The secretive world of "data recovery".

~~pawn3d~~ · 09-06-2008, 09:18 PM

I've watched all the Toorcon videos on YouTube twice, but I haven't got a single definitive answer of the exact step by step procedure. Everybody seems to have a different answer.

SCENARIO I: External Hard Drive Crash.
If you connect a 250-300GB HD as a slave drive via IDE and it shows up under Disk Management as unallocated and it doesn't have a letter, what do you do? People say "oh run Recover My Files" but don't you run a huge risk of permanently damaging the drive in those exhausting scans?

SCENARIO II: Click of Death.
If the hard drive is clicking, what good will Recover my files do when it won't mount or even show up in the Disk Management?

Scott Moulton talks about replacing the controller. How do you know when it's time to do that?

He also talks about cloning a drive using a utility that skips bad sectors. Exactly, what apps for Windows or Mac is he talking about?

Those videos were great, but he left me hanging. I need definitive answers.

~~pawn3d~~ · 09-06-2008, 11:16 PM

Should I be running Ddrescue on a Linux computer?

**blah789** · 09-07-2008, 01:14 AM

Not sure about scenario I. I'd take it step by step though. First make sure there aren't any physical problems (clicks/screeching sounds); I think data recovery people have more sophisticated tools for that - I know EasyRecovery Professional has a hardware diagnostics tool that's pretty good (I wonder if it actually tries to read servo sectors to make sure the heads align properly at various locations on the platter - just a wild guess though) - but there's probably tons of other tools out there I don't know about. And the data recovery ppl can open the drive if they want to - they have clean rooms after all.
Then I'd try running testdisk - see if there's any partition information, if there's a file system detected (usually unallocated can mean the partition information is gone or damaged); usually if the file system is detected, you can infer from it the start point and endpoints of the partition and rebuild the partition table. It would be my best guess as to how testdisk or other partition recovery tools work.
Scenario II is bad. Constant clicking usually indicates the head can't read (or find) what it's looking for, and it keeps recalibrating itself (hence the clicking). What actually happens is unclear - it could be the mechanism for calibrating the actuator arm isn't working so the head isn't aligned properly (could be physical damage, or maybe firmware errors), or it could mean the disk surface is damaged (unreadable).
If the error is physical, software programs probably won't do much good.
Data recovery folks usually tons of spare material they get from ebay or elsewhere, so they can do a number of things on physically damaged drive (you've prob seen it on the youtube videos). They can replace the PCB at the bottom (simplest scenario). They can replace other parts (for example the heads). They can even move the platters from the bad drive to a new. The last two have to be done in clean rooms though.

Dunno about controller replacement.

Well, bad sectors are skipped by default. Once a sector is marked as bad by Windows (or any other OS), the OS won't try to read nor write to it anymore.
I think what he may be talking about is "hard to read" sectors - like those that have CRC errors or lost some of their ability to retain their magnetic charge. When Windows encounters those it may retry reading it a certain number of times, and if it can't, it'll mark it as bad. Sometimes you need the data under there, but if you read it too many times, you could make it worse (from wear). I think what he's talking about is special programs that skip hard-to-read sectors on the first pass, and incrementally increase the threshold for future passes. I stumbled upon this page once http://www.deepspar.com/products-ds-disk-imager.html and watched the video. It's a totally wild guess that it's what Moulton is talking about. I think ddrescue, which you mentioned in the following post, may work that way. Also a guess.

As for definitive answers, I doubt he'll give them all. I mean some of these are secret of the trade...

I do agree they charge too much (especially for trivial problems like simple logical errors that can be fixed with testdisk or similar tools - did you remember his comment about Macs having a very simple, yet common problem, but it was purely logical, and it wasn't easily solvable to the average Mac users because they didn't have utilities available to them).
It might be because of the cost to build and maintain the clean room though. Keeping those rooms particle-free costs millions. But they allow you to do stuff you just couldn't do without them.

Fun stuff if you have time to kill (and data recovery interests you):
http://www.astro.ufl.edu/~ken/crash/index.html
http://forum.hddguru.com/some-fun-stuff-t7115.html
http://forum.hddguru.com/check-this-out-t7088.html
Actually those make me cringe and hold on to my balls. I most certainly wouldn't wish that on anyone. I think the most spectacular ones are when the head crashes and starts scraping the magnetic coating off the platter.

~~pawn3d~~ · 09-07-2008, 08:09 AM

i heard i could make a cleanbox out of tupperware and most repairs can be done if you work fast.

**blah789** · 09-07-2008, 09:09 AM

In one of the videos moulton does say you can make a cleanroom using household equipment. There's also other tips if you google, but I wouldn't trust them too much to say they're particle-free.
I also don't think the tupperware solution is a handy one for a company that has lots of drives to repair.

09-06-2008, 09:18 PM	#1 (permalink)
~~pawn3d~~ Troubled Join Date: Apr 2008 Location: New Orleans Posts: 34 OS: xp	The secretive world of "data recovery". I've watched all the Toorcon videos on YouTube twice, but I haven't got a single definitive answer of the exact step by step procedure. Everybody seems to have a different answer. SCENARIO I: External Hard Drive Crash. If you connect a 250-300GB HD as a slave drive via IDE and it shows up under Disk Management as unallocated and it doesn't have a letter, what do you do? People say "oh run Recover My Files" but don't you run a huge risk of permanently damaging the drive in those exhausting scans? SCENARIO II: Click of Death. If the hard drive is clicking, what good will Recover my files do when it won't mount or even show up in the Disk Management? Scott Moulton talks about replacing the controller. How do you know when it's time to do that? He also talks about cloning a drive using a utility that skips bad sectors. Exactly, what apps for Windows or Mac is he talking about? Those videos were great, but he left me hanging. I need definitive answers.

09-06-2008, 11:16 PM	#2 (permalink)
~~pawn3d~~ Troubled Join Date: Apr 2008 Location: New Orleans Posts: 34 OS: xp	Re: The secretive world of "data recovery". Should I be running Ddrescue on a Linux computer?

09-07-2008, 01:14 AM	#3 (permalink)
blah789 TSF Enthusiast Join Date: Aug 2008 Posts: 2,306 OS: Windows 2000 SP4 and Windows XP SP3	Re: The secretive world of "data recovery". Not sure about scenario I. I'd take it step by step though. First make sure there aren't any physical problems (clicks/screeching sounds); I think data recovery people have more sophisticated tools for that - I know EasyRecovery Professional has a hardware diagnostics tool that's pretty good (I wonder if it actually tries to read servo sectors to make sure the heads align properly at various locations on the platter - just a wild guess though) - but there's probably tons of other tools out there I don't know about. And the data recovery ppl can open the drive if they want to - they have clean rooms after all. Then I'd try running testdisk - see if there's any partition information, if there's a file system detected (usually unallocated can mean the partition information is gone or damaged); usually if the file system is detected, you can infer from it the start point and endpoints of the partition and rebuild the partition table. It would be my best guess as to how testdisk or other partition recovery tools work. Scenario II is bad. Constant clicking usually indicates the head can't read (or find) what it's looking for, and it keeps recalibrating itself (hence the clicking). What actually happens is unclear - it could be the mechanism for calibrating the actuator arm isn't working so the head isn't aligned properly (could be physical damage, or maybe firmware errors), or it could mean the disk surface is damaged (unreadable). If the error is physical, software programs probably won't do much good. Data recovery folks usually tons of spare material they get from ebay or elsewhere, so they can do a number of things on physically damaged drive (you've prob seen it on the youtube videos). They can replace the PCB at the bottom (simplest scenario). They can replace other parts (for example the heads). They can even move the platters from the bad drive to a new. The last two have to be done in clean rooms though. Dunno about controller replacement. Well, bad sectors are skipped by default. Once a sector is marked as bad by Windows (or any other OS), the OS won't try to read nor write to it anymore. I think what he may be talking about is "hard to read" sectors - like those that have CRC errors or lost some of their ability to retain their magnetic charge. When Windows encounters those it may retry reading it a certain number of times, and if it can't, it'll mark it as bad. Sometimes you need the data under there, but if you read it too many times, you could make it worse (from wear). I think what he's talking about is special programs that skip hard-to-read sectors on the first pass, and incrementally increase the threshold for future passes. I stumbled upon this page once http://www.deepspar.com/products-ds-disk-imager.html and watched the video. It's a totally wild guess that it's what Moulton is talking about. I think ddrescue, which you mentioned in the following post, may work that way. Also a guess. As for definitive answers, I doubt he'll give them all. I mean some of these are secret of the trade... I do agree they charge too much (especially for trivial problems like simple logical errors that can be fixed with testdisk or similar tools - did you remember his comment about Macs having a very simple, yet common problem, but it was purely logical, and it wasn't easily solvable to the average Mac users because they didn't have utilities available to them). It might be because of the cost to build and maintain the clean room though. Keeping those rooms particle-free costs millions. But they allow you to do stuff you just couldn't do without them. Fun stuff if you have time to kill (and data recovery interests you): http://www.astro.ufl.edu/~ken/crash/index.html http://forum.hddguru.com/some-fun-stuff-t7115.html http://forum.hddguru.com/check-this-out-t7088.html Actually those make me cringe and hold on to my balls. I most certainly wouldn't wish that on anyone. I think the most spectacular ones are when the head crashes and starts scraping the magnetic coating off the platter.

09-07-2008, 08:09 AM	#4 (permalink)
~~pawn3d~~ Troubled Join Date: Apr 2008 Location: New Orleans Posts: 34 OS: xp	Re: The secretive world of "data recovery". i heard i could make a cleanbox out of tupperware and most repairs can be done if you work fast.

09-07-2008, 09:09 AM	#5 (permalink)
blah789 TSF Enthusiast Join Date: Aug 2008 Posts: 2,306 OS: Windows 2000 SP4 and Windows XP SP3	Re: The secretive world of "data recovery". In one of the videos moulton does say you can make a cleanroom using household equipment. There's also other tips if you google, but I wouldn't trust them too much to say they're particle-free. I also don't think the tupperware solution is a handy one for a company that has lots of drives to repair.