A Walk Through the Hard Drive Recovery Process 238
Fields writes "It's well known that failed hard drives can be recovered, but few people actually use a recovery service because they're expensive and not always successful. Even fewer people ever get any insights into the process, as recovery companies are secretive about their methods and rarely reveal any more information that is necessary for billing. Geek.com has an article walking through a drive recovery handled by DriveSavers. The recovery team did not give away many secrets, but they did reveal a number of insights into the process. From the article, "'[M]y drive failed in about every way you can imagine. It had electro-mechanical failure resulting in severe media damage. Seagate considered it dead, but I didn't give up. It's actually pretty amazing that they were able to recover nearly all of the data. Of course, they had to do some rebuilding, but that's what you expect when you send it to the ER for hard drives.'" Be sure to visit the Museum of Disk-asters, too.
Never had any luck with recovery (Score:3, Informative)
Sure, I suppose if the drive has bad electronics AND the head hasn't crashed, you might have some luck, but I never seem to get any of those cases. As far as people accidentally formatting their drives or deleting files, I can recover that stuff myself.
That's not an article, it's a long ad :( (Score:5, Informative)
Short of "sending in a zip lock satchel" and "using methodology" what exactly did this article cover in regards to recovering hard drive information? Not a lot. Sorry to be a bit of a drag here, but considering that the company was mentioned more than once, with links and so forth, it just made the whole thing read like a glorified infomercial with the added bonus of being surrounded by advertising.
Defcon 14 had a talk about this (Score:5, Informative)
Defcon 14 - Hard Drive Recovery [youtube.com]
Basically it talks about making a clean box and how to change out the read heads or the PCB from a drive that is the exact same model. Really cool stuff!
Summary of Article (Score:5, Informative)
1) Mumbo Jumbo
2) Put drive platter into otherwise identical drive
3) proprietary secret stuff (sound like they used Windows to get the data off and then burn to DVDs.
Now you don't have to read the article.
Re:Any *REAL* information out there? (Score:5, Informative)
1) find out what's wrong with the drive (logic board or drive motor board)
2) get an identical drive; put the old platter assy into the new drive's guts, or just move the good drive's electronics over
3) use a sector editor to find the FAT, journal, or whatever, or restore the MBR and use your fav OS (Kunbuntu, here)
4) painfully gather files (actually, go out back while they're retrieved for you)
5) collect fat (as in BIG) check with lots of kudos, thank yous, and appreciation
6) repeat
You don't have to backup, as long as you have a fat wallet.
p.s. TFA really does sound like a commercial.
Re:That's not an article, it's a long ad :( (Score:4, Informative)
Good call.
Re:Their secret revealed... (Score:5, Informative)
A friend of mine told me this method, so I tried it; it worked. I got more than 30 minutes of operation out of the drive, enough to pull ALL of the files off (30 gigs of data) successfully.
1. Put masking tape over the data and electrical connectors of the drive.
2. Immerse the drive in a ziplock bag of minute-rice, with the data/power connectors sticking up. This can't be regular rice, it MUST be minute rice. This acts as a poor man's silica gel later in the process. Close the zip-lock.
3. Freeze the bag of rice with the hard drive in it in the deep freeze for 24 hours. You want it completely frozen, patience is a virtue.
4. Remove the bag from the freezer, and take it to a pre-prepared computer where the drive is ready to be received and plugged in (longer data cable, longer power cable, etc...) You should have another big data drive in the system ready to receive the data from the frozen drive.
5. Leave the drive immersed in the minute rice except for the data/power connector. Remove the tape. Plug in the data and power cables. Try to re-seal the zip-lock bag as much as possible so you don't have rice grains escaping.
6. Orient the drive so it's laying in as natural of a position as possible with as much frozen rice around it.
7. Fire up the system, and try to access the frozen drive. This is the moment of truth. If you're lucky, it'll identify and respond, and you'll have access to the file system.
8. You now about 20 reliable minutes to copy data. You may get more if you're lucky. Copy copy copy. Note: The drive WILL be slow at first, and will speed up as it starts to warm.
Why the minute rice? It performs two functions: First, it keeps the moisture from condensing on, and in the drive's metal parts. Moisture's the killer when you power up a frozen drive. Second, it provides an additional thermal block of "cool" to help keep the drive at a lower temperature while you perform the copy.
After I got the data, I scrapped the original drive I froze (literally, out came the platters and they sit in my stack of platter-shame.) No sense courting disaster a second time.
I've since used this method 2 more times successfully with other people's hard drives. I suspect the recovery specialists use a similar trick, only they'd be smart to use a sub-zero frozen room with no moisture to do their "cold start and copy" process.
Re:Their secret revealed... (Score:4, Informative)
Re:Never had any luck with recovery (Score:5, Informative)
Needless to say, I was disappointed with the experience and in hindsight we should have never spent several thousand dollars to get almost nothing back.
Now I have my dad's computer hooked up to an external hard drive using Time Machine. Unless our house burns down, which would be far more catastrophic than a hard disk failure, I don't anticipate having ever to do that again.
Sorry if this comes off as overly negative, but as this article essentially an advertisement and people need to know customer experiences.
Re:Their secret revealed... (Score:5, Informative)
Re:This may be a dumb question... (Score:4, Informative)
Have a look at this photograph [wikipedia.org].
The chip on the left is memory. That's where your data hides. The chip on the right is the memory controller. If that chip fails, but the memory chip is intact, your data may be recoverable.
Surface mount chips are hard, but not impossible to swap out.
Re:Any *REAL* information out there? (Score:3, Informative)
That's the hard part. "Identical" means not only model, but often revision as well. Once I did get lucky and find another drive from the same batch, and successfully trade circuit boards. But a couple of other times I failed to find the same rev. number, and the transplant didn't work.
I've been successful a few times freezing the drive (sometimes extending runtime with a can of freeze spray, an aerosol like canned air but gets a lot colder, intended to help techs find thermal problems). And mechanically abusing it (twisting it to start the platter spinning, or just whacking it.
Always have everything ready to go, if you do get it started it may work for ten minutes and quit. Maybe you'll get it started a second time, maybe not.
When the problem has (apparently) been data corruption rather than a hardware problem, I've been successful with software a few times. Once with OnTrack EasyRecovery [ontrackdatarecovery.com], several times with File Scavenger [quetek.com]. Including once where the problem was obviously a head crash, the drive made a horrid screeching sound. Couldn't get all of the data, but got some of it.
There's a pdf [hddrecovery.com.au] at http://www.hddrecovery.com.au/ [hddrecovery.com.au] that's got some other suggestions. (I have never tried that company's recovery software so have no opinion on it.)
I've never had anybody who was willing to pay to have the data recovery pros do it. But often they'd be willing to go a few hundred bucks for me to have a shot at it. Sometimes we get lucky. Sometimes we don't.
Re:Defcon 14 had a talk about this (Score:5, Informative)
Last week we recovered 26gb of a customer's data, full recovery, in about 10 sessions of using rsync. We'd let rsync run until the drive "hung up" on us, then cancel it and into the freezer to cool back down for 10 min, repeat.
That chirp he heard is a failure of one of the windings (or the driver IC) on the spindle motor. It's a stepper, and so if a winding goes out, it can't step, and it just resonates at the stepping frequency, and makes a very noticeable "chiiirp". (it's trying to move the head, stepping at an audible frequency, which is why you can hear it) This is followed by a loud click as the drive determines it can't read anything and resets itself, one step of which is to move the read head all the way to the parking track. It does this regardless of where it's at currently because it can't read track information to tell, so it moves it the full distance, and slams into the hard stop and makes the loud noise like a free ball in a pinball machine. Most drives will make 3-6 hard reset attempts before shutting down, but some will go forever.
I've dealt with several dozen Seagate 2.5" HDDs lately, and they just give a loud TAK-TAK-TAK...TAK-TAK-TAK and that's it, you can't hear the chirp. Most of the 3.5" drives do the cyclic chiiirpTAK...chiiirpTAK...chiiirpTAK and then power off. Either way, as far as WE are concerned, dead drive. We refer customers to drivesavers, and due to cost, very few send it in, but a few do. (maybe 5%) So far they have had success with all the people we have referred.
TotalRecall is another company that does this sort of work, but I don't have any experience with them. One nice thing with drivesavers is if they can't recover ANYTHING from the drive, you don't get billed. (but shipping I think)
The OP's article was mighty light on details. I think I just provided more info than they did...
Re:What is a good DIY success rate? (Score:3, Informative)
For Macs with 10.5 that has become easier because of Time Machine. A 2x1000G RAID box connected to an Apple Extreme wireless router does backups for 6 Macs over the network.
If one of the drives fails, the RAID device makes an audible alarm and indicates which of the two drives has died. A new drive can be installed without shutting down the RAID system. Once the new drive is plugged in, the controller in that box automatically copies all the data from the still working drive.
So far, there have been no glitches or hiccups. Our lone PC user has to copy important files manually to the RAID box.
Re:This may be a dumb question... (Score:3, Informative)
It still might not work if the controller failure took out the flash memory with it, but in practice this is rare.
Re:Their secret revealed... (Score:3, Informative)
I tried Drivesavers once in the distant past. $1200 later, they hadn't recovered more than a megabyte of data off of an 40gb server drive -- and it was all OS files, none of the actual data files we wanted. They claimed the files were too fragmented on the drive, and the failure was too extreme, that nothing else could be recovered. I doubted this because the server ran a defragging routine during downtime.
But it taught me a lesson. I had been on vacation for a couple of weeks, leaving the tape backup system in the hands of someone else. They dutifully swapped tapes on schedule, but never checked the console to determine that the tapes were full and needed to be replaced with new (or newly-erased) tapes. So for six days, no tape backups occurred -- and of course, that department just happened to do a lot of valuable work during that time because it was approaching a deadline. That team valued the work at over $50K. *sigh* After that, I overhauled that server to include RAID, plus a secondary server which cloned all the data from the first server nightly, plus put an autoloader on the tape drive.
Re:Nice Theory But... (Score:3, Informative)
Hmmm (Score:1, Informative)
Even if you send the hard drive back to the company, and the hard drive is under warranty, you always get a blank drive in return.
Your data means nothing and the hard drive company wont recover or pay for recovery of your data even if they are at fault and the drive fails under warranty.
Your only course of action to save money is to always buy two identical drives and always back one up to the other and keep it off line.