How your hard drive data is recovered by the experts

how experts save your hard drive data failure crash bug expertdriverecovery

The digital age has brought with it a false sense of security. All of the information on our computers, tablets and hard drives may seem magical, almost immortal. Unlike paper, it does not tear, wrinkle, collect dust or go yellow with age. Instead it remains unchanging and intact, safe from the wear and tear that can so easily destroy physical records.

Until, one day, your hard drive malfunctions. In one moment, everything disappears.

That’s more likely to happen than you might think. A recent study published by Carnegie Mellon University found that twenty percent of mechanical drives fail within their first four years and, surprisingly, just over 5% fail within their first 18 months. And don’t think that solid state drives are a cure-all; the limited testing conducted so far shows them failing at roughly the same rate as mechanical drives, albeit for different reasons.

flashbackdata

All of this means you should back up your data. Now. Yet many people don’t, which provides labs like Flashback Data with no shortage of customers. Located Austin, Texas, Flashback Data handles hundreds of drives every month and is America’s only non-governmental lab to meet the standards set by the American Society of Crime Laboratory Directors. We spoke with Russell Chozick, one of the company’s technicians, to find out how lost data can be retrieved from a seemingly dead drive.

Calling the experts

Expert data recovery can be intimidating at first. The average user, who has no idea how to recover a drive, likely envisions a long, grueling and expensive process. In fact, diagnosing a drive’s problem is usually quick, which is why Flashback Data provides free evaluations. “Most of our techs have been working for years,”  Mr. Chozick says, “so it doesn’t take much to know what is wrong. With certain mechanical failures, they know the problem by smell.” Though mechanical drives are the most common device sent in for recovery, every type of drive imaginable can be serviced, including not just modern solid state drives but also legacy formats like tape drives and floppy disks. Once the evaluation is complete, a report is made available to the customer through an online report, which includes both the diagnosis and a quote. If it’s accepted, data recovery begins; if the customer declines, the drive is simply sent back.

expertdatarecovery-1

Mechanical drives are commonly sent in not only because of their popularity but also because mechanical failure is the leading reason for sudden, disastrous hard drive failure. In most cases, the problem occurs because of age or a defect in the drive rather than any external factor, which means there’s little indication the drive is about to die before it goes belly-up. Accidental damage is less common, but when it does occur, it’s usually the result of a drop or bump instead of a more dramatic event, such as fire or flood. Flashback Data lumps such unintended human-assisted destruction under the category of “user error.”

The security of drives received by Flashback Data is, of course, a major concern. Flashback Data does work not only for individuals, but also corporations and even police departments, none of which want to worry that a stranger might be able to snoop around during the recovery process. The risk of theft or unauthorized access is virtually eliminated through a three-zone security setup of heavy locked doors secured with fingerprint scanners, all of which are monitored by 24-hour surveillance. The last security zone, the laboratory itself, is accessible only through a “man trap” – a connecting room that only permits one door to be open at a time. Deliveries are left in this room and can only picked up by lab staff after the deliveryman has left and closed the door behind him.

expertdatarecovery-6

Even if a ninja did manage to evade the man trap, he’d have a hard time finding anything of use. Drives are only identified by their job number, so it’s impossible to identify a drive without gaining access to the company’s database, which is only open to lab technicians through on-site computers. Jobs sent in for forensic investigation are further secured by another locked area inside the lab, accessible only by a handful of authorized investigators, and drives involved with an investigation are stored in a locked cage with motion sensors that monitor any attempt at entry from below or above.  

Hard drive surgery 

Once a drive is delivered and diagnosed, and the customer has approved the recovery project, the lab team gets to work. What that work involves depends on the drive – and what’s wrong with it.

Many failures are mechanical in nature, and that means recovering data is impossible until the drive has been physically repaired. “When a drive has failed mechanically,” says Chozick, “the first step is to source parts. Usually we have them in house. We typically have between three and four thousand parts on hand and, as needed, we’ll order even more.” Once the parts are obtained, repair begins. Adapters, read/write heads and other components that have stopped functioning are replaced inside a “clean workstation” which keeps dust and other foreign objects out of the open drive. Though this is delicate work, it is second-nature to these experts, who have handled thousands of repairs.

expertdatarecovery-2

Mechanical parts are often the culprit, but electronics can fail, too. The mainboard, for example, can experience issues like faulty soldering or damage from a power surge that fries chips or melts contacts. Problems like these are fixed using a stereoscopic microscope and specialized soldering equipment, a delicate and time-consuming process made more challenging by the small size of modern hardware.

Once a drive is operational, the next step is to image the drive. An exact sector-by-sector copy is made, or at least attempted; bad sectors can interrupt the process. Flashback Data uses conventional desktop PCs with special adapters to make recovery possible. This setup allows lab techs to move forward or backwards through a drive’s sectors to focus on certain data or use custom algorithms to speed up recovery. Mr. Chozick explained that a lab tech might program the hardware to “do a fast pass, and if any slow sectors are hit, skip forward 1,000 sectors and keep going.” This tactic can quickly retrieve large amounts of data. If bad sectors turn out to be an issue, the techs can go back with a slower, more detailed algorithm which searches sector-by-sector for every last bit that’s still intact. Even specific file types, like .jpeg images or .mp3 audio files, can be located using algorithms that search for known file headers.

 expertdatarecovery-3

While mechanical drives are fairly straightforward, flash memory presents a particular challenge. An operational flash drive uses a controller chip to manage data, and if that chip stops working, or is corrupted, sorting through files becomes a long, difficult process of browsing raw hex data in search of anything that looks familiar. Recovery is only possible because experts know how key data structures, such as file tables, look in hex form. Once found, these can be restored, making it possible to recover most data from a drive.

Modern solid state drives are even more difficult to work with because, unlike a flash drive (which may contain just one or two chips), an SSD may contain up to sixteen chips, each of which has separate “dumps” across which data can be split. Technicians must analyze data from each dump and piece it together like a digital jig-saw puzzle. Matters are made more difficult by automatic drive encryption features found on many SSDs which, though they can provide extra security, make normal data recovery impossible. Flashback Data’s experts first have to focus on repairing the controller chip itself, as it’s the only way to decode what’s on the drive. 

Returning the hard drive home

Even with solid state drives, which is the most challenging storage format to work with, success comes more often than not. “In 98 percent of cases the drive is sent back looking exactly like it did before failure,” says Chozick. “All the folders, files will be in the same place.” Even if such in-depth recovery isn’t possible, lab techs can usually find and retrieve individual files by searching through a drive’s data after it has been imaged. The files returned to the customer may be missing their original file name, and may not be organized, but at least they can be returned otherwise intact.

expertdatarecovery

Once recovery is complete, the data is uploaded to a local server, which is not connected to the Internet for security reasons. The customer then receives word of the good news via a notification. Data is returned on a physical drive for security reasons; in most cases a flash drive, though larger jobs may require the use of a mechanical hard drive. While most of Flashback Data’s customers use Windows, the company is happy to return data in whatever format the customer requires, so Mac users aren’t left out in the cold.  For customers, this means retrieving data is a plug-and-play affair.

Of course, once data is retrieved, it should be protected. Though Flashback Data makes money by helping people who don’t have a proper backup, Mr. Chozick was happy to tell us what he thought was most effective for the average user. “I think the easiest backup is an external hard drive running a backup utility. You can’t just rely on yourself to move files regularly. And cloud backup solutions are good, affordable. They protect data from fires, natural disasters and other unexpected events.”

But if you forget, don’t fret. The experts can help – for a fee.

Emerging Tech

Smarter cities need smarter addresses. And you just need 3 words

To make really smart transportation choices, more precise location data will have to be integrated with citywide transportation data. Here’s how one company is mapping the world by using just three words.
Computing

Want to make one hard drive act like two? Here's how to partition in Windows

If you don't want all of your files stored in one place but only have one drive to work with, partitioning is your best way forward. Here's how to partition a hard drive in Windows 10, step by step.
Computing

Recover your beloved data with these great software tools

The best data recovery software isn't always free, but whether you've lost files on a hard drive, SD card, or even physical media like CDs and DVDs, there's a chance they'll be able to get that data back.
Gaming

How to Install an SSD in a PlayStation 4 or PS4 Pro

SSDs are much faster than mechanical hard drives, which is what the PlayStation 4 and PlayStation 4 Pro come with. Here, we show you how to replace it with an SSD, which will allow you to boot to the OS faster and load games quicker.
Computing

How to easily record your laptop screen with apps you already have

Learning how to record your computer screen shouldn't be a challenge. Lucky for you, our comprehensive guide lays out how to do so using a host of methods, including both free and premium utilities, in both MacOS and Windows 10.
Gaming

Want to gift a Steam game so you can play with a friend? Here's how to do it

The holidays may have passed, but it's always a good time to give the gift of gaming (especially when there's a Steam sale)! Here's our quick guide on how to give a Steam game as a gift.
Emerging Tech

Microsoft’s friendly new A.I wants to figure out what you want — before you ask

Move over Siri and Alexa! Microsoft wants to build a new type of virtual assistant that wants to be your friend. Already making waves in Asia, could this be the future of A.I. BFFs?
Computing

Multi-monitor issues? Here's how to resolve them

If you're running into multi-monitor problems, you're not alone. Two screens are very useful, but they can present some difficulties. Here are some common multi-monitor problems and how to fix them.
Computing

Capture screenshots with print screen and a few alternative methods

Capturing a screenshot of your desktop is easier than you might think, but it's the kind of thing you'll probably need to know. Here's how to perform the important function in just a few, easy steps.
Emerging Tech

Awesome Tech You Can’t Buy Yet: A.I. selfie drones, ‘invisible’ wireless chargers

Check out our roundup of the best new crowdfunding projects and product announcements that hit the web this week. You may not be able to buy this stuff yet, but it sure is fun to gawk!
Deals

The best MacBook deals for November 2018

If you’re in the market for a new Apple laptop, let us make your work a little easier: We hunted down the best up-to-date MacBook deals available online right now from various retailers.
Deals

Cyber Monday 2018: When it takes place and where to find the best deals

Cyber Monday is still a ways off, but it's never too early to start planning ahead. With so many different deals to choose from during one of the biggest shopping holidays of the year, going in with a little know-how makes all the…
Computing

All the best deals on Surface products for Black Friday

A number of retailers are discounting Surface devices for Black Friday. Be it the Surface Pro 2017, Surface Pro 6, or the Surface Go, here's a look at how (and where) you can save big on Surface this holiday season.
Smart Home

All the best Amazon Black Friday deals for 2018

Amazon may be an online-only retailer, but that doesn’t mean its Black Friday sales are anything to sniff at. In fact, due to its online status, Amazon has huge flexibility with the range of products and deals it can offer. Here's our…