Articles tagged with: Cyber Forensic Investigators

What You Should Not Do to a Failing or Failed Hard Drive?

Ten Things You Should Not Do To A Failing Or Failed Hard Drive

If the data is essential and you wish to maximise the likelihood of retrieving it!

In the era of the cloud and omnipresent digital storage, many of us forget the perils that come with storing data on physical hard drives. If you're facing a situation where your hard drive is failing or has failed, and the data stored on it is crucial to you, it's imperative to know what actions might worsen the situation. Let's delve into the don'ts of managing a troubled hard drive if you wish to have the best possible chance of recovering your data.

Electro-mechanical hard drive failure is typically associated with a clicking or noisy disk drive, the drive is no longer detected, or the drive is slow to respond to read and write requests.


1. Do Not Continue Using It

The more you use a failing drive, the more it deteriorates. Using the drive can overwork it, potentially making data recovery more difficult or impossible. This includes rebooting as constantly rebooting might cause more damage. Each start-up cycle puts stress on the drive.

2. Do Not Leave It Powered On

  • Hard disk drives - A knocking (or noisy) head stack will cause (more) physical damage to the platters and/or magnetic field if left knocking, possibly making the drive unrecoverable or only partially recoverable.
  • SSDs - Solid-state drives use a technology called SSD TRIM or trimming, whereby deleted data areas first need to be cleared before new data can be written. TRIM is an automatic function, that will erase any previously deleted data areas, making recovery impossible with standard data recovery tools, and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered on, the more likely the drive will execute trimming.
    • It is potentially possible to recover deleted data from an SSD using factory access mode if trimming has not yet been executed.

3. Don't Assume It’s Dead Immediately

  • Just because the drive isn't being recognised by your computer doesn't mean all hope is lost. Jumping to conclusions might lead to rash decisions.

4. Do Not Make Any Rash Decisions

  • Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
    • Are you willing to play Russian roulette with your data, possibly ruining any chance of recovery?
    • How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
  • The value of your (or your customers) data will ultimately determine your next action.
  • There may only be one chance at recovering data from a failed or failing drive!

Hard drives, SSDs and other storage devices are a lot more complex than many people think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - In essence, a computer within a computer. Every one of these components must be in a working condition for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.

 
5. Do Not Open The Drive

  • Hard drives are manufactured in a Class 100 cleanroom as they are extremely sensitive to airborne contamination. Opening a drive outside of a cleanroom environment will contaminate the drive, possibly leaving the drive unrecoverable.


6. Do Not Replace The PCB (The Printed Circuit Board)

  • There was a time when you could swap the PCB (between most drives) within a model range. The programming (firmware) on most modern hard drives is unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB, possibly leaving the drive unrecoverable or making recovery extremely difficult.

7. Avoid D.I.Y. Recovery Software

  • While there are many data recovery software solutions available, they might not always be the best choice for severe hardware malfunctions. These tools can strain the drive even more.


8. Do Not Run Any Disk Tool Or Utility

  • D.I.Y. disk tools are designed to test working hard drives and reallocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters complicating or hampering data recovery attempts.


9. Do Not Try To Write Data To The Drive

  • Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure, and you can possibly overwrite valuable data, leaving that data unrecoverable.


10. Do Not Format Or Initialise The Drive

  • If prompted, do not format or initialise the hard drive. This process will make data recovery much more challenging, as it can overwrite existing data. Formatting a failing hard drive may lead to permanent data loss or make recovery attempts difficult.


11. Do Not Run A System Restore Disk

  • Restore disks or system recovery programs are designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable, especially if run on a failing hard drive.


12. Do Not Bump, Drop Or Knock The Drive

  • There was a time when hard drives used bearings prone to seizing. A bump in some cases did solve the bearing problem, but you still ended up with platter damage due to the heads contacting the platters. Modern drives do not use bearings, and the only result will be platter damage and/or platter alignment issues, leaving the drive unrecoverable or, at best, partially recoverable.

13. Avoid DIY Fixes from Online Forums

  • While some online advice can be helpful, many "quick fixes" found on forums can do more harm than good. Not all solutions are applicable to every situation.


14. Avoid Heat and Cold

Exposing the drive to extremes, like using a hairdryer or putting it in a freezer, are myths that can cause more harm. Temperature fluctuations can lead to component damage or condensation.


Do not put the drive in a fridge!

    • This is an urban legend that may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or bad solder connections by lowering the temperature, causing the joints to contract to make contact again. This may have worked briefly until the device heated up, causing the “dry joints” to expand, breaking the connection again. 
    • Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint”, you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
    • The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit, leading to damaged components. The drive will, in most cases, be unrecoverable if one of those components happens to be the firmware chip.

A failing or failed hard drive can indeed induce panic, especially if vital data is at stake. However, making hasty decisions can exacerbate the situation. If the information is crucial, the best course of action is to stop using the drive immediately and consult with professional data recovery experts. This will give your or your customer’s data, the best possible chance of being recovered. Always remember, when it comes to precious data: act wisely, not quickly. You may only have one chance at recovering the data from a failed or failing drive.

Need Help In Recovering Your Data - Contact Us Now!

REQUEST A FREE ONLINE QUOTATION

10 Things You Should Not Do To A Failing Or Failed Hard Drive

Ten Things You Should Not Do To A Failing Or Failed Hard Drive

Hard drive failure is typically associated with a clicking or noisy disk drive, the drive is no longer detected, or the drive is slow to respond to read and write requests.


1. Do Not Make Any Rash Decisions.

  • Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
    • Are you willing to play Russian roulette with your data, possibly ruining any chance of recovery?
    • How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
    • The value of your (or your customers) data will ultimately determine your following action.
    • There may only be one chance at recovering data from a failed or failing drive!

Hard drives, SSDs and other storage devices are much more complex than many think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - A computer within a computer. Every one of these components has to be in a working condition for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.


2. Do Not Leave The Device Powered On.

  • Hard disk drives - A knocking (or noisy) head-stack will cause (more) physical damage to the platters and/or magnetic field if left knocking possible, making the drive unrecoverable or partially recoverable.
  • SSDs - Solid-state drives use SSD TRIM or trimming technology, whereby deleted data areas must first be cleared before new data can be written. TRIM is an automatic function that will erase any previously deleted data areas, making recovery impossible with standard data recovery tools and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered on, the more likely the drive will execute trimming.
    • It is potentially possible to recover deleted data from an SSD using factory access mode if trimming has not yet been executed.

3. Do Not Open The Drive.

Hard drives are manufactured in a Class 100 cleanroom as they are susceptible to airborne contamination. Opening a drive outside a cleanroom environment will contaminate the drive, possibly leaving the drive unrecoverable.

4. Do Not Replace The Pcb (printed Circuit Board).

  • There was a time when you could swap the PCB (between most drives) within a model range. However, the programming (firmware) on most modern hard drives is unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB, possibly leaving the drive unrecoverable or making recovery extremely difficult.

5. Do Not Run Any Disk Tool Or Utility.

  • D.I.Y. disk tools are designed to test working hard drives and re-allocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters and corrupt the firmware programming, complicating or hampering data recovery attempts.


6. Do Not Try To Write Data To The Drive.

  • Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure, and you can possibly overwrite valuable data, leaving that data unrecoverable.

7. Do Not Format The Drive.

  • Formatting a failing hard drive may lead to permanent data loss or make recovery difficult.

8. Do Not Run A System Restore Disk.

  • Restore disks or system recovery programs are designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable, mainly if run on a failing hard drive.

9. Do Not Bump, Drop Or Knock The Drive.

  • There was a time when hard drives used bearings prone to seizing. In some cases, a bump solved the bearing problem, but you still ended up with platter damage due to the heads making contact with the platters. Modern drives do not use bearings; the only end result will be platter damage and/or platter alignment issues, leaving the drive unrecoverable or partially recoverable at best.

10. Do Not Put The Drive In A Fridge.

  • This urban legend may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or lousy solder connections by lowering the temperature, causing the joints to contract to make contact again. This may have worked briefly until the device heated up, causing the “dry joints” to expand, breaking the connection again.
  • Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint”, you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
  • The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit, leading to damaged components. In most cases, the drive will be unrecoverable if one of those components happens to be the firmware chip.

Losing data is possibly one of the most traumatic events you can encounter. Give your or your customer's data the best possible chance of being recovered by not making rash decisions. You may only have one chance at recovering the data from a failed or failing drive.
Need Help In Recovering Your Data - Contact Us Now!

 

Updated - Originally published 18 January 2016