Case Study: Hard Drive Data Recovery

It’s always easiest to explain and demonstrate the issues involved in data recovery by looking at a real-life example of our work. Here, you’ll see what’s involved in a typical case, how we differ from typical “guy in bedroom/small shop” data recovery services, why we charge a little more than them- and why we’re more than worth it!

This particular case started with a customer bringing a faulty external hard drive to us. The problem was very simple- the drive wasn’t being detected by the OS (in this case, Windows) at all and the data was important to the customer.

Since this was an external USB hard drive, our first instinct was to check whether the fault lay with the USB converter. While a few models have the USB interface attached directly to the drive itself, it turns out that- once you remove the outside case- most external hard drives are really just regular internal drives with a SATA-to-USB converter attached. That was the case here, and it’s actually preferable, because if the USB interface develops a fault, you can still connect the drive directly to a computer’s internal SATA interface and read it that way.

Unfortunately, even after doing this, the drive still wasn’t being detected at all by the computer. At this stage, many so-called data recovery services would have to give up as they don’t have the advanced tools and knowledge that we have to overcome this problem.

Using our specialised data recovery machine, we could see that the drive was in fact detectable at a basic level- however, it was constantly telling the computer that it was in a BUSY state, so the OS wasn’t able to read the drive. We listened to the noise that the drive was making, and from this could determine that the read/write head was stuck, most likely over the platter.

To confirm this, and to proceed further, we needed to take the drive mechanism into our clean room for disassembly. (Many data recovery companies don’t have these, and won’t even try because disassembling a hard drive outside a specialised clean room is a really, really bad idea! Drive heads float incredibly close to the drive surface itself, and at a typical 5400 or 7200 RPM (i.e. linear head speed of up to 75 MPH), even a small speck of dirt can cause a massive and irreparable head crash.)

Once we had the internal drive itself open, we could see that the head was indeed stuck over the platter. We also noticed a small scratch on the platter (which can be seen on the pictures) and guessed this may be the cause of the head stick. (Note that we could only see the top platter; there may well have been more damage underneath).

Firstly, we had to free the head so that it could read properly and wasn’t just throwing back BUSYs at the PC (and thus could be detected normally by the computer).

Now that this had been done and the drive was in a working but degraded state, the first thing we wanted to do was image as much as possible of the contents of this faulty hard drive onto a good one. Since we may only have one chance of doing this, we want to get as much information off in as little time as possible.

In order to do the best job with the limited opportunity available, we connected the drive to our hardware-based imager. This model is industry-standard, of the type that every reputable company in the data recovery business would own.

While the hardware itself is controlled via a PC, it’s significantly more powerful, flexible and safer than plugging the drive directly into the computer’s regular SATA interface. (It’s also significantly more expensive, so you won’t see every two-bit Tom, Dick and Harry “recovery” service using one).

• For example, we can power-cycle the drive without losing the current read position.
• Another problem when scanning a drive with PC-based software is that it can also slow down or get completely stuck while reading bad sectors– this can sometimes crash the software, losing all the data recovered. Our hardware-based imager supports multiple passes, scanning and recovering all the good sectors quickly and then coming back for the bad ones on later passes. Thus we stand a much better chance of recovering more information from the drive.
• Another problem with software-based recovery is that it tends to be based around blocks or clusters, with the whole block being dropped, even if only one sector within it is bad. Our hardware-based device can easily recover data at the level of individual drive sectors, so only those specifically bad sectors will be dropped. Again, this increases the amount of data that can be recovered.
• The specialised hardware also makes it much easier to read and access service areas of the drive that are usually inaccessible without sending special commands to the drive.
• Our hardware-based system connects directly to the drive using its own custom built-in SATA interfaces, rather than having to tolerate or work around the limitations of the standard built-in SATA interfaces and computer BIOS that don’t always offer the fine-grained control required for serious data recovery. Hardware connects direct to the drive; if you connect an HDD to your computer, computer connects through BIOS to ATA controller to hard drive. Our hardware communicates straight from the hardware to the hard drive.

After we’d been running our recovery system for a while, we could see that the drive was struggling to read. Since time and chances are limited, and we didn’t want to risk this further, we weren’t able to successfully image the entire drive. The drive was relatively full, but the customer didn’t require all the data back, only a few folders. This is fortunate, as the drive was in very poor condition. Thus, we prioritised getting those important folders back first, attempting to recover the rest of the data afterwards.

Once we had recovered much of the data, we could see the file structure and select the files and folders that the customer required back. This wasn’t as straightforward as simply selecting the files and copying them off the image drive- it was still necessary to experiment with device settings and configurations to determine which ones were required to get the data back.

This final part of the process itself took a significant amount of time.

Without the appropriate skill, experience and tools, it would have been impossible for another company or the average person to get any of the data back. In fact, as we said earlier on, many non-specialist companies would have got stuck right at the start when the drive wasn’t recognised by Windows. They might never have even realised why!

Opening the drive without a clean room would have significantly reduced the chances of data recovery due to dust or dirt getting onto the platter.
The customer was fortunate that the head was stuck on the platter. If he’d taken it elsewhere first, and they’d connected it multiple times to a computer (in order to have it be seen), the head may have moved and damaged more data.

If the problem had been logical corruption of the drive filesystem or catalogue, connecting it directly to Windows could have caused more recoverable data to be overwritten by logs, housekeeping or other data, even if the user did nothing to it. Hard drives will also perform housekeeping if idle for a certain amount of time- again, this is a bad idea if the drive is in a corrupt or damaged state. Dedicated hardware-based recovery systems will not allow this to happen.

This is why it’s important not to trust your data to any old “recovery service” without knowing their credentials. Even if you’d intended bringing it to us later if things didn’t work out, it’s all too easy for them to have already caused further damage and reduced the chances of recovery.

We’re not the absolute cheapest out there. There’s always going to be at least one guy operating out of his bedroom or kitchen advertising “data recovery” through Facebook or Gumtree. He’ll be cheap- and you’ll get what you pay for! As we said, there’s a good chance this guy wouldn’t even have got past the “drive not recognised” stage above, or he might already have messed up the hard drive further. It’s unlikely he has the skills or years of experience our technicians have, and far less likely still that he has specialised recovery hardware or a clean room facility.

For basic, everyday data recovery we believe that we charge a fair and competitive price for a professional and efficient service. For cases involving more complex, hardware-based issues like the one above; yes, this will cost more, but our typical rates compare extremely favourably against professional recovery services. Compare us against them and you may be pleasantly surprised.

Need to know more? Please telephone or contact us to find out about our services and typical pricing.