How your hard drive data is recovered by the experts

how experts save your hard drive data failure crash bug expertdriverecovery

The digital age has brought with it a false sense of security. All of the information on our computers, tablets and hard drives may seem magical, almost immortal. Unlike paper, it does not tear, wrinkle, collect dust or go yellow with age. Instead it remains unchanging and intact, safe from the wear and tear that can so easily destroy physical records.

Until, one day, your hard drive malfunctions. In one moment, everything disappears.

That’s more likely to happen than you might think. A recent study published by Carnegie Mellon University found that twenty percent of mechanical drives fail within their first four years and, surprisingly, just over 5% fail within their first 18 months. And don’t think that solid state drives are a cure-all; the limited testing conducted so far shows them failing at roughly the same rate as mechanical drives, albeit for different reasons.

flashbackdata

All of this means you should back up your data. Now. Yet many people don’t, which provides labs like Flashback Data with no shortage of customers. Located Austin, Texas, Flashback Data handles hundreds of drives every month and is America’s only non-governmental lab to meet the standards set by the American Society of Crime Laboratory Directors. We spoke with Russell Chozick, one of the company’s technicians, to find out how lost data can be retrieved from a seemingly dead drive.

Calling the experts

Expert data recovery can be intimidating at first. The average user, who has no idea how to recover a drive, likely envisions a long, grueling and expensive process. In fact, diagnosing a drive’s problem is usually quick, which is why Flashback Data provides free evaluations. “Most of our techs have been working for years,”  Mr. Chozick says, “so it doesn’t take much to know what is wrong. With certain mechanical failures, they know the problem by smell.” Though mechanical drives are the most common device sent in for recovery, every type of drive imaginable can be serviced, including not just modern solid state drives but also legacy formats like tape drives and floppy disks. Once the evaluation is complete, a report is made available to the customer through an online report, which includes both the diagnosis and a quote. If it’s accepted, data recovery begins; if the customer declines, the drive is simply sent back.

expertdatarecovery-1

Mechanical drives are commonly sent in not only because of their popularity but also because mechanical failure is the leading reason for sudden, disastrous hard drive failure. In most cases, the problem occurs because of age or a defect in the drive rather than any external factor, which means there’s little indication the drive is about to die before it goes belly-up. Accidental damage is less common, but when it does occur, it’s usually the result of a drop or bump instead of a more dramatic event, such as fire or flood. Flashback Data lumps such unintended human-assisted destruction under the category of “user error.”

The security of drives received by Flashback Data is, of course, a major concern. Flashback Data does work not only for individuals, but also corporations and even police departments, none of which want to worry that a stranger might be able to snoop around during the recovery process. The risk of theft or unauthorized access is virtually eliminated through a three-zone security setup of heavy locked doors secured with fingerprint scanners, all of which are monitored by 24-hour surveillance. The last security zone, the laboratory itself, is accessible only through a “man trap” – a connecting room that only permits one door to be open at a time. Deliveries are left in this room and can only picked up by lab staff after the deliveryman has left and closed the door behind him.

expertdatarecovery-6

Even if a ninja did manage to evade the man trap, he’d have a hard time finding anything of use. Drives are only identified by their job number, so it’s impossible to identify a drive without gaining access to the company’s database, which is only open to lab technicians through on-site computers. Jobs sent in for forensic investigation are further secured by another locked area inside the lab, accessible only by a handful of authorized investigators, and drives involved with an investigation are stored in a locked cage with motion sensors that monitor any attempt at entry from below or above.  

Hard drive surgery 

Once a drive is delivered and diagnosed, and the customer has approved the recovery project, the lab team gets to work. What that work involves depends on the drive – and what’s wrong with it.

Many failures are mechanical in nature, and that means recovering data is impossible until the drive has been physically repaired. “When a drive has failed mechanically,” says Chozick, “the first step is to source parts. Usually we have them in house. We typically have between three and four thousand parts on hand and, as needed, we’ll order even more.” Once the parts are obtained, repair begins. Adapters, read/write heads and other components that have stopped functioning are replaced inside a “clean workstation” which keeps dust and other foreign objects out of the open drive. Though this is delicate work, it is second-nature to these experts, who have handled thousands of repairs.

expertdatarecovery-2

Mechanical parts are often the culprit, but electronics can fail, too. The mainboard, for example, can experience issues like faulty soldering or damage from a power surge that fries chips or melts contacts. Problems like these are fixed using a stereoscopic microscope and specialized soldering equipment, a delicate and time-consuming process made more challenging by the small size of modern hardware.

Once a drive is operational, the next step is to image the drive. An exact sector-by-sector copy is made, or at least attempted; bad sectors can interrupt the process. Flashback Data uses conventional desktop PCs with special adapters to make recovery possible. This setup allows lab techs to move forward or backwards through a drive’s sectors to focus on certain data or use custom algorithms to speed up recovery. Mr. Chozick explained that a lab tech might program the hardware to “do a fast pass, and if any slow sectors are hit, skip forward 1,000 sectors and keep going.” This tactic can quickly retrieve large amounts of data. If bad sectors turn out to be an issue, the techs can go back with a slower, more detailed algorithm which searches sector-by-sector for every last bit that’s still intact. Even specific file types, like .jpeg images or .mp3 audio files, can be located using algorithms that search for known file headers.

 expertdatarecovery-3

While mechanical drives are fairly straightforward, flash memory presents a particular challenge. An operational flash drive uses a controller chip to manage data, and if that chip stops working, or is corrupted, sorting through files becomes a long, difficult process of browsing raw hex data in search of anything that looks familiar. Recovery is only possible because experts know how key data structures, such as file tables, look in hex form. Once found, these can be restored, making it possible to recover most data from a drive.

Modern solid state drives are even more difficult to work with because, unlike a flash drive (which may contain just one or two chips), an SSD may contain up to sixteen chips, each of which has separate “dumps” across which data can be split. Technicians must analyze data from each dump and piece it together like a digital jig-saw puzzle. Matters are made more difficult by automatic drive encryption features found on many SSDs which, though they can provide extra security, make normal data recovery impossible. Flashback Data’s experts first have to focus on repairing the controller chip itself, as it’s the only way to decode what’s on the drive. 

Returning the hard drive home

Even with solid state drives, which is the most challenging storage format to work with, success comes more often than not. “In 98 percent of cases the drive is sent back looking exactly like it did before failure,” says Chozick. “All the folders, files will be in the same place.” Even if such in-depth recovery isn’t possible, lab techs can usually find and retrieve individual files by searching through a drive’s data after it has been imaged. The files returned to the customer may be missing their original file name, and may not be organized, but at least they can be returned otherwise intact.

expertdatarecovery

Once recovery is complete, the data is uploaded to a local server, which is not connected to the Internet for security reasons. The customer then receives word of the good news via a notification. Data is returned on a physical drive for security reasons; in most cases a flash drive, though larger jobs may require the use of a mechanical hard drive. While most of Flashback Data’s customers use Windows, the company is happy to return data in whatever format the customer requires, so Mac users aren’t left out in the cold.  For customers, this means retrieving data is a plug-and-play affair.

Of course, once data is retrieved, it should be protected. Though Flashback Data makes money by helping people who don’t have a proper backup, Mr. Chozick was happy to tell us what he thought was most effective for the average user. “I think the easiest backup is an external hard drive running a backup utility. You can’t just rely on yourself to move files regularly. And cloud backup solutions are good, affordable. They protect data from fires, natural disasters and other unexpected events.”

But if you forget, don’t fret. The experts can help – for a fee.

Cars

Lyft and Aptiv’s self-driving car program has come a long way (but not far enough)

Many companies talk about self-driving cars, but Lyft and Aptiv are already using a fleet of them to transport paying customers in Las Vegas. Hop in for a close look at the tech of autonomous cars, and the challenges they face.
Computing

Delete tracking cookies from your system by following these quick steps

Cookies are useful when it comes to saving your login credentials and other data, but they can also be used by advertisers to track your browsing habits across multiple sites. Here's how to clear cookies in the major browsers.
Computing

How to share an external hard drive between Mac and Windows

Compatibility issues between Microsoft Windows and Apple MacOS may have diminished sharply over the years, but that doesn't mean they've completely disappeared. Here's how to make an external drive work between both operating systems.
Computing

Is your PC slow? Here's how to restore Windows 10 to factory settings

Computers rarely work as well after they accumulate files and misconfigure settings. Thankfully, with this guide, you'll be able to restore your PC to its original state by learning how to factory reset Windows.
Computing

Watch out for these top-10 mistakes people make when buying a laptop

Buying a new laptop is exciting, but you need to watch your footing. There are a number of pitfalls you need to avoid and we're here to help. Check out these top-10 laptop buying mistakes and how to avoid them.
Computing

Don't spend a fortune on a PC. These are the best laptops under $300

Buying a laptop needn't mean spending a fortune. If you're just looking to browse the internet, answer emails, and watch Netflix, you can pick up a great laptop at a great price. These are the best laptops under $300.
Product Review

LG Gram 14 proves 2-in-1 laptops don’t need to sacrifice battery for light weight

The LG Gram 14 2-in-1 aims to be very light for a laptop that converts to a tablet. And it is. But it doesn’t skimp on the battery, and so it lasts a very long time on a charge.
Computing

Dell XPS 13 vs. Asus Zenbook 13: In battle of champions, who will be the victor?

The ZenBook 13 UX333 continues Asus's tradition of offering great budget-oriented 13-inch laptop offerings. Does this affordable machine offer enough value to compete with the excellent Dell XPS 13?
Gaming

Take a trip to a new virtual world with one of these awesome HTC Vive games

So you’re considering an HTC Vive, but don't know which games to get? Our list of 25 of the best HTC Vive games will help you out, whether you're into rhythm-based gaming, interstellar dogfights, or something else entirely.
Computing

The Asus ZenBook 13 offers more value and performance than Apple's MacBook Air

The Asus ZenBook 13 UX333 is the latest in that company's excellent "budget" laptop line, and it looks and feels better than ever. How does it compare to Apple's latest MacBook Air?
Computing

AMD Radeon VII will support DLSS-like upscaling developed by Microsoft

AMD's Radeon VII has shown promise with early tests of an open DLSS-like technology developed by Microsoft called DirectML. It would provide similar upscale features, but none of the locks on hardware choice.
Computing

You could be gaming on AMD’s Navi graphics card before the end of the summer

If you're waiting for a new graphics card from AMD that doesn't cost $700, you may have to wait for Navi. But that card may not be far away, with new rumors suggesting we could see a July launch.
Computing

Is AMD's Navi back on track for 2019? Here's everything you need to know

With a reported launch in 2019, AMD is focusing on the mid-range market with its next-generation Navi GPU. Billed as a successor to Polaris, Navi promises to deliver better performance to consoles, like Sony's PlayStation 5.
Computing

Cortana wants to be friends with Alexa and Google Assistant

Microsoft no longer wants to compete against Amazon's Alexa and Google's Assistant in the digital assistant space. Instead, it wants to transform Cortana into a skill that can be integrated into other digital assistants.