Specialist Data Recovery firm educates trade show visitors the real dangers of failing Hard Disc Drives/Digital storage with real-world samples and best practice to avoid data loss.

CeBIT Australia 2008 Special Report

One would think that at a globally recognised IT trade show amongst all the Web 2.0 start-ups, Military/Enterprise data link vendors, research institutes, foreign diplomats and Channel distributors one would find an exhibitor who focused solely on something as important, ubiquitous and commonplace as a magnetic hard drive?

Casual users of computing with little to no IT knowledge even know what a hard drive is, even if it is in the transposed sense of the PC system chassis being the ‘hard drive or hard disk’.

The market leaders such as Seagate, Western Digital, Samsung and Hitachi Global Storage do not bother with ‘business’ oriented trade shows such as CeBIT any more (at least in their international, regional versions) as everyone and anyone needs a Hard Disk Drive and there is little convincing of purchasers about this matter.

These Vendors make the hard drives by the millions each month and will gladly sell you a newer, larger capacity disk drive to replace a user’s failed drive.

Amongst walking the halls of CeBIT this time around, we came across, only just, a Sydney based data recovery firm who had real world examples of significant types and generations of Hard Disk Drives as well as common models of Hard Disk Drives which have known issues which lead to failure of the drive, as well as drives have just failed out of use or poor operating environments. In other words, rather than try to explain a complex topic to a person, just show them real thing which speaks more than just pictures and words.

The fact that this firm bothered to bring along these drives as case-studies and the staff’s willingness to discuss and explain difficult or problematic drive models impressed us, when they (or other firms) could have simply displayed a video or PowerPoint presentation or even just a single broken drive as a paperweight. Considering that revealing or discussing their day to day work on different drives (and making users proactive in the process) could actually lead to loss of business.

Quantum SCSI drive in Self-Test mode, demonstrating the head mechanism performing seek operations.

The Firm, XYBER Data Recovery of Sydney also had some ‘antique’ Hard Disk Drives on display dating back from 1986 as well as some more contemporary but less common models E.g. Compact sized 1.8” hard disks all with their covers removed for inspection by visitors to their stand or display of visible damage to the hard disk platter, the medium that stores a user’s data.

NitroWare.net spoke at length with representatives of this firm regarding typical symptoms of failing drives, problematic brands and models, strategy and best practice for users to preserve their precious data as well as challenges and issues faced with use and recovery of flash media such as USB flash drives/keys/sticks - a digital storage format that is growing exponentially in recent years.

We were pleased that the firm took a neutral view towards drive vendors and agreeing that all drives are equally likely to fail in their own ways. This view is not equally shared by the industry and user community alike and is a common subject of debate and conflict in online discussion.

Since data recovery firms in general see all types of brands, models and failures on a daily basis and have to work with the drives at the lowest level, a good reputable firm will know the ‘ins and outs’ of each brand and should not be particularly biased towards a particular vendor of disk drive.

As hard disk platter capacity increases, the capacity of the hard disk itself meaning vendors can squeeze more data into their traditional form factors? At time of going to press, Western Digital has announced their migration to 334 Gigabytes per platter. A typical Hard Disk Drive may comprise of a number of internal disks, between one and four which each disk (platter) comprising of the 334 Gigabytes.

What this means is that Hard Disk Drive vendors can lower their production costs by using higher areal density and reduce the amount of physical raw material needed to make the drive resulting in lower prices for the consumer which as low as $100 AUD for 500 gigabytes or $115 for 750 gigabytes, verified by NitroWare.net as of May 2008.

Vendors now offer three to five year warranties on these Hard Disk Drives but this typically means that the user will receive a ‘certified refurbished drive’ as a replacement and not a brand new drive as it is a more economic solution for the vendor as the price per drive has lowered.

For some segments of users and resellers this does not pose a problem but for others it does.

A fellow Australian based Corporate owned Enthusiast Computing publication commented in their online coverage of CeBIT that they challenged this firm on whether or not a clean room is needed for data recovery.

Well you need not wait for their coverage as we can answer this one now.

If it is a hardware fault with the drive, data recovery firms are able to interface with the drive using vendor provided tools or third tools and are able to correct issues such as repair or modify the drive geometry information, repair corrupt drive firmware, recover the firmware or update contents of firmware such as the drive firmware.

The next tier is if the drive’s electronics, mechanism, firmware and configuration are sound and healthy there are software tools that operate on the sectors of the drive to actually attempt recover data.

With disk file systems, deleted, lost or corrupt data can generally be recovered as when data is deleted, the data is actually not physically overwritten or erased. The pointers to a particular file in an index are deleted or marked as available.

Recovery tools, or if necessary manually editing the indexes on the drive will re-synchronise the drive contents and the drive index. Recovery firms typically have to operate at the sector level to repair damaged cause by system maintenance tools or attempts to recover the drive.

If the index and its backup copies is completely lost, then longer process is needed to recover a users files, this process which will pick up the data chunks and save them will end up with thousands of sequentially, or randomly named files which are meaningless to the user without analysing the file ‘headers’ to determine what type of the file the randomly named file is.

Some users may have noticed such behaviour when running system maintenance tools on a Windows or Unix disk partition.

Flash memory poses its own problems with sector level recovery. Each vendor of the actual semiconductors in the flash device, the controller chip which carries out all the requested instructions to read and write data into the device typically have their own proprietary algorithm in the way they map out and writ to areas of the flash memory.

In flash memory, data is not written sequentially as this will literately burn out the particular location in the integrated circuit just as if attempting to write to the same place on a piece of paper will tear a hole through the paper. The method to avoid is happening is called write leveling and each vendor has their own method of achieving this in their flash based storage products.

Not being able to see how the data is allocated poses a challenge to data recovery specialists as they would not know where to look next when trying to manually recover some data, just as if you have a map or a set of instructions which are missing some particular instructions or directions.