Articles tagged with: Data recovery

10 Things you should not do to a failing or failed hard drive

Wednesday, 05 February 2020

Ten Things You Should Not Do To A Failing Or Failed Hard Drive

 

1. Do not make any rash decisions.

  • Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
    • Are you willing to play Russian roulette with your data possibly ruining any chance of recovery?
    • How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
  • The value of your (or your customers) data will ultimately determine your next course of action.
  • There may only be one chance at recovering data from a failed or failing drive!

Hard drives, SSD's and other storage devices are a lot more complex than what many people think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - In essence a computer within a computer. Every-one of these components have to be in a working condition in order for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.

 

2. Do not leave the device powered on.

  • Hard disk drives - A knocking (or noisy) head-stack will cause (more) physical damage to the platters and/or magnetic field if left knocking possible making the drive unrecoverable or only partially recoverable.
  • SSD's - Solid-state drives use a technology called SSD TRIM or trimming whereby deleted data areas first need to be cleared before new data can be written. TRIM is an automatic function, that will erase any previously deleted data areas making recovery impossible with standard data recovery tools, and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered-on the more likely the drive will execute trimming.
    • It is possible to recover deleted data from an SSD using factory access mode if trimming has not yet executed.


3. Do not to open the drive.

  • Hard drives are manufactured in a Class 100 cleanroom as they are extremely sensitive to airborne contamination. Opening a drive outside of a cleanroom environment will contaminate the drive possibly leaving the drive unrecoverable.


4. Do not replace the PCB (printed circuit board).

  • There was a time when you could swap the PCB on (between most drives) within a model range. The programming (firmware) on most modern hard drives are however unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB possibly leaving the drive unrecoverable or making recovery extremely difficult.


5. Do not run ANY disk tool or utility.

  • D.I.Y. disk tools are designed to test working hard drives and re-allocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters and corrupt the firmware programming complicating or hampering data recovery attempts.


6. Do not try to write data to the drive.

  • Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure and you can possibly overwrite valuable data leaving that data unrecoverable.


7. Do not format the drive.

  • Formatting a failing hard drive may lead to permanent data loss or make recovery attempts extremely difficult.


8. Do not run a system restore disk.

  • Restore disks or system recovery programs are typically designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable especially if run on a failing hard drive.


9. Do not bump, drop or knock the drive.

  • There was a time when hard drives used bearings that were prone to seizing. A bump in some cases did solve the bearing problem but you still ended-up with platter damage due to the heads making contact with the platters. Modern drives do not use bearings and the only end result will be platter damage and/or platter alignment issues leaving the drive unrecoverable or at best partially recoverable.


10. Do not put the drive a fridge.

  • This is an urban legend that may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or bad solder connections by lowering the temperature causing the joints to contract to make contact again. This may have worked for a short period until the device heated up causing the “dry joints” to expand breaking the connection again. 
  • Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint” you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
  • The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit leading to damaged components. The drive will in most cases be unrecoverable if one of those components happens to be the firmware chip.

Losing data is possibly one of the most traumatic events that you can encounter. Give your, or your customers data, the best possible chance of being recovered by not making any rash decisions. You may only have one chance at recovering the data from a failed or failing drive.

Hard drive failure is typically associated with a clicking or noisy disk drive or the drive is no longer detected or the drive is slow to respond to read and write requests.

Need Help In Recovering Your Data - Contact Us Now!

 

 

Updated - Originally published 18 January 2016

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services

Henk Smit Thursday, 18 May 2017

May 2017

Now supporting data recovery from 22,179 mobile devices and 4,046 applications, including:

  • * Bypassing the user lock on 135 LG devices including LG F700L G5, H872 G6 and US996 V20.
  • * Advanced physical data recovery on 214 devices.

Mobile Device Data Recovery May 2017

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services

Henk Smit Friday, 13 January 2017

January 2017
Now supporting 20,850 devices and 2,850 applications, including:

  • * Physical extraction for 17 MTK (Mediatek) Android devices.
  • * Physical extraction and decoding from and additional 26 Motorola Android devices.
  • * Physical extraction while bypassing user lock for 18 additional Huawei devices.
  • * Logical extraction and decoding for the new Google Pixel Android devices.
  • * The ability to convert BSSID values (wireless networks) and cell towers into physical locations (longitude and latitude GPS coordinates) within a specific timeframe.
  • * Mobile data recovery from 26 new iOS and Android applications.

Summary of our mobile device data recovery and forensic capabilities:

Tecleo Data Recovery and Digital Forensics Lab - Updated mobile device data recovery & forensic capabilities

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services

Henk Smit Wednesday, 28 September 2016

September 2016
New data recovery and forensic capabilities added to our mobile device data recovery service - Now supporting 20,489 devices and 2,256 applications, these include:

  • * Physical extraction and decoding of rooted and unencrypted Samsung Galaxy S7 and Note 7 devices.
  • iPhone 7 devices can now be recovered using advanced logical, logical and file system data extraction.
  • File system, advanced logical and logical extractions and decoding from apple devices running iOS 10.
  • * Extraction and decoding of encrypted and unencrypted iOS 10 backups.

Summary of our mobile device data recovery capabilities:

  • Logical data recovery: 8,785 mobile devices
  • Physical data recovery: 4,584 mobile devices
  • File system data recovery: 4,699 mobile devices
  • Extract/disable user lock: 2,421 mobile devices
  • Total number of devices now supported = 20,489

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services

Henk Smit Thursday, 11 August 2016

August 2016
New data recovery and forensic capabilities added to our mobile device data recovery service - Now supporting 20,165 devices and 2,255 applications, these include:

  • * Partial file system recovery from 105 locked and unlocked Samsung Android devices.
  • Advanced logical and file system recovery from Apple iOS 10.x devices
  • Eight new iOS and Android device applications.
  • Call log decoding for iOS and Android snap chat applications.
  • Five hundred and twenty-seven applications capabilities updated.  

Summary of our mobile device data recovery capabilities:

  • Logical data recovery: 8,663 mobile devices
  • Physical data recovery: 4,528 mobile devices
  • File system data recovery: 4,571 mobile devices
  • Extract/disable user lock: 2,403 mobile devices
  • Total number of devices now supported = 20,165

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services.

Henk Smit Tuesday, 28 June 2016

JTAG Technical illustration web
June 2016
New data recovery and forensic capabilities added to our mobile device data recovery service - Now supporting 19,776 devices and 1,729 applications, these include:

  • Physical extraction while bypassing user lock for twenty-two Samsung Galaxy devices including the Samsung Galaxy S6, S6 Edge and Note 5.
  • A new and unique extraction method that allows physical extraction for more than hundred and forty LG models, with twenty-two new devices that were not previously supported including the LG MS330 and VS880.
  • A unique capability to disable the user lock for hundred and thirty-seven Samsung devices.
  • Physical extraction while bypassing user lock and decoding for nineteen Huawei devices.
  • Disable user lock support for seventeen LG Android devices, including the LG G5.
  • Physical extraction while bypassing user lock and decoding for three Nokia 105 devices, including RM-1133, RM-1134, and RM-1135. 
  • An enhanced lock-bypassing physical extraction method supporting twenty-eight Samsung devices (MSM8916), overcoming previous firmware limitations.
  • New applications for iOS and Android devices - Don’t Touch This (iOS), HereMaps (Android), HideSMS (Android), Hot or Not, Kakao Story, Mappy (Android), Meet24, MeetMe, Nike+ Running, Scruff (Android), SpringPad FlipNote (iOS) and TextMe and 183 updated application versions.

Summary of our mobile device data recovery capabilities:

  • Logical data recovery: 8,539 mobile devices
  • Physical data recovery: 4,444 mobile devices
  • File system data recovery: 4,462 mobile devices
  • Extract/disable user lock: 2,331 mobile devices
  • Total number of devices now supported = 19,776