How can a data recovery lab get the data you can’t?

By | September 10, 2020

I am all for DIY (do it yourself). In fact my first website was called ‘DIY Data Recovery’, and the idea was to provide people with information and tools to perform their own data recoveries.  I learned a few things from that. Some things are not suited for DIY’ing. And some things that are DIY-able, labs are much better at. They can do things faster and safer. It comes down to more knowledge and experience, better software and magic “data recovery machines”.

Data recovery techs don’t skip this vital step ..

The first thing a recovery lab will try to accomplish is cloning the patient drive. Whether it is healthy or not. If it’s not healthy, the sole goal of repair is making the drive run stable enough for it to be cloned. A good lab will always clone the patient drive as soon as they have the chance. ALWAYS.

Many end users skip this step. Or they will do it because some with some knowledge on the subject urged them too. And if they clone, they keep going even if all signals tell them, stop this please! A lab has specialized hardware to clone ill drives. This allows them to monitor and adjust the process, more about that later.

Logical Data Recovery

Although good tools go a long way, in the end it’s experience that accounts for a lot. When I was running DIYDataRecovery, people who purchased my software needed a lot of hand holding. That’s not a bad thing, in fact I like supporting people. In fact I like it so much that I regularly offer advice on Reddit and Quora. Often they use the wrong tools for a specific scenario.

Point is, a data recovery lab has a lot of tools where it’s engineers can pick from. From experience a veteran engineer can tell in an X situation tool Y performs best. Or even if he doesn’t have a clue, he can try different tools, pick the one giving the best result or even combine results from different tools.

Professional logical data or file recovery software often allows for greater control than end user software. End user software typically allows the user to select a drive, scan it and then to select and recover files. If the files that are recovered turn out to be corrupt there’s little he can do. Professional grade tools allow the technician to tweak settings and modify file system parameters.

Professional tools offer support for RAID and a great variety of files systems. Some times a combination of both these are required for, for example reconstructing RAID arrays from NAS devices. Some professional tools offer extended integration with data recovery hardware.

Developers of such software benefit greatly from the experiences of data recovery techs. They are provided with feedback based on many real world cases. In return the tech gets even more powerful tools.

Of course, logical data recovery is never done using the original patient but always on a clone or sector-by-sector disk image.

ReclaiMe Pro and USB Stabilizer, a powerful combo

DeepSparUSB Stabilizer can give professional software a boost, allowing greater control over unstable USB connected drives, including SD Card, USB thumb drives, native USB hard drives and also SSD drives

Very sick drives and “data recovery machines”

I already mentioned a data recovery lab tech will use specialized equipment to clone drives (or other storage media). This ‘equipment’ is often a combination of hardware and software. The patient drive is attached to the device (people some times call it “data recovery machines”). The interaction between the device and the drive can be monitored and adjusted using control software. The device sits in between the operating system and the drive. It can tell the OS not to touch the drive.

Some times data recovery machines come as sexy little units ..

Some times data recovery machines come as sexy little units ..

Certain drives for example have known firmware problems that can be ‘patched’. Also the tech can for example decide he does not want a drive to perform sector reallocation on a drive he has just repaired. And commonly read access parameters can be monitored and modified (what action should be preformed on a bad read or when drive becomes unresponsive, etc.). Often the software also controls the imaging or cloning process directly. It is also possible it sits in between the disk imaging software and the patient drive.

Without this software disk cloning could easily take over a month for some drives, if they even make it that far. Unstable drives get sicker and sicker to eventually completely fail. By reducing cloning times drastically the chance of the drive surviving increases dramatically.

Although these data recovery machines can do a lot and certainly a lot more than software alone they can not perform magic. A drive has to be able to spin (assuming a spinning disk for now) without causing damage. So physically damaged disks first needs to be repaired.

Often these data recovery machines are cards very much like a graphics card built into a PC

But often these data recovery machines are cards very much like a graphics card built into a PC

Physical damage needs to be addressed first

Trying to fix hardware related issues yourself about equals killing your disk. Not all data loss issues are DIY-able. Drop a mechanical drive and it will most likely result in physical damage. No DIY grade software tools can help you with that.

Simpler repairs can be done with a closed disk, think electronic components on the PCB that failed. Common wisdom has it you can simply swap the PCB for one from a working identical drive, however this is often not the case. A ‘simple’ board swap requires the drive to be connected to specialized hardware and software to change certain parameters and sometimes to disable bad sector reallocation and such.

For many repairs, you have to open up the patient, some times a drive is opened purely for inspection: Is it safe to power it up or not?

Sure, I know the videos on Youtube of people opening their drives, ‘unstuck’ them and then successfully copy the data. It’s a risky procedure as a spec of dust can already cause havoc. Some even run the drive while being opened and this for certain is a recipe for disaster. A mechanical drive should only be opened in a clean room and never run with the lid off. Even if there is anecdotal evidence of successful repairs outside a clean room.

Patient and donor drive side by side for a 'head-swap'.

Patient and donor drive side by side for a ‘head-swap’.

And while opening the drive and give the heads a little push to unstuck them seems easy enough, more complex repairs require lots of experience and precision instruments. These complex repairs some times have to be repeated multiple times because somewhere between the start of the disk cloning process and the end, the drive simply gives up again. Typically such drives have to be constantly monitored much like a critical patient in a hospital.

Once the drive is repaired it goes back to the ‘data recovery machine’ we looked at earlier and it’s special software can then be used to configure the drive’s firmware and cloning.

Physical repair of flash based drives

Another type of repair is on flash based media. Unlike mechanical drives this type of repair does not require a clean room. Simple failed electronic on PCB can often be repaired or replaced. If this however is beyond repair or if the controller failed, NAND memory has to be removed from the PCB and dumped using a specialized reader. In case of monolith flash memory, where the controller and actual NAND memory is integrated, a layer of protective material is scraped off until the naked chip becomes accessible. Micro wires are then soldered onto pins and a reader to allow dumping of raw NAND memory.

Before such a raw dump can be used to recover data, specialized software is needed to transform the raw data dump into a logical image that can be processed using ‘normal’ file recovery software.

monolith nand chip soldered to board, attached to power controller, attached to specialized reader controlled by software

Monolith NAND chip soldered to board, attached to power controller, attached to specialized reader controlled by software

A data recovery tech is often one in a network of peers

Two know more than one. And ten now more than two. Data recovery labs often work together to a degree. These are often informal contacts in various online forums and social media. Storage technology is changing all the time, and no one can keep up with everything. Fortunately many techs value sharing of information and knowledge. And because of this, participating labs can solve more cases. Or even help each other out with certain types of recoveries. It is not uncommon for a tech from lab A using a remote connection to work on a recovery of lab B.

Peers of the typical home user trying to recover his data are often people populating end user forums. Without wanting to sound disrespectful it’s often very much like the one eyed leading the blind. A lot of bad upto downright destructive advice is given in these places. Often the goal is to find the cheapest possible solution rather than the best. Often limitations of this free or inexpensive software is worked around using potentially destructive methods.

Data recovery machines

I have mentioned ‘magic’ data recovery machines a couple of times. You could argue, if I buy me one of those I can do my own data recoveries. To a degree this is true. But first you need to consider the pricing. The tools are expensive to purchase and often there is an annual license fee attached.

Now that you have purchased the tool you need to learn how to use it. I think I am not exaggerating if I say that to really get to know a tool, takes years. You can somewhat speed that up if you’re willing to book courses, often several thousands of Dollars and depending on where you live only available in another part of the world. There is no magic involved. Most data recovery machines require a solid foundation of knowledge and lots of experience and tinkering to be effective.

DeepSpar: Makes a variety of hardware/software data recovery solutions http://www.deepspar.com/

AceLab: The big guns, hardware software combos for HDD, SDD and other flash based drives https://www.acelaboratory.com/

Rusolut: Specialized hardware/software for flash drives https://rusolut.com/

SoftCenter: Specialized hardware/software for flash drives http://flash-extractor.com/

Dolphin Data Labs: Hardware/software for mainly hard drives https://www.dolphindatalab.com/

 

 

Leave a Reply

Your email address will not be published.