An article you might want to read swift...
Hard-drive crash! A tour of a data-recovery lab
Lincoln Spector
By Lincoln Spector on May 9, 2013 inBriefing Session
When a hard drive crashes and there’s no backup of critical data, what are your options? There’s really only one — and it could be costly.
You send the broken drive to a company that specializes in data recovery; here’s what happens when it gets there.
A video tour inside a data-recovery lab
It’s often said that nothing is certain but death and taxes. To that I would add hard-drive crashes. It’s especially maddening that mechanical hard drives always seem to fail at the most inopportune times. SSDs and flash drives aren’t immortal, either.
In a perfect world, a dead hard drive would be of no real concern. Our data would be backed up on other media or in the cloud. But in reality, we often fail to make timely backups, backups themselves fail, or the drive crashes just as we finish that vital report. In those cases, recovering critical data could well be difficult and expensive.
When simply kissing your work goodbye is not an option, companies such as Flashback Data (site) will attempt to recover files trapped on a broken drive — for a price ranging from hundreds to thousands of dollars. Recently, Flashback Data vice president/co-founder Russell Chozick gave me a video tour, via Skype, of the company’s Texas-based facilities. He showed me the equipment — including a cleanroom and special workstations — used to pull data off dead drives, smartphones, and other devices. (Please excuse the images — they were captures from my Skype-based tour.)
And, of course, we discussed the many issues involved with recovering lost data.
In addition to recovering digital data, Flashback Data works with law-enforcement agencies on data forensics.
Note: This story is not a review or endorsement of Flashback Data. There are many companies in the data-recovery business; two of the best-known are Kroll Ontrack (site) and DriveSavers (site). Also, objectively comparing the quality of these companies’ services is exceptionally difficult — unless, possibly, you can throw many thousands of dollars at the project. The Pentagon might have the budget for that sort of testing. I don’t.
You should never need data-recovery services
Companies such as Flashback Data exist because of that previously mentioned, all-too-common flaw in our digital life: that a great many of us have poor habits when it comes to protecting our data.
“We try to educate people” about backup, Chozick stated. But there’s a huge number of too-casual or misinformed computer users. Chozick noted instances where users bought external drives for backup purposes, then moved — not copied, but moved — their files to the “backup” drive. That’s a new one to me, and I’ve covered digital technology for many years.
No one will hold a club over your head to make you change bad backup habits (not literally, anyway), but the cost of recovering critical documents might. What’s the personal price for losing treasured family photos? Or the professional cost of losing something your boss wants next Monday?
Backing up your data is dirt-cheap insurance when compared to the alternatives. According to Chozick, pulling files off a hard drive typically runs from about U.S. $300 to $1,900 — if the damage is something relatively simple, such as a faulty hard-drive logic board. That might not seem like much, but there’s no assurance that usable data can be recovered for any cost.
Pulling information from a dead hard drive
When a faulty drive arrives at Flashback Data’s lab, it’s assigned a project number and labeled. Then the diagnostics begin. (This procedure and the ones that follow are undoubtedly common to most data-recovery companies.)
Engineers start with the described symptoms. If the user complained of a clicking noise, the drive goes to the cleanroom for inspection. Otherwise, they simply attach it to a computer and see what it needs.
Flashback has a class 100 cleanroom (Wikipedia info), but it’s not what you probably imagine. It’s not a room that’s kept completely free of dust; you don’t need to suit up and walk through an airlock to get in. Rather, the room is equipped with several laminar flow benches (Wikipedia info), shown in Figure 1, that provide a clean environment around the drive and the gloved hands working with them.
AirClean 4000
Figure 1. Rather than a completely dust-free cleanroom, Flashback Data uses special workstations to examine drives.
After diagnosis, Flashback Data sends the customer an exact quote. If the drive must be opened (see Figure 2) in the cleanroom, the price goes up considerably.
Open hard drive
Figure 2. If a drive's external circuitry is working, the next step in diagnosing a broken drive is exposing the platters.
In most cases, recovering data means fixing the drive — temporarily. Flashback Data keeps racks and bins of old hard drives and tape drives around for spare parts. (It only recently dumped its Intel 8086–era, 20MB hard drives.) Once patched together with working parts, the drive is connected to a computer and the accessible files removed.
Flashback Data sends recovered files back on external media — usually USB hard drives or flash drives. Customers can provide their own return media.
Not every data recovery has a happy ending
There’s no guarantee that usable data will be recovered. If a drive is too damaged, the data is effectively gone. Also, if a drive was encrypted and the customer doesn’t have the encryption key, recovery becomes extremely unlikely. Many hard-drive manufacturers sell self-encrypting drives, with the decryption key on the drive’s circuit board. In those cases, data-recovery requires the original, working circuit board.
Not all forms of password protection prevent data recovery. “We can crack the [four-digit] passwords on iPhones pretty quickly,” Chozick stated.
Physical damage can leave a drive permanently unreadable. Dropping the drive can shatter glass platters, and no one is going to get magnetic bits off glass shards. If the read/write heads have scraped the magnetic coating off the platter, there’s nothing to recover.
Overwriting files — intentionally or otherwise — renders the erased bits unreadable. Chozick (who, you’ll recall, does data forensics for law-enforcement agencies) claims that overwriting a sector once is just as secure as the fabled Gutmann method, which rewrites sectors 35 times. That wasn’t always the case; however, today’s drives pack data so tightly there’s no room for ghosts of previous bits. (That was the biggest surprise of the interview.)
Growing market: recovering data from flash media
Old-fashioned, mechanical hard drives are becoming a smaller and smaller part of Flashback Data’s business, according to Chozick. With the rapid adoption of flash drives, SSDs, and smartphones, people are finding new ways to lose their data.
Recovering files from iPhones can present a challenge because of their combined software/hardware encryption. “We can’t take flash memory straight off an iPhone.” They have to effectively repair the phone to access its information.
That’s not the case with all phones, however. Chozick showed me the flash-memory chip removed from a damaged Android phone (Figure 3). The chip was connected to a makeshift circuit board via a mass of hand wiring (Figure 4).
Disected Android
Figure 3. Recovering data from broken smartphones, such as this Android, is a growing business.
Hand-wired memory-chip adapter
Figure 4. Flashback Data's custom circuit board, used for reading a smartphone memory chip.
SSDs can be difficult because the data is intentionally scattered throughout the drive’s memory cells. The drive’s controller uses wear-leveling algorithms to keep one part of the memory from wearing out prematurely.
“We don’t see a lot of worn-out [flash] drives,” Chozick told me. “But when it wears out, it wears out. Error correct can’t handle it anymore.” Fortunately, most problems with flash storage are the result of damaged supporting electronics — not the memory cells.
Whether you trust your files to a magnetic platter, flash memory, or both, your data is never really safe. Back it up regularly, and you will never have to ask a company such as Flashback Data whether the cost of getting some or all of your data back will be in the hundreds or the thousands.
