Slashdot Log In
A Walk Through the Hard Drive Recovery Process
Posted by
kdawson
on Mon May 12, 2008 07:02 PM
from the it's-dead-jim dept.
from the it's-dead-jim dept.
Fields writes "It's well known that failed hard drives can be recovered, but few people actually use a recovery service because they're expensive and not always successful. Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing. Geek.com has an article walking through a drive recovery handled by DriveSavers. The recovery team did not give away many secrets, but they did reveal a number of insights into the process. From the article, "'[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage. Seagate considered it dead, but I didn't give up. It's actually pretty amazing that they were able to recover nearly all of the data. Of course, they had to do some rebuilding, but that's what you expect when you send it to the ER for hard drives.'" Be sure to visit the Museum of Disk-asters, too.
Related Stories
Submission: Walk through the Hard Drive Recovery Process by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Their secret revealed... (Score:5, Funny)
Re:Their secret revealed... (Score:5, Interesting)
Parent
Re:Their secret revealed... (Score:5, Interesting)
Parent
Nice Theory But... (Score:5, Interesting)
That is a nice theory but there is no oil in the bearings of a Hitachi (formerly IBM) drive. They ride on an air bearing. I have heard of faulty temperature sensors being reset through the freezing method, but whatever the reason I have seen the freezing method suggested by several sources. For me I believe that it has to do with moving the drive. Shorts or binds will often be resolved by moving the drive around.
When I worked for IBM I did a fair share of data recovery. My favorite drive that I saved was a laptop drive with a stiction problem. It would get caught during spin-up. I put my ear to the drive and would listen to it and kept rebooting and shaking the drive until it finally got past the rough spot. Recovered all the engineers data who was extremely happy he didn't have to waste $500 bucks with Ontrack.
--
So who is hotter? Ali or Ali's Sister?
Parent
Re:Their secret revealed... (Score:5, Informative)
A friend of mine told me this method, so I tried it; it worked. I got more than 30 minutes of operation out of the drive, enough to pull ALL of the files off (30 gigs of data) successfully.
1. Put masking tape over the data and electrical connectors of the drive.
2. Immerse the drive in a ziplock bag of minute-rice, with the data/power connectors sticking up. This can't be regular rice, it MUST be minute rice. This acts as a poor man's silica gel later in the process. Close the zip-lock.
3. Freeze the bag of rice with the hard drive in it in the deep freeze for 24 hours. You want it completely frozen, patience is a virtue.
4. Remove the bag from the freezer, and take it to a pre-prepared computer where the drive is ready to be received and plugged in (longer data cable, longer power cable, etc...) You should have another big data drive in the system ready to receive the data from the frozen drive.
5. Leave the drive immersed in the minute rice except for the data/power connector. Remove the tape. Plug in the data and power cables. Try to re-seal the zip-lock bag as much as possible so you don't have rice grains escaping.
6. Orient the drive so it's laying in as natural of a position as possible with as much frozen rice around it.
7. Fire up the system, and try to access the frozen drive. This is the moment of truth. If you're lucky, it'll identify and respond, and you'll have access to the file system.
8. You now about 20 reliable minutes to copy data. You may get more if you're lucky. Copy copy copy. Note: The drive WILL be slow at first, and will speed up as it starts to warm.
Why the minute rice? It performs two functions: First, it keeps the moisture from condensing on, and in the drive's metal parts. Moisture's the killer when you power up a frozen drive. Second, it provides an additional thermal block of "cool" to help keep the drive at a lower temperature while you perform the copy.
After I got the data, I scrapped the original drive I froze (literally, out came the platters and they sit in my stack of platter-shame.) No sense courting disaster a second time.
I've since used this method 2 more times successfully with other people's hard drives. I suspect the recovery specialists use a similar trick, only they'd be smart to use a sub-zero frozen room with no moisture to do their "cold start and copy" process.
Parent
Re:Their secret revealed... (Score:5, Informative)
Parent
Re:Their secret revealed... (Score:5, Insightful)
Parent
Re:Their secret revealed... (Score:4, Informative)
Parent
Re: (Score:3, Interesting)
Re:Their secret revealed... (Score:5, Insightful)
Parent
Re:Their secret revealed... (Score:4, Funny)
Parent
Re:Their secret revealed... (Score:5, Insightful)
The entire article reads like an advertisement for the company. This is pretty piss poor quality for a Slashdot article.
Parent
Summary (Score:5, Funny)
[Citation Needed]
Hmmm. (Score:5, Insightful)
Wouldn't backing your data up be cheaper?
--
http://vancouvercondo.info [vancouvercondo.info]
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Re:Hmmm. (Score:5, Insightful)
Parent
Re:Hmmm. (Score:5, Funny)
Yes, once a geek discovers the beauty of a good backup system, he/she has stepped into a new world.
My backup/archive server is my most lovingly maintained system. It has saved me several times, and recently had to go through a hard drive replacement. That had me nervous.
Parent
Re:Hmmm. (Score:5, Interesting)
I was on a customer's site one day in Detroit showing a new engineer about installing a mini-computer from the company we were working for at the time.
On another mini-computer located about 50 feet away a customer did a sector by sector backup to another disk and in the process copied the wrong way and lost all of their information that represented two years work.
He immediately panicked and looked around to see who he could blame the error on and decided to blame us... it was really pathetic because the other workers there knew he did it but he could not bring himself to admit it.
We finished the installation and left so I never did here what happened to him.
He was a doctor that specialized in bone deterioration and apparently the data could not be reproduced or re-keyed for some reason.
Parent
Re: (Score:3, Insightful)
Absolutely, just like wearing a condom is cheaper than having a baby but sometimes don't take all necessary precautions.
LK
Re:Hmmm. (Score:5, Interesting)
Parent
Never had any luck with recovery (Score:3, Informative)
Sure, I suppose if the drive has bad electronics AND the head hasn't crashed, you might have some luck, but I never seem to get any of those cases. As far as people accidentally formatting their drives or deleting files, I can recover that stuff myself.
Re:Never had any luck with recovery (Score:5, Informative)
Needless to say, I was disappointed with the experience and in hindsight we should have never spent several thousand dollars to get almost nothing back.
Now I have my dad's computer hooked up to an external hard drive using Time Machine. Unless our house burns down, which would be far more catastrophic than a hard disk failure, I don't anticipate having ever to do that again.
Sorry if this comes off as overly negative, but as this article essentially an advertisement and people need to know customer experiences.
Parent
Re: (Score:3)
Here is my previous post on the subject in the Ontrack Columbia Article. [slashdot.org]
I'll add it here so you don't have to go and read it:
I think this is false. I sent a hard drive to them and they sent it back (and made me $100 poorer) and told me they couldn't recover anything.
:P Anyhow, let's skip to the next morning where I go and power down the computer and check out the drive. Well the chips on the controller card were fried. (Physically melted.) :(
:) And probably about 20 other morals too. :P
:P
The story of the drive: I had my computer (tower) at a party in college and one of the sides was off. I also had one of my storage (not boot) hard drives (which contained various art, pictures, and other valuable stuff to me) laying on the bottom of the 'puter. A buddy came flying out of a door, hit my hand which contained my beer and the beer went flying into the case and all over my hard drive. Needless to say I was pretty well "gone" at that point and toweled the inside/drive off, but left it running. At that point my computer was the party machine pumping loud music and it couldn't be stopped.
So the moral of the story is that if you want to make your data unrecoverable, have a party. Space shuttle explosions will not do the trick. Oh, and backups are good.
Needless to say, I sort of hope that one day I will find a company that can recover the data, because if they can recover a hard drive from a space shuttle explosion, you'd think a little beer would be nothing.
Re:Never had any luck with recovery (Score:4, Funny)
Parent
Re:Never had any luck with recovery (Score:4, Funny)
Parent
DriveSavers (Score:5, Insightful)
That's not an article, it's a long ad :( (Score:5, Informative)
Short of "sending in a zip lock satchel" and "using methodology" what exactly did this article cover in regards to recovering hard drive information? Not a lot. Sorry to be a bit of a drag here, but considering that the company was mentioned more than once, with links and so forth, it just made the whole thing read like a glorified infomercial with the added bonus of being surrounded by advertising.
Re:That's not an article, it's a long ad :( (Score:4, Interesting)
Parent
Re:That's not an article, it's a long ad :( (Score:4, Informative)
Good call.
Parent
Just a Slash-Ad (Score:5, Insightful)
That stuff on the front page? Bahh! Instead of 15 modpoints twice a week give me 5 article mod points to vote this one down to -1 overrated.
Nice freaking advertisement (Score:5, Funny)
I'm sorry, but that was the most content-free load I've read on /. in a while. And no, I'm not new here - I just usually don't RTFA. ;-P
Defcon 14 had a talk about this (Score:5, Informative)
Defcon 14 - Hard Drive Recovery [youtube.com]
Basically it talks about making a clean box and how to change out the read heads or the PCB from a drive that is the exact same model. Really cool stuff!
Re:Defcon 14 had a talk about this (Score:5, Informative)
Last week we recovered 26gb of a customer's data, full recovery, in about 10 sessions of using rsync. We'd let rsync run until the drive "hung up" on us, then cancel it and into the freezer to cool back down for 10 min, repeat.
That chirp he heard is a failure of one of the windings (or the driver IC) on the spindle motor. It's a stepper, and so if a winding goes out, it can't step, and it just resonates at the stepping frequency, and makes a very noticeable "chiiirp". (it's trying to move the head, stepping at an audible frequency, which is why you can hear it) This is followed by a loud click as the drive determines it can't read anything and resets itself, one step of which is to move the read head all the way to the parking track. It does this regardless of where it's at currently because it can't read track information to tell, so it moves it the full distance, and slams into the hard stop and makes the loud noise like a free ball in a pinball machine. Most drives will make 3-6 hard reset attempts before shutting down, but some will go forever.
I've dealt with several dozen Seagate 2.5" HDDs lately, and they just give a loud TAK-TAK-TAK...TAK-TAK-TAK and that's it, you can't hear the chirp. Most of the 3.5" drives do the cyclic chiiirpTAK...chiiirpTAK...chiiirpTAK and then power off. Either way, as far as WE are concerned, dead drive. We refer customers to drivesavers, and due to cost, very few send it in, but a few do. (maybe 5%) So far they have had success with all the people we have referred.
TotalRecall is another company that does this sort of work, but I don't have any experience with them. One nice thing with drivesavers is if they can't recover ANYTHING from the drive, you don't get billed. (but shipping I think)
The OP's article was mighty light on details. I think I just provided more info than they did...
Parent
Summary of Article (Score:5, Informative)
1) Mumbo Jumbo
2) Put drive platter into otherwise identical drive
3) proprietary secret stuff (sound like they used Windows to get the data off and then burn to DVDs.
Now you don't have to read the article.
Re:Summary of Article (Score:4, Funny)
4. profit!
Parent
Advertisments (Score:3, Insightful)
Here is what I'd like to see (to submitter), maybe you should have gone to the corp with your drive (since you did spend 2k on recovery.. why not fly over?). Then you should have taken pictures of the whole process and even a video (instead of using stock images), and most of all you could have avoided all this by using backups.
But this story would have been truly
What is a good DIY success rate? (Score:5, Interesting)
I recommend that people buy drives in pairs. That way you have a good drive to use as parts once the data has been moved off to a newer drive.
I do repairs in my house so there isn't a clean room in sight.
If the board is fried, a board swap tends to do the trick but the bad sectors are stored on the board so the mapping will result in some bad data.
I start with the hard drive in the freezer (using a external firewire case) trick first. That tends to get noisy bearings about 3 hours which is enough to copy data over.
If that doesn't work, I do a platter swap. I disassemble the drive and I've found that normal printer paper works great for lifting out the platters with out scratching them. Just make sure you put them in the donor drive in the same order and don't flip them. Once the platters are in, it appears that the drives have a few days to live before they stop working. With head crashes, you might want to consider only putting the good platters in. I have yet to find a good cleaning solution so with crashes you have a very limited amount of time but head crashes seem to be rare these days.
Once you can read the disk, use DD to copy the data to a new disk. Don't try to mount it to look for a specific file unless you only need one file and mount it read only. For data file recovery, I use a mac program Data Rescue by Prosoft which is good except it sometimes is too good and pulls out the internals like pictures out of flash and office docs.
If your going to do this at home, take apart a few older disks first. Keep in mind they designed these things to be assembled quickly so there is a way to retract the heads completely off the platter so hunt around for it. There are some people who use vacuum cleaners to try to remove dust and others will use a shower to steam up a bathroom and wait until the steam clears with the hope of taking the dust away. I just open the drives on my computer desk.
Where's the beef? (Score:4, Interesting)
Nothing as interesting as the crash on our old mini-computer ages ago either. One of those 12" drives with 4-5 platters had a head crash and repurposed itself into a metal lathe quick nicely one weekend. At least it didnt burn down the building but it left several pounds of aluminum confetti all over the computer room after it blew out the filters on the drive. It seems you just can't filter air by the pound
Needless to say, that had a zero chance of recovery. Only time a insanely overpriced maintainence agreement ever paid off...Drive was almost $20k to replace plus cleanup and setup on 200lb drive.
Only other one that might have required a recovery service turned out to be electronic issue only and i sacificed a matching computer for the HD circuit board to repair the 'server' from a remote warehouse. Only some memos and spreadsheets and stuff and not worth the huge quote for recovery so i got to try it and fixed it the next day
PS. always found it interesting the the edge speed was the same as current drives at around 105mph. The head hit a platter going between 50 and 105 mph.
What the hell are the moderators doing ? (Score:5, Insightful)
As noted by many, no real technical information. Whoever wrote it might have tried to sound 'grassroot', but the whole thing still reads very much like a marketing material... 'Be sure to visit the Museum of Disk-asters too' ? Especially when such page contains nothing but marketing stuff ? Give me a break !
And how many people would go pay 2000$ just to get back some music and photos of the family ???
Slashdot needs a system so that people can RATE THE MODERATORS, because anyone who lets something such blatant fake-grassroot marketing material on the front-page should not be in that position.
The whole thing is just an insult to our intelligence
Let's review. (Score:4, Interesting)
Yep. The article helpfully points out the $1500 charge for a medium sized hard drive. It might have been more interesting if the article demonstrated a time when it wasn't successful.
Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing.
So, just like this article? Got it. Something involving putting old platters into new drives by people wearing bio-hazard suits.
The recovery team did not give away many secrets, but they did reveal a number of insights into the process.
Wowsers. You can say that again, but insights? I defy anyone to name any insight that wasn't in their last press release
[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage.
Doesn't "elctro-mechanical failure" describe anything that could be wrong with a device that is
It's a good thing space on the interwebs is free. Someone should run this past the kids that edit airline magazines.
Wow, thanks for the ad (Score:3, Insightful)
The sad part is that I rarely even read Slashdot anymore since it is a sad shell of what it was... Pitiful.
Article is useless, comments are good (Score:5, Interesting)
Re:This may be a dumb question... (Score:5, Insightful)
Parent
Re:This may be a dumb question... (Score:5, Interesting)
Not really. Software tools such as the one you mentioned, Magic Rescue, are for dealing with deleted files or corrupt file systems. That applies to both flash and magnetic drives.
But for it to work on a magnetic drive, the drive pretty much has to be functional electrically and mechanically. Most drives like that would work after reformatting.
For that software to work, the interface to the computer has to work, the spindle servo has to work, the head positioning system has to work, the heads have to be okay and have a working connection, and at least the read electronics has to work. A drive isn't really very dead if software can control it and read from it.
A failure of some part of the drive hardware is likely to require repair or substitution of what's broken. I was disappointed that the article provided almost NO useful details on that.
If the electronics has failed, substituting the circuit board from another drive of the same type seems like one thing that would be relatively easy.
Those in the know should easily be able to tell if a head or connecting cable has become open-circuited. I suspect that cracked copper in the head flex cable is a fairly common problem. It is likely the as it first fails, a connection is lost more towards one end or the other of head travel. If one can run the electronics in a sort of diagnostic mode (to avoid aborting on errors), I suspect that a bit for bit copy can be attempted by physical location. That's likely what they're talking about when they mention making an image to recover from.
If the heads/cables are trashed and not easily repaired in place, swapping the platters into another drive (after removing any debris) is one of the more extreme measures.
There are probably alternate test-jig type fixtures available to substitute for normal drive electronics. I wouldn't be surprised if the most extreme tools allowed varying read-head preamp parameters and finely adjusting head positioning parameters.
It's kind of sad that so much information is unavailable to most of us. With full schematics, details of drive firmware etc a skilled technician can do component level repairs. People used to laugh at tv repairmen when sets came along where they'd just swap individual circuit boards instead of finding the bad component. But that's the sort of thing we now see most of the time with our computers and consumer electronics, if they get "fixed" at all. Most of the so called repair people know very little about electronics. It's understandable that the low replacement cost of much electronics has made labor-intensive repairs cost prohibitive, but I'd still like to see schematics available for everything.
It's sad that we've not only lost the majority of manufacturing jobs, but much of the service side too as a result of the "if it breaks buy a new one" way of doing things.
Parent
Re:This may be a dumb question... (Score:4, Informative)
Have a look at this photograph [wikipedia.org].
The chip on the left is memory. That's where your data hides. The chip on the right is the memory controller. If that chip fails, but the memory chip is intact, your data may be recoverable.
Surface mount chips are hard, but not impossible to swap out.
Parent
Re:This may be a dumb question... (Score:4, Interesting)
Parent
Re:This may be a dumb question... (Score:4, Funny)
Assuming, of course, that if hiding the data is that important, the cost of a flash drive is a sacrifice you're willing to make.
Parent
Re:This may be a dumb question... (Score:4, Interesting)
If you do put your flash drive through the washer / pool / toilet you should try to soak it in distilled (not deionized or spring) water for a while and then let it dry on a windowsill for a few days. As long as you don't plug it in until it dries it should work just like new. This is the same process used during manufacture of most PC boards with water soluble flux, so it's likely that your drive has already been dunked anyway.
Parent
Re:Any *REAL* information out there? (Score:5, Informative)
1) find out what's wrong with the drive (logic board or drive motor board)
2) get an identical drive; put the old platter assy into the new drive's guts, or just move the good drive's electronics over
3) use a sector editor to find the FAT, journal, or whatever, or restore the MBR and use your fav OS (Kunbuntu, here)
4) painfully gather files (actually, go out back while they're retrieved for you)
5) collect fat (as in BIG) check with lots of kudos, thank yous, and appreciation
6) repeat
You don't have to backup, as long as you have a fat wallet.
p.s. TFA really does sound like a commercial.
Parent