Upload
others
View
0
Download
0
Embed Size (px)
Citation preview
Data Recovery
a guide by
What you Need to Know
02
What NOT to do When you Lose Data from a Storage Device
[!] Neverrunaprogramthatwritesto,oralters,astoragedeviceinanyway.
[!] Donotpowerupadevicewithobviousphysicaldamage(e.g.aharddrivethatismak-ingaclickingnoise).Persistentread/writeattemptsonadrivewithdefectiveheadswilljustincurfurtherdamageandpotentiallymakethedatarecoveryprocesstwiceascomplex.
[!] Donotactivatethewrite-protectswitchonanymemorycardsorUSBsticks.[!] Beawarethatthereisnosoftwareintheworldthatcanfixastoragedevicewithphysicaldefects.
[!] DonotruntheCheckDisk, Disk Utilityoranythird-party“diskrepair”utilities.Theyaredesignedtocorrectsmallerrorsinthefilesystem,notmoreseriouslogicalerrors.Iftherearephysicalproblemswithyourdrive,theseutilitiescanexacerbatethem.
What to do When you Suspect you Have Lost Data from a Storage Device
[!] Keepcalm–someusersgetdistressedandpanickedaboutdataloss.Insteadoftrying“quickfix”solutions,stepbackfromthesituationandmaximisetheprobabilityofasuccess-fuldatarecovery,withoutfurtherjeopardisingyourdata.Evaluateyouroptionscarefully.
[!] Diagnosecorrectly–youcanwastehourstryingtofixaharddriveproblemthatdoesnotexist,soitisvitaltodiagnosetherootcauseofthedatalossproblemcorrectly.
[!] Handleharddrivescorrectlyafteradata loss situation.Someuserspanicanddonotproperlyobserveproperharddrivehandlingprocedures.Thiscanbeamistake.Forexample,ifadrivehasmechanical issues,donotcompoundtheproblemfurtherbynotobservingproperanti-ESDprecautionsasthiswillcauseelectronicissuesonthedriveaswell.
[!] Avoidsolutionoverkill–donotbetemptedtodeploydrasticsolutions.TryingtofactoryresetaRAIDarrayonaNASdeviceinthehopethatitwillfixabrokenRAIDwillreduceyourchancesofasuccessfuldatarecovery.
[!] Sometimesthebestandsafestsolutionistotakethestoragedevicetoaprofessionaldatarecoverycompany.Experiencedrecoverytechnicianswhodealday-inandday-outwithdatalosswillhavetheexpertise,equipmentandinsighttosuccessfullyrecoverallofyourdata.
03
Myths about Data Recovery
If I remove the PCB from a failed drive and replace it with an identical one, will that fix any electronic problems with the drive?
Thisprobablywouldhaveworked10-15yearsago.Forexample,PCBswapsusedtoworkbrilliantlywithQuantumharddrives.However,timeshavemovedonintheworldofdatare-coveryand20GigabyteQuantumdrivesarenotverycommonanymore.Withmodernhigh-capacitydrives,PCBswapsgenerallydonotwork.Everyharddrive isnow“hyper-tuned”tooptimiseperformance.Thismeanseachtimeaharddrive ispoweredup,anorchestraofheads,platters,electronicsandfirmwareparametersallworktogetherinunison.Whenan “alien”PCB is introduced into theequation–whichusesa slightlydifferentvariantofPRMLreadchanneltotheoneinthefaileddrive–thedrivewillnotreadorwillnotinitialiseproperly.
To fix the heads in my hard drive, all I need to do to get the drive working again is to open up the drive quickly and reposition them on the platters, right?
Drivescannotbesafelyopenedupwithoutaclean-room.Ifyouwanttotestthis,getacleanmirrorandplaceitinastandardroomforacoupleofhours.Youwillprobablynotice,evenafteranhour,tinyparticlesofdusthavefallenonitssurface.Thesamecontaminationhap-penstotheplattersofaharddrive.Thesetinyparticlesofdustcanseverelyinterrupttheheads reading from theplatters. Remember that theaverage “flyingheight”of thedriveheadsagainsttheplatterisonly3nanometres.(Aparticleofdustistheequivalentofputtingarockonatrainline,exceptonamicroscopicscale).Donottrytorepositionthedriveheadsmanuallyas, fromourexperience, it cancause irreversibleplatterdamage.Recently,oneDublinuserbroughtusadrivethathetriedtorecoverhimself.Weopenedthedrivetofindfingerprints,dustandscratchesontheplatters.ItlookedasifEdwardScissorhandshadbeenpokingaroundinthere!Toproperlyrepairorreplaceaharddrive’sheads,aclean-room,aspecialdevicecalleda“headcomb”andyearsofexperienceareneeded.
Even if a hard drive has severely damaged heads, there must be a universal platter reader invented by someone, right?
Manycomputerusersassumetheremustbeamachineouttherethatcanrecoverdatafromallfailedharddrives.Theyimagineamagicalmachinewhereyoudropplattersfromafaileddriveintoit,andacoupleofhourslaterallthedatastartsflowingout.Generaluserswouldnotbealoneinimaginingsuchadevice.Intheearly2000s,theUSDepartmentofDefenseevenputoutatenderforadevicethatcouldreadplattersdrive-independently.Well,ifthereisauniversalplatterreaderinexistence,thegeneralpublicanddatarecoveryprofessionalshaveyettobetoldaboutit!Manycompaniesofproprietarytoolshaveclaimedtheyhavedeveloped awayof recoveringdata fromplattersdrive-independently for one-off cases.However,noneofthemhaveprovedtobecommerciallyviable.
04
When Backup Files are Useless
We have come across several data recovery cases where the user “thought” they had an up-to-date and complete backup.
But,whendata lossdoesoccur, theyexperience thepainfuldiscovery that thebackup iseithernot fullyup-to-date,notcompleteor corrupt.Abackup that is, forexample, threemonthsout-of-datecanbeuseless,asisabackupfilethatisnotcompleteorcorrupt.
TheITindustrycouldlearnalotfromtheairlineindustry,whichrigorouslyrehearsesandsim-ulatesemergencysituationseverycoupleofmonths.Emergencyequipment is rigorouslytestedsothatwhenarealemergencydoesoccur,crewsareusuallywell-versedinexecutingtheproperproceduresinacalmandefficientmanner.
Everysooften,youoryourusersshouldtestpreparednessfordataloss.Forexample,whenwasthelasttimeyoudownloadedfilesfromyourCloudbackup?Wasallyourdataintactafterdownloadingit?Arethebackupfoldersonyourexternaldriveallup-to-dateandcom-plete?IfyouworkinITsupport,encourageyouruserstotesttheirbackupfilesonaregularbasis.Agoodbackupisonlygoodifitiscomplete,hasfullintegrity(i.e.nocorruption)andisup-to-date.
05
Why New Drives have a High Risk of Failure
Even though most harddrives undergoquality con-troltestingbeforetheyleavethe factory, there are somelatent failures that do notmanifest themselves duringmanufacturer testing.Theselatent failures can happenduetosmalldefectsthatoc-cur duringthemanufactur-ingprocess.
Asyouwillseefromthegraphabove,harddrivesfailureratesfollowthe“bath-tubcurve”.Thismeansthatharddriveshavehigher-than-averagefailureratesduringthefirst12monthsoftheirlifecycle.Afterthisperiod,thefailureratesplateau.Then,afterabout6-7yearsofuse,theprobabilityoffailurerisessteeplyagain.
So,nomatterhow“new”adriveis,complacencyshouldneversetin.Statistically,anewharddrive(i.e.adrivethatislessthan12-months-old)ismorelikelytofailthana3-year-oldone.Justbecauseaharddriveorcomputerisnewdoesnotmeanthatyoucansitonyourdatabackuplaurels.
Toillustratethefauxsenseofdatasecuritywhichnewhardwarecaninstil inusers,here’sacommonscenariothatweseealot:
1) Ausergetsanewcomputer.2) Theydonotconfigureanybackuptothenewcomputer.(How could such a powerful and shiny computer lose any data?)3) Theuserbeginsusingnewsystemforacoupleofmonths.4) Thedrivefailsduetoalatentfailure(ordataislostduetodatacorruption)5) Theuserhasnobackup.6) They,ortheirITsupport,providertriestorecoverthedata.7) Ifunsuccessfulandthedataissufficientlyimportant,theybringthefaileddrivetoadata recoverycompany.
Theymighthavehadadisciplinedbackup regimewith theiroldcomputer,butwith theacquisitionofanewcomputer,complacencysetsin.Asaresult,scheduledbackupsgobythewayside.Nomatterhow“new”acomputersystemorstoragedeviceis,itisstillpronetodataloss.
06
Critical Success Factors for a Head Disk Assembly Swap
Replacing the headdisk assembly issometimes necessarywhenthereisdamageto the drive heads.Thisisanintricatetaskand time-consumingtaskwhichDrive Res-cue has performedsuccessfullyhundredsoftimes.
From our experience, a successful Head Disk Assembly swap has the followingcharacteristics:
Whenchoosingadonordrive,itmustbeanexact match for the failed drive.Itmusthavethesamemodelnumber,sameserialnumberandsamerevisionnumber.A“closematch”willnotwork,itmustbeanexactmatch.
Thehead’sflying heightmustbetheexactsamedistanceasusedbytheoldHeadDiskAs-sembly.Anincorrectflyingheightwillresultinaweakorsaturatedsignal.
Thehead stack must be aligned perfectlyinthesamepositionastheoriginalheads.Ifalignmentisoff-kilter,therewillbeexcessivehead-to-platter“eccentricity”thatcannotbetrackedoutbythedrive’sservo.
Thespacing of the headsmustbethesameasthatusedontheoriginalHDA.Ifthespacingisnotcorrect,thediskpackwillnotsuccessfullyreload.
Thecentres of the platters should line up perfectlywitheachother.Iftheyarenotinperfectalignment,theservowillnotbeabletotrackouttheirregularity.
Whenreplacingtheplattersandspacers, it is importantthatthedatarecoverytechniciantorques the retraining screws correctly. Ifnotenoughpressureisapplied,theplatterscanwarp.Thedriveheadscantoleratesmalldegreesofwarpastheyfly,buttoomuchandaccuratesyncingbetweentheheadsandplattersisverydifficult.
07
Drive Heads
Things to remember when buying and using an NAS drive
RAID 0 offers no level of data redundancy.Itincreasesdatathroughputrates,butnore-dundancy.Ifonediskfails,theRAIDarraygetsbroken.Thatdiskwillhave tobe repaired inordertofacilitatedatarecovery.
IfyouareusingaNASasafileserver,thenit is not a backup device.NASdevicesalsofail.Forthisreason,youwilloftenseeaUSBportor and E-SATA port on an NAS device. Thisenablestheusertobackuptheirfilesontoan-otherdrive.
ChooseaNASdevicethatusesactive cooling(i.e.itusesafan)insteadofpassive cooling.Thermalstresskillsharddrives.Itcausesdamagetotheelectronicsonboard,causesfailureofmechanicalcomponentsandcaninduceaphenomenonknownasthesuper-paramagneticeffecttocorruptyourdata.FromourNASdatarecoveryexperience,NASdrivesthatonlyuseactivecoolingaremuchlikelytobedamagedbythermalstress.
TrytochooseaNAS device that allows backup directly to the Cloud.Forexample,manyNASdevicesnowallowdirectbackuptoaDropboxaccount.Thismitigatesagainsttherisksoffire,flood,theftandemployeesabotage.
Try toavoidpluggingyourNASdevice intoyourmainspowersupply. If there isapowersurge,youriskturningyourNASintoanexpensivedoorstop.Instead, plug it into an Un-interruptible Power Supply.
ThesedaysmanyusershaveadesktopPCintheirofficethatisnotbeingused.ByinstallinghighcapacitydrivesintosuchaPC,youcanturnitintoacost-effective NAS solution.
08
Failed RAID or NAS – Data Recovery Process and Best Practice Tips
TheRAIDdatarecoveryprocessnormallyinvolvesthefollowingsteps:
1) DiagnosisorconfirmationofRAIDfailure
2) Carefulnumberingofalldrives
3) Imagingofalldrivesinthearray
4) DeterminationofRAIDtype
5) Determinationofmemberdisks
6) Findingoutthecorrectdiskorder
7) FindingouttheBlockSize
8) Findingoutthestartoffsetpointsoneachofthedisks
9) StartofRAIDrebuildprocess
10) Verificationofdataintegrity
11) Extractionofthedata
09
10
Raid Data Recovery – Good To Know
> IfyoususpectoneofthedisksinyourRAIDarrayhasfailed,donotcontinuetousethatsystem.Normally,youwillgetawarningerrorfromyourSCSIBIOS/BIOSoramessagefromyourNASdevice.
> DonotrunCHKDSKorFSCKrepaircommandsunlessyouhaveimagedyourdrivesfirst.
> RAIDdatarecoveryprogramsneed“tospeak”tothedrivesdirectlywithoutanyRAIDcontrollers.Therefore,eachdrivemustberemovedandmounteddirectlytotherecoverysystem.
> MostRAIDdatarecoveryprogramscannotworkwithproprietaryformats.ThepartitionmustbeNTFSorEXT2/3.Forexample,theycannotworkwithRAIDconfigurations,suchasBeyondRAIDasusedonDrobodevices.ForthepurposesofRAIDdatarecovery,thesecon-figurationshavetobemanuallyconfigured.
> BeforeyoustartremovingdisksfromafailedRAIDarray,makesurethatyouexaminetheRAIDcontrollerlogtoseewhatorderthedrive(s)failedin.Themoreinformationyouarearmedwiththebetter.> WhenyouareremovingdisksfromaserverorNASdevice,remembertonumberallthedrivescarefully,bearinginmindthatthefirstdrivewillalwaysbelabelled“0”not“1”.Neverattempttochangetheorderofthedisks.
> DonotuseUSBenclosuresforRAIDrebuilds,whichcantakehours.WhenyouusedrivesattachedviaUSBitcantakedays(evenwhenyouuseUSB3.0enclosures).> BeforeyouattempttheRAIDrebuildprocessmakesurethatyouimageallyourdrives.Itisadvisablethatyourundiagnosticsonalldrivesbeforeimagingasfailingdrivesmightnotsurvivetheimagingprocess.
> IfyouneedtofindouttheparametersofyourbrokenRAIDarrayyoucanusethefreeReclaiMetoolavailableatwww.freeraidcovery.com
11
Useful Tools to Prevent Data Loss
Your ultimate toolagainstdata loss isbyhaving a scheduledbackup to several dif-ferent backup me-diums. In turn, thisbackup is verifiedfrequently to makesure that the backupapplication(s) are per-forming the backuptaskscomprehensivelyand maintaining dataintegrity.
However,havingautilitythatpre-warnsyouaboutharddriveproblemswouldbenice. ItsavesITsupporttechniciansandend-usersthetimeandhassleinvolvedindoingacompleterestorationfrombackups.ItisthefunctionofSMARTtohelpgiveusersawarningofimmi-nentfailure.SMARTusuallyworksbycountingread-errors,writefaults,reallocatedsectorsandtemperatureovertime.
The Problem with SMART
Everytimeawarningistriggered,thedrivecanbereturnedforanRMA(returnmerchandiseauthorisation),providing it is stillunderwarranty.Asa result,manufacturershavesetex-tremelyhighthresholdsintheirSMARTfault-detectingalgorithms.IndependentstatisticalanalysisoffaileddriveshasestimatedthatSMARThasapaltryfailuredetectionrateofonly3-10%.Thankfully,third-partyapplicationscanhelpincreasethesedetectionratesbyupto50%withoutanunacceptableleveloffalsealarms.Thereisaplethoraofthesetoolsonthemarket.Notallofthemareworthyofmention.However,Hard Disk Sentinelstandsoutforitsreliabilityandaccuracy.WheninstalledonaWindowsPC,itcangivesufficientwarningthataharddriveisabouttofail.
12
Get your users or customers to remember the LOCKSS Principle
Stanford University in the United Stateshasoneof the leading researchandde-velopment laboratories in the world forInformationTechnology.
Oneoftheirstudiesinvestigatedthebestandmostreliablewaytoarchiveinformationandkeepitsafe.Thebasictenetoftheirresearchfindingsisthis:makelotsofcopiesofyourdataanddistributethemindifferentplaces.Tomakethisprincipleeasytoremember,theycameupwith a simplemnemonic: “LotsofCopiesKeepStuffSafe”or LOCKSS.Users cannowachieve remotebackupmoreeasilywith someexcellentonline storage facilities, suchastheAmazon S3 Cloud.Alternatively,youcouldsimplystoreyourdataontwoseparateharddrivesthatareplacedindifferentlocationsandverifiedonaregularbasis.
13
The Gallery Rescue Lab
RemovalofDriveSpindle
AdiskplatterandHeadDisk
Assemblyinperfectalignment
14
The Gallery Rescue Lab
DriveRescueimagingstation
Examinationof2,5inchPCB
15
Keep Informed and Stay in Touch with Drive Rescue
Have any data recovery questions or issues? Pleasefeelfreetocontactus
Email:[email protected]:1890571571
Forinformationonourcompleterangeofdatarecoveryservicesvisit:www.datarecoverydublin.ie
Keepupdatedandinformedaboutdatarecovery-visitourblogat:www.datarecoveryireland.ie
©Drive Rescue Data Recovery9TrinityStreet,Dublin2,Ireland
www.datarecoverydublin.ie