A Walk Through the Hard Drive Recovery Process

Fields writes "It's well known that failed hard drives can be recovered, but few people actually use a recovery service because they're expensive and not always successful. Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing. Geek.com has an article walking through a drive recovery handled by DriveSavers. The recovery team did not give away many secrets, but they did reveal a number of insights into the process. From the article, "'[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage. Seagate considered it dead, but I didn't give up. It's actually pretty amazing that they were able to recover nearly all of the data. Of course, they had to do some rebuilding, but that's what you expect when you send it to the ER for hard drives.'" Be sure to visit the Museum of Disk-asters, too.

Their secret revealed...

A hard drive shaped freezer.

Re:Their secret revealed...

That's actually not to far away from a working solution. You can normally make a failing/failed harddisk work for around 5 minutes by freezing it and then immediately using it. Don't try to boot off it, just connect it as an external drive and you can probably get that code you were working on before the drive failed. Its worked for me all 3 times I've tried.

Re:Their secret revealed...

That worked for me - I recovered an entire hard disk drive (Hitachi Travelstar) using the freeze and sudden twist method. Basically you freeze the hard disk drive to get whatever it is that sticks, to become brittle, and then give the drive a sudden twist to free the platters. This will last as long as the drive motor keeps running. Blogosphere theory is that it is the oil from the platter bearings that leaks and hardens.

Nice Theory But...

Blogosphere theory is that it is the oil from the platter bearings that leaks and hardens.

That is a nice theory but there is no oil in the bearings of a Hitachi (formerly IBM) drive. They ride on an air bearing. I have heard of faulty temperature sensors being reset through the freezing method, but whatever the reason I have seen the freezing method suggested by several sources. For me I believe that it has to do with moving the drive. Shorts or binds will often be resolved by moving the drive around.

When I worked for IBM I did a fair share of data recovery. My favorite drive that I saved was a laptop drive with a stiction problem. It would get caught during spin-up. I put my ear to the drive and would listen to it and kept rebooting and shaking the drive until it finally got past the rough spot. Recovered all the engineers data who was extremely happy he didn't have to waste $500 bucks with Ontrack.

--
So who is hotter? Ali or Ali's Sister?

Re:Their secret revealed...

I had a primary hard drive fail in a linux file server I have at the house. The backup hadn't been taken in a while (yeah, I got lazy), and I really needed the updated files.

A friend of mine told me this method, so I tried it; it worked. I got more than 30 minutes of operation out of the drive, enough to pull ALL of the files off (30 gigs of data) successfully.

1. Put masking tape over the data and electrical connectors of the drive.
2. Immerse the drive in a ziplock bag of minute-rice, with the data/power connectors sticking up. This can't be regular rice, it MUST be minute rice. This acts as a poor man's silica gel later in the process. Close the zip-lock.
3. Freeze the bag of rice with the hard drive in it in the deep freeze for 24 hours. You want it completely frozen, patience is a virtue.
4. Remove the bag from the freezer, and take it to a pre-prepared computer where the drive is ready to be received and plugged in (longer data cable, longer power cable, etc...) You should have another big data drive in the system ready to receive the data from the frozen drive.
5. Leave the drive immersed in the minute rice except for the data/power connector. Remove the tape. Plug in the data and power cables. Try to re-seal the zip-lock bag as much as possible so you don't have rice grains escaping.
6. Orient the drive so it's laying in as natural of a position as possible with as much frozen rice around it.
7. Fire up the system, and try to access the frozen drive. This is the moment of truth. If you're lucky, it'll identify and respond, and you'll have access to the file system.
8. You now about 20 reliable minutes to copy data. You may get more if you're lucky. Copy copy copy. Note: The drive WILL be slow at first, and will speed up as it starts to warm.

Why the minute rice? It performs two functions: First, it keeps the moisture from condensing on, and in the drive's metal parts. Moisture's the killer when you power up a frozen drive. Second, it provides an additional thermal block of "cool" to help keep the drive at a lower temperature while you perform the copy.

After I got the data, I scrapped the original drive I froze (literally, out came the platters and they sit in my stack of platter-shame.) No sense courting disaster a second time.

I've since used this method 2 more times successfully with other people's hard drives. I suspect the recovery specialists use a similar trick, only they'd be smart to use a sub-zero frozen room with no moisture to do their "cold start and copy" process.

Re:Their secret revealed...

A better version of the poor man's silica gel is crystalline kitty litter (which is just rebranded silica gel).

Re:Their secret revealed...

All modern disks ship with some unused spare sectors that are used to remap onto failed sectors. This occurs all inside the drive's firmware, so even though the computer thinks it's addressing the same sector, in actuality the drive is pulling data from the remapped spare. The firmware is smart enough to only remap sectors when you try to write to a bad one, though, because if it decided to remap a bad sector that had data on it that you needed, you'd not be able to get back that data even if the disk was eventually able to read the sector.

Summary

"It's well known that failed hard drives can be recovered"

[Citation Needed]

Hmmm.

The cost for recovering data from a drive with severe media damage, like mine, is about $1900. An average single drive data recovery costs about $1500.

Wouldn't backing your data up be cheaper?

--
http://vancouvercondo.info [vancouvercondo.info]

Re:Hmmm.

That is a good point about not listing everything that requires backing up.

I was on a customer's site one day in Detroit showing a new engineer about installing a mini-computer from the company we were working for at the time.

On another mini-computer located about 50 feet away a customer did a sector by sector backup to another disk and in the process copied the wrong way and lost all of their information that represented two years work.

He immediately panicked and looked around to see who he could blame the error on and decided to blame us... it was really pathetic because the other workers there knew he did it but he could not bring himself to admit it.

We finished the installation and left so I never did here what happened to him.

He was a doctor that specialized in bone deterioration and apparently the data could not be reproduced or re-keyed for some reason.
 

Re:Hmmm.

A properly scheduled and maintained backup system is truly a thing of beauty :)

That's the geekiest thing I've read today. ;)

Re:Hmmm.

Ah young love. ;)

Yes, once a geek discovers the beauty of a good backup system, he/she has stepped into a new world.

My backup/archive server is my most lovingly maintained system. It has saved me several times, and recently had to go through a hard drive replacement. That had me nervous.

Re:Hmmm.

Until one day you find the files you're taring are corrupt...

DriveSavers

DriveSavers can save your dead drives so check out DriveSavers today and see their other link about DriveSavers and did I mention DriveSavers.

The recovery team did not give away many secrets, but they did reveal a number of insights into the process.

Cool article, just wish it didn't read like an advertisement.

That's not an article, it's a long ad :(

Having read the article, I can't help but think that it doesn't really read like an article of "Oh, this happened, and then this happened" especially considering that it is about hard driver recovery.

Short of "sending in a zip lock satchel" and "using methodology" what exactly did this article cover in regards to recovering hard drive information? Not a lot. Sorry to be a bit of a drag here, but considering that the company was mentioned more than once, with links and so forth, it just made the whole thing read like a glorified infomercial with the added bonus of being surrounded by advertising. :(

Just a Slash-Ad

The summary says Be sure to visit the Museum of Disk-asters too. and I did. It is pure advertising. Zero facts, instead boring emotional angle with mom and pop hugging as all their iMac data got recovered.

That stuff on the front page? Bahh! Instead of 15 modpoints twice a week give me 5 article mod points to vote this one down to -1 overrated.

Nice freaking advertisement

"Although there was severe media corruption on this drive, DriveSavers engineers were able to successfully recover the majority of the critical data by utilizing our proprietary software and methodology."

I'm sorry, but that was the most content-free load I've read on /. in a while. And no, I'm not new here - I just usually don't RTFA. ;-P

Defcon 14 had a talk about this

Video of the talk:

Defcon 14 - Hard Drive Recovery [youtube.com]

Basically it talks about making a clean box and how to change out the read heads or the PCB from a drive that is the exact same model. Really cool stuff!

Summary of Article

Recovering hard drives is a 3 step process:

1) Mumbo Jumbo
2) Put drive platter into otherwise identical drive
3) proprietary secret stuff (sound like they used Windows to get the data off and then burn to DVDs.

Now you don't have to read the article.

What is a good DIY success rate?

I've done a few platter swaps and have had good luck if I can find the right donor drive. So far I've gotten data off most of the disks I've tried but sometimes the recovery rate can be as low as 25%.

I recommend that people buy drives in pairs. That way you have a good drive to use as parts once the data has been moved off to a newer drive.
I do repairs in my house so there isn't a clean room in sight.
If the board is fried, a board swap tends to do the trick but the bad sectors are stored on the board so the mapping will result in some bad data.
I start with the hard drive in the freezer (using a external firewire case) trick first. That tends to get noisy bearings about 3 hours which is enough to copy data over.
If that doesn't work, I do a platter swap. I disassemble the drive and I've found that normal printer paper works great for lifting out the platters with out scratching them. Just make sure you put them in the donor drive in the same order and don't flip them. Once the platters are in, it appears that the drives have a few days to live before they stop working. With head crashes, you might want to consider only putting the good platters in. I have yet to find a good cleaning solution so with crashes you have a very limited amount of time but head crashes seem to be rare these days.

Once you can read the disk, use DD to copy the data to a new disk. Don't try to mount it to look for a specific file unless you only need one file and mount it read only. For data file recovery, I use a mac program Data Rescue by Prosoft which is good except it sometimes is too good and pulls out the internals like pictures out of flash and office docs.

If your going to do this at home, take apart a few older disks first. Keep in mind they designed these things to be assembled quickly so there is a way to retract the heads completely off the platter so hunt around for it. There are some people who use vacuum cleaners to try to remove dust and others will use a shower to steam up a bathroom and wait until the steam clears with the hope of taking the dust away. I just open the drives on my computer desk.

What the hell are the moderators doing ?

This article is such a blatant fake / advertisement, how could the moderators let that be published on the front page ?

As noted by many, no real technical information. Whoever wrote it might have tried to sound 'grassroot', but the whole thing still reads very much like a marketing material... 'Be sure to visit the Museum of Disk-asters too' ? Especially when such page contains nothing but marketing stuff ? Give me a break !

And how many people would go pay 2000$ just to get back some music and photos of the family ???

Slashdot needs a system so that people can RATE THE MODERATORS, because anyone who lets something such blatant fake-grassroot marketing material on the front-page should not be in that position.

The whole thing is just an insult to our intelligence

Article is useless, comments are good

I found an unusually large proportion of the follow up comments here to be (+1, Informative) and (+1, Interesting). TFA itself was total infomercial-tastic tripe, however.

Re:This may be a dumb question...

IME flash drives don't fail catastrophically, they go bad one part at a time, and generally only writes fail, you can still read without problem. I've seen a few drives fail all together, but they stopped registering as USB devices all together. The same recovery techniques can be used, and they need not be expensive. There's MagicRescue, and foremost that kick absolute ass. Free recovery software rawks.

Re:Any *REAL* information out there?

There's tons of information out there. We'll omit details about how your data should have been backed up. The rest of it's pretty simple, and it depends on your filing system, but marginally.

1) find out what's wrong with the drive (logic board or drive motor board)
2) get an identical drive; put the old platter assy into the new drive's guts, or just move the good drive's electronics over
3) use a sector editor to find the FAT, journal, or whatever, or restore the MBR and use your fav OS (Kunbuntu, here)
4) painfully gather files (actually, go out back while they're retrieved for you)
5) collect fat (as in BIG) check with lots of kudos, thank yous, and appreciation
6) repeat

You don't have to backup, as long as you have a fat wallet.

p.s. TFA really does sound like a commercial.

Re:Never had any luck with recovery

My father had a failed hard drive many years ago and we sent it to Drivesavers. To say the least, I was not impressed. Not only did they manage only to recover 1/100 of his important powerpoint presentations and research, but they used Norton Utilities to do it. I know this because a few months later I bought Norton Utilities (Mac) and only the types of files recoverable from Norton were present. Also, the icons in the resource fork of each file had the exact same (some non-standard) icons for things like .doc, .pdf, etc. It was against the Norton Utilities EULA to use it for commercial purposes like these guys did. He was using a PowerBook and Mac OS X so maybe they didn't know what to do at the time.

Needless to say, I was disappointed with the experience and in hindsight we should have never spent several thousand dollars to get almost nothing back.

Now I have my dad's computer hooked up to an external hard drive using Time Machine. Unless our house burns down, which would be far more catastrophic than a hard disk failure, I don't anticipate having ever to do that again.

Sorry if this comes off as overly negative, but as this article essentially an advertisement and people need to know customer experiences.