Hard Drive Data Recovery Toronto

To understand why you may require data recovery services on your HDD or hard disk drive it helps to understand the two main categories of causing data loss.

1. LOGICAL FILE SYSTEM DAMAGE - The hard disk drive (HDD) is operationally functional. Data is lost or inaccessible because the file system structures (think of an index) that are used by the operating system to locate your data have become corrupted, overwritten, deleted, or possibly even orphaned from the file system. This may result from several scenarios including:

   Deleted Files or Folders	Formatted Hard Drive	Re-installed Windows
   Virus Attack	Improper shutdown	PST file too large
   Overwrote Original File	Deleted Partition or Volumes	Chkdsk utility run
   Created New Volume	Boot Record damage	Ran Utilities
   Read Errors	Master Boot Record Bad	Encryption Issues

   
    
2. PHYSICAL DAMAGE - The hard disk drive or HDD is NOT functioning properly. There are varying degrees of damage, but the most critical factor determining the success of a data recovery on a hard disk drive is the condition of the actual disks or platters. Hard drives may become defective for a variety of reasons, including:

   Bad Heads or Head Assembly	Electrical Storm Damage	Media Damage Read Errors
   Bad Sectors or Read Errors	ESD damage Power Spike	Noisy Drive Spindle Motor
   Clicking Noise, bad head(s)	Excessive heat	PCB defective
   Computer Dropped	Excessive Read Errors	Physical damage
   Corrupted Firmware	Fire, Flood, Water Damage	Printed Circuit Board bad
   Damaged Motor Failure	Hard Drive Head Crash	Seized Spindle Motor
   Defective or bad Heads	Heads Stuck or Stiction	Servo track damaged
   Drive doesn't spin	Knocked Over External Drive	Static Electricity damage
   Drive Dropped	Laptop Dropped	System Area damage

If variety is the spice of life then being a Data Recovery Technician is never a boring job. There are so many different scenarios of data loss that each new case seems to present a new challenge. However, there are some common processes and steps for all recoveries.

Evaluation

• Every data recovery begins with an in-depth evaluation to determine the exact cause of the problem. We assess if the data loss is the result of a LOGICAL or PHYSICAL problem.
   
• If the problem is PHYSICAL we further isolate the problem to determine which component of the hard drive is faulty.
   
• If the problem originates inside the sealed HDA or Head Disk Assembly; the drive will be opened and inspected further under Class 100 Clean room conditions to determine exactly what's wrong.
   
• If the problem appears to be LOGICAL and there are no obvious physical issues with the drive, we will attempt to create a sector by sector image or mirror of the entire hard drive. This imaging process will often reveal the problem to be PHYSICAL; if for instance the drive has media damage and all the sectors cannot be read. If an adequate image can be secured, the image is then analyzed to determine the cause of the data loss.
   
• The results of the evaluation are then used to determine a set cost for a successful recovery, as well as an estimate of the time required and the chances of success.
   

Logical Recovery (some examples)

• FILE AND FOLDER DELETIONS: In most operating systems the deletion of a file does not mean the actual file is deleted or overwritten but rather that its entry in the MFT or "operating system's index of files" is tagged to show the file as being deleted. This lets the operating system know that the sectors where a particular file is stored can now be re-used for future use. This is why it is so important to immediately quit using your computer should you delete a critical file. Even when a computer appears to be doing nothing, there are tons of read/write operations occurring just to maintain the system and any one of them could be the write operation that overwrites your data forever.
   
• RE-FORMATTING/RE-PARTITIONING /RE-SIZING: "Oh oh!!.. I just formatted the wrong volume and now I can't see my data". If this scenario happens to you in Windows, don’t despair we CAN recover your data. But once again, to ensure we have the best chance and to prevent any critical overwriting of key data structures, please stop using the computer immediately. Doing a format will erase a very small part of the MFT or Master File Table or "operating system's index of files" as we referred to it earlier. The remainder of the index is intact and can be rebuilt by Memofix.
   
• VIRUS ATTACK: The news media loves to sensationalize computer viruses but in reality we recover data in well over 99% of all virus related data loss situations. The majority of viruses causing data loss tend to disable a users access to their system by overwriting the boot sector. This is very effective at keeping you from using your system but any competent data recovery service will have little trouble repairing such damage.
   
• ENCRYPTION: Encryption was developed to ensure the security of a user's data should it fall into unscrupulous hands. In theory any encryption password can be discovered by using brute computer force and time but in reality the time and/or resources required would make it impractical to all but the most motivated. More often encryption is broken by a hacker using other means to discover the password like keyboard recorders or reading the un-purged RAM contents. When recovering the data off encrypted volumes there are two approaches that Memofix Data Recovery Services Toronto may take.
  
  The 1st method is only feasible when our evaluation finds the PHYSICAL problems with the hard drive AND we are able to repair the hard drive AND we are able to mirror it off with NO read errors. Then we can ship an exact image back to the client which should be as functional as before it failed. In this approach we have no way of validating the success of the recovery but the client never needs to reveal his password or his data to anyone.
  
  In the 2nd PREFERRED method we need to first decrypt the data from every readable sector of the hard drive. We are able to do this for most Encryption programs including, WinMagic SecureDoc, Symantec Endpoint Encryption and PGP Whole Disk Encryption. Once the entire volume is decrypted we can treat the recovery normally and deal with any damaged file system structure or bad files as a result of read errors etc.
  
  Also be aware that several hard drive manufactures including Seagate and Hitachi are now offering hardware encryption options on some of their hard drives. Referred to as FDE or Fixed Disk Encryption, there are no known methods to recover the data without the original password.

Physical Recovery (some examples)

• HEAD CRASH: A head crash refers to the damage that occurs when the heads come into contact with the spinning disks. In a good working hard drive, the heads float on a microscopic layer of air just above the surface of the disks. But if the drive is bumped while spinning, the heads may easily break through this air cushion and touch down on the surface of the disks. The disks are composed of an aluminum or glass core, coated with a super thin MAGNETIC coating. Unfortunately, your data IS the magnetic coating! When the heads touch down they begin to score the disk as it spins under the pressing head. Within milliseconds a complete ring around the disk may form and clouds of black data dust are released into the sealed chamber. In the process the head is completely destroyed or in the case of a multiple head drive, this scenario is likely unfolding with many heads simultaneously. If allowed to continue, the damage will quickly dissolve any chance of recovering the data.
  
  HDD data recovery from such a scenario is NOT always possible and almost always expensive. The first step is to disassemble the drive and remove as much of the black dust as possible. The platter surfaces are then cleaned and lubricated using proprietary techniques. Several compatible parts drives are located. The head assembly from one donor is removed and prepared for installation into the defective drive. The new head assembly is installed and aligned in the crashed drive. Imaging of the surfaces starts from one clean end of the platter towards the crashed area. Imaging is stopped as we begin to enter the crashed area and restarted from the opposite end towards the crash. As we again approach the crashed area, the heads will become damaged permanently. In an effort to get as much of an image as possible we will often repeat this procedure 3 or more times using different sets of donor heads. When we determine that we have as much of the data as is likely possible, we analyze the image for any file structure damage and subsequently repair it. Once the file system structures are repaired enough to allow access to the data, a complete list of good and bad data file sis created.
   
• DRIVE DOES NOT SPIN UP DUE TO A BAD SPINDLE MOTOR: Once regarded as an almost unrecoverable situation, seized spindles are no longer the bad news they once were. While to the layman it seems like an easy fix; just re-install the platters or disks into a new drive. In reality only a single platter drive allows this simplistic approach. When you have a drive with multiple disks, as most drives now do, the disks must be moved as a single unit with no change in their physical relationship to each other. The disks must remain aligned vertically to such accuracy that just loosening the screws that secure the platters down WILL destroy the alignment and any chance of a successful data recovery.
  
  We have developed several proprietary techniques and specialized tools for dealing with "no spin" motor type cases, but due to the propriety nature of these techniques we prefer not to dislose them in any detail. Suffice to say, we are able to transplant stacks of disks up to 4 platters acheiving industry success rates of over 85%.
   
• SYSTEM AREA PROBLEMS: The "System Area", the "Maintenance Tracks" or the "Engineering Tracks" are all common names for a special hidden data area found on the hard drive. Being totally invisible to the user, the System Area is accessible only for the hard drive's service use. It contains the equivalent of the drive's own operating system and is used for such functions as error management and performance tuning. In fact this same area is also used for special functions like storing the drive's SMART history and setting up a HPA or Host Protected Area.
  
  Every manufacture has its own System Area design with very little common ground. Even within a manufactures product lines there are big differences in how the System Areas are implemented. The amount of time required to reverse engineer System Areas makes this approach not practical. Fortunately, there is a very specialized piece of equipment that solves most System Area problems on most manufactures drives. But of course it’s very expensive and consequently many lesser equipped data recovery companies do not possess this equipment.
  
  The System Area is one of the first items checked by a freshly powered hard drive and it must be error free for accessing the client's data area. If the drive fails this check we can use our specialized equipment to repair the damaged modules and re-acquire access. If it is impossible to fix the System Area due to read errors on the media, there is another technique that may be applied. This alternative method involves the creation of a dummy System Area on another good working drive. Critical and unique modules for the System Area are then transferred from the client drive to the dummy drive and the client drive is temporarily initialized using this dummy System Area and a technique called PCB hot swapping. This procedure will give us temporary access to the client's data area.

Legacy HARD DRIVES (MFM, RLL,ESDI, MCA interfaces)

Rare expertise on digital antiques including 5¼" and 3.5" drives manufactured by:

SCSI HARD DRIVES

Proficiency with all manufactures and all SCSI interfaces including,

IDE ATA HARD DRIVES (IDE, EIDE, ATA, PATA, SATA)

Extensive expertise with all modern 2.5" laptop and 3.5" desktop hard drives including those produced by or for,

EXTERNAL HARD DRIVES (USB, Firewire, eSATA)

Expertise with all external hard drives including,

SPECIAL HARD DRIVES

Besides the more common devices, we’re also experienced in recovering data from odd sized drives like the .85" Cornice hard drive, the 1" Seagate series, the 1.8" Toshiba, Hitachi and Samsung ZIFF drives, PCMCIA drives and the legendary IBM MicroDrives. So remember Memofix for all of you hard drive data recovery Toronto needs!