had managed to image 6 of the 8 disk surfaces. We were now ready to go after the two damaged disk surfaces.

At this stage, our greatest danger was the inherent risk of developing new crashes & destroying our chances of imaging off the last two disk surfaces. Consequently, the drive was imaged only while it could be monitored by a dedicated human watching and listening for any potential new crashes. Imaging of these last two surfaces took almost a week and in the process we consumed five sets of heads and still had some areas where nothing could be read because of the damage to the hard drives’ disks.

With the best drive images we could obtain, we began to analyze what we had. Once we determined the correct RAID 5  configuration settings we were able to use the RAID’s parity to virtually rebuild the missing disk and to de-stripe the 3 drive RAID 5 volume onto a single drive. Then it was a matter of repairing some minor file system structure damage, mounting up the volume, and copying the data to a new target hard drive.

In the end, we were able to recover over 99% of all the students’ data. But there wouldn’t have been any data recovery had it not been for one individual at the University refusing to take NO for an answer.

Consequently, I think the real takeaway point, has to be the fact that not all data recovery companies have the same abilities and just because the world’s largest data recovery company says it can’t be done, doesn’t mean Memofix, the world’s most determined data recovery company, can’t prove them wrong.

We are Memofix, and YES we can recover your data, even if others can’t!