LOGICAL DATA RECOVERY
MASTER BOOT RECORD FAILURE: The Master Boot Record, or MBR, is located at the first sector of a hard disc drive. When the MBR becomes corrupt or inaccessible, it will give the operating system incorrect booting instructions. As a result, a hard drive will not boot. The most common reasons for MBR malfunction are power surges, improper shutdown, viruses and other malware attacks.
DELETED DATA: Deleted data is one of the most common causes of Logical Hard Disc Failure. Deletion, formatting, or incorrect partitioning of a hard drive can occur due to both system error or human error. Once you click the DELETE button, you will not be able to access that file. However, it does not mean complete deletion of data from the hard drive platters. Normally, deleted data can still be recovered unless the area of a hard drive where this data is physically located is overwritten and occupied by new files.
OS ERRORS: Operating System errors or registry damage can also be a cause of Logical Failure. They may result from virus attacks, contaminated applications, improper shutdowns or numerous other reasons.
IMPROPER SHUTDOWN: Improper shutdown of the computer can be a cause of data loss. It can happen both intentionally (i.e. pressing and holding the power button, or pulling the plug) or accidentally if power surge or outage occurs.
IMPROPER USE OF SPECIAL SOFTWARE: Improper use of special software, such as disk partition utilities, disk repair utilities, formatting tools, and other software that is not intended for unprofessional use can cause Logical Damage and data loss.
Logical Recovery is the least expensive problem to deal with, and the success rate is considerably high. However, any attempt to retrieve the files without proper skills and equipment may reduce the chance for effective results. If you have experienced data loss, please do not attempt to perform the data recovery yourself. Make sure to disconnect your storage device or computer and avoid any kind of operations to it.
PHYSICAL NON-INVASIVE DATA RECOVERY
FIRMWARE CORRUPTION: Hard Drives contain a set of service data called firmware that controls its hardware and is vital for its proper functioning. The firmware can be compared to the Operating System installed on your computer. Just like an Operating System allows your computer to run a certain application, the firmware allows all parts of a hard drive to operate smoothly and provides access to drives contents. Firmware codes are located in the service area of the hard drive on data platters and in the ROM (Read-only Memory) of the PCB (Printed Circuit Board). If the firmware becomes corrupt, the drive will fail even if its electronic and mechanical components are fully functional. Common causes of firmware failure include failed firmware update attempts, unskillful use of professional software not intended for personal use, virus attacks, self-corruption due to excessive and prolonged use, to name a few. Some general symptoms of firmware corruption include failure to recognize a hard drive in the BIOS or the computer freezing up at startup.
BAD SECTORS: Quite often our experts have to perform data recovery on hard drives affected by large amounts of damaged unreadable sectors. A Hard Drive that has numerous bad sectors is not able to operate properly: it slows down dramatically, and may cause various error messages including the “blue screen of death”. Sometimes the Hard Drive disappears or shows unreadable volumes under “My Computer". It may also make occasional clicking sounds. This problem can affect any Hard Drive regardless of type, brand, model and size.
Please note that it is very dangerous to use “over-the-counter” software to cure this problem. In most cases it will simply kill the Hard Drive completely before you get access to your precious data! Bad sectors tend to develop catastrophically and without proper handling they will eventually cause a head crash or even unrecoverable rotational scoring of the data platters.
Data recovery from drives affected by bad sectors is performed by using very sophisticated (and expensive!) professional data recovery tools. Unlike simple sector-by-sector imagers these intelligent tools are able to avoid damaged areas as much as possible, selectively targeting critical file system objects (boot sectors, bitmaps, master file tables, catalog files or superblocks) to get immediate access to most important user’s files and carefully extract them.
ELECTRONIC FAILURE: Hard Drives contain a number of electronic components that are vital to its proper and accurate functioning. These components are located on the PCB (Printed Circuit Board). They control all hard drive operations including communication with the PC, positioning read-write heads, reading stored data, and copying new files. Malfunction of any electronic part will result in a hard drive failure. Electronic failure is very common and can occur on both new and old drives. The causes are power outages, electrical surges, static electricity, use of incompatible or faulty power supplies, storage at improper conditions, such as at extremely high or low temperatures, and more. The first sign of a possible hard drive electronic failure is its failure to power on. The hard drive will appear completely dead without any noise coming from the inside. It won’t be able to spin. Sometimes you might smell a burning smell. If you experience any of the above signs immediately disconnect your drive from a power supply unit. Please do not try to disassemble the drive and attempt to do a recovery yourself! The data recovery process may include un-soldering and soldering faulty chips from the PCB or replacing the PCB as necessary.
PHYSICAL INVASIVE DATA RECOVERY
Since hard drives are mechanical devices, they will eventually fail. Mechanical failure arises when one of the internal components becomes faulty. As a result a drive won’t be able to access the data stored on it. It might even power on and attempt to spin making a repeating clicking, scraping, or grinding sound, often called “click of death”. This sound occurs when a head is scratching the platter making your data inaccessible. In some cases mechanical failure occurs because of worn out parts. In most cases it happens because of mishandling, such as accidental dropping of a hard drive, sitting or stepping on it, liquid spillage, etc. Recovering data from mechanically failed hard drives requires disassembling, investigating, and repairing the drive in a Clean Room.
HEAD CRASH: A head crash occurs when a hard drive’s read-write heads come in contact with rotating magnetic platters. Normally heads are flying over the surfaces on a thin layer of air and are not supposed to touch the rotating platters unless they are within specially designed parking areas of a platter. When such accidental impact happens (usually due to shock, drops, or electrical surges) both magnetic heads and surfaces might be seriously damaged or even completely destroyed. After the initial crash, particles from the damaged area can land on other areas of the platters causing secondary crashes and causing even more damage, occasionally rendering the drive unrecoverable. The symptom of a head crash is the infamous “click of death” – damaged magnetic heads being unable to read calibration servo tracks from platters are making repetitive clicking sounds while trying to re-calibrate. Head crash can happen to any hard drive regardless of type, brand, model or size. Data recovery from drives affected by a head crash is performed by replacing of the magnetic head assembly with a compatible one taken from a donor drive of the same make and model. Usually after a head crash, a hard drive’s magnetic surfaces have large amounts of bad sectors so data must be extracted extremely carefully with the help of professional data recovery tools.
SEIZED MOTOR: This problem is pretty common with certain hard drive manufacturers. The Drive’s spindle will not spin up making a distinctive buzzing or humming sound on power-up. The reason for the drive’s spindle being stuck is either bent/damaged axis or partial destruction of the sleeve bearing. Usually drives don’t get stuck by themselves but due to some mechanical impact (even a minor shock). The fact that some drives are significantly more subject to spindle seizure than others indicates flaws in motor design, they are simply not enough “shock-proof”. Drives affected by seized motors are not registered in computer’s OS and not visible in the BIOS. Data recovery from seized spindle drives is usually performed by replanting magnetic platters from original drive into a compatible donor drive.
HEAD STICTION: This problem is a result of physical shock and drops and sometimes power surges and outages. Both heads and surfaces are super finely polished so when they accidentally come into a contact (normally heads are flying over the surface on a thin layer of air) they are getting stuck together by force of molecular attraction. A Hard Drive that is affected by head stiction is not registered in computer’s OS and not visible in the BIOS. Typically, this issue affects laptop models (1.8 and 2.5 inches, all manufacturers). Desktop models have much more powerful motors so head stiction is less common. The symptom of head stiction is faint humming sound upon the drive’s power-up. Data recovery from drives affected by head stiction problem is usually performed by proper unsticking heads from surfaces with the help of special tools, sometimes head assembly replacement is needed.
DATA RECOVERY FROM FLASH & SOLID STATE DRIVES
Flash media devices are much more reliable than traditional hard drives, mainly due to the fact that they have no moving parts inside and this makes them less vulnerable to shocks and drops. Most flash media manufacturers rate their devices at 10,000 to 100,000 write/erase cycles. With normal use, USB sticks, camera cards and SSD drives can last for up to a decade without showing signs of memory wear.
Typical reasons for Flash Media Failures:
• Damage from malicious software – viruses, trojan horses and other malicious programs. [Recovery Type: Logical Data Recovery]
• Accidental file deletion or reformatting, which is often human error. [Recovery Type: Logical Data Recovery]
• File corruption, which is usually due to unsafe device removal. [Recovery Type: Logical Data Recovery]
• Damage from physical impacts (broken connectors or microchips). [Recovery Type: Controller Repair or NAND Chip-Off Data Recovery]
• Overheating. [Recovery Type: Controller Repair or NAND Chip-Off Data Recovery]
• Electrical damage (power surges or electrostatic discharges). [Recovery Type: Controller Repair or NAND Chip-Off Data Recovery]
Data Recovery from failed flash media is usually performed by direct extraction of memory dumps from NAND microchips (professional data recovery tools being used) with subsequent reconstruction of logical volume. Sometimes damaged connector or electronic circuitry needs to be repaired.
DATA RECOVERY FROM RAID ARRAYS
RAID stands for Redundant Array of Independent (originally – Inexpensive) Disks. Redundancy means that the same data is stored in different places of multiple hard drives combined into a single logical unit (ironically, one of the most popular RAID configurations – RAID-0 has no redundancy). This storage technology allows to avoid data loss if one (or even more than one) of the hard drives fails. Many people believe that RAID should not fail, as a result of overemphasis of RAID’s fault tolerance and auto rebuilt functions. In reality, RAIDs can fail and this happens quite often. Typical reasons for RAID failures are:
- Controller malfunction
- Physical failure of multiple disks
- RAID auto rebuild error
- Human error (most often – improper reconfiguration)
- Logical corruption of RAID volume
Data Recovery from failed RAIDs is performed by proper reconstruction of virtual RAID volumes with the help of professional data recovery tools. Prior to the reconstruction, physically failed hard drive members of RAID arrays might need to be repaired (sometimes clean room required), sector-by-sector images of all drives must be created.
There are numerous types of RAID arrays and they are as follows:
RAID-0: This technique has striping (chunks of data are spread across the drives) but no redundancy. It offers the best performance but no fault-tolerance.
RAID-1: This type is also known as disk mirroring and consists of at least two drives that duplicate each other. There is no striping. Read performance is improved since either disk can be read at the same time. Write performance is the same as for single disk storage. RAID-1 provides high performance and best fault-tolerance.
RAID-2: This type uses striping across disks with some disks storing error checking and correcting information.
RAID-3: This type uses striping and dedicates one drive to storing parity information.
RAID-4: This type uses large stripes, which means you can read records from any single drive.
RAID-5: Uses rotating parity, requires at least three drives for the array.
RAID-6: This type is similar to RAID-5 but includes a second parity scheme that is distributed across different drives and thus offers extremely high fault- and drive-failure tolerance.
RAID-7: This type implements a real-time embedded operating system as a controller, caching via a high-speed bus.
RAID-10: Combining RAID-0 and RAID-1 is often referred to as RAID-10, which offers higher performance than RAID-1 but at much higher cost. There are two subtypes: In RAID-0+1, data is organized as stripes across multiple disks, and then the striped disk sets are mirrored. In RAID-1+0, the data is mirrored and the mirrors are striped.
RAID-50 (OR RAID-5+0): This type consists of a series of RAID-5 groups and striped in RAID-0 fashion to improve RAID-5 performance without reducing data protection.
RAID-53 (OR RAID-5+3): This type uses striping (in RAID-0 style) for RAID-3′s virtual disk blocks. This offers higher performance than RAID-3 but at much higher cost.
RAID-S (ALSO KNOWN AS PARITY RAID): This is a proprietary method for striped parity RAID from EMC Symmetrix that is no longer in use on current equipment. It appears to be similar to RAID-5 with some performance enhancements.
DATA RECOVERY FROM OPTICAL DISCS (CD & DVD)
CD (Compact Disc) and DVD (Digital Versatile Disc) media are common optical formats for storing music, video, photos and data files. Manufacturers claim that CD and DVD media should, when stored properly in a controlled environment, hold data for 100 years or longer. However, they are extremely susceptible to environmental and handling problems, the most common being fingerprints, smears and scratch damage.
Unlike magnetic media, CD and DVD media use reflected patterns to optically interpret recorded data. CD-R (Compact Disc - Recordable) media allows a single, one-time write operation to be performed by a laser that heats a layer of organic dye. The laser heats the dye creating permanent "pits" in the recording layer. Another layer of plastic fills these voids and creates the reflective pattern that is then read by the drive. This type of write process is permanent and the media cannot be reused. CD-R media can be read in most CD and DVD drives.
CD-RW (Compact Disc - Read / Write) media can be written, erased and overwritten many times over. Unlike the dye recording layer found in CD-R disks, the CD-RW recording layer is made of various metal alloys. When heated, the targeted areas will change from a crystalline, highly-reflective state to a non-crystalline, less-reflective (or amorphous) state. This non-crystalline pattern is then read by the CD-RW drive as data. To erase data, the laser heats the selected area (similar to a CD-R drive) and returns the area to crystalline condition. During an overwrite operation, the laser performs both operations at the same time - writing new data while erasing the older recording.
DVD-R and DVD-RW represent enhancements to both the capacity and the technology used with recordable CD media. DVD-R media is very similar to CD-R in that it also uses an organic dye technology for recording. DVD-RW media utilizes a phase-change technology, similar to CD-RW, that allows many hundreds of write, erase and overwrite operations over the life of the media.
When data loss occurs with recorded optical media, there can be many reasons. Many times, errors develop during the write process itself. If a recording session does not close properly, or is aborted before it has chance to close, the data already written to the disk may be inaccessible. Selection of the correct media is important as well. Data should always be written using media that has a speed rating that is appropriate for the drive being used. Using generic (non-brand name) media, or media not rated for the speed you will be recording at, can lead to recording problems during a write session or read problems later on.
Examine the disk for any scratches, smears, warping, or other physical problems. Many read problems with previously recorded media are simply due to fingerprints that distort the ability of the laser to accurately read the disk.
If the data is critical, professional data recovery may be the best solution Technical Difficulties is experienced in optical technologies and we will initially examine the media for any handling or physical damage. Tools and techniques are then employed that allow for a thorough analysis of the recorded pattern at the block level of the format. By identifying the best representation of the recorded signal, precise and accurate extraction and retrieval of previously recorded data can be achieved.
