Saving Your Data After a Head Crash:
An Inside Look at a Disk Recovery Service
The Hard Disk Failure Nightmare
Data Recovery Article As Seen On Tom’s Hardware: www.tomshardware.com/reviews/saving-data-a-head-crash,1044.htmlOver the years, hard disks have gotten a lot quieter and faster, with capacities of up to 400 GB. The downside is that their reliability is far from perfect, and the devices are often fraught with mechanical failures – of course, this caveat is not mentioned in the vendors‘ product specifications. Experience shows that users can be divided into two groups. The first group of users is well informed or has already experienced the pain of losing data. In cases such as these, the user is careful to back up information such as emails, photos, work files or similar data on a DVD or other media, at least on an irregular basis. In business settings, the IT department or an administrator is the one who takes care of backups. Digital assets are thus protected should a virus attack, hardware failure or simply human error destroy a hard drive. However, this group is a small minority. The other group lives with a permanent risk, either because they aren’t aware of the possible horror scenario or, as is often the case, they don’t take it seriously enough. Generally speaking, it should be clear to everyone that any complex component could from one day to the next fail to provide its services. If such a scenario were to occur, then all the data stored exclusively on a hard disk would most likely be unrecoverable. Or not? As is true so often in life, there are second chances. For example, if the hard disk’s electronic system is the only thing that is defective, then the drive can still be saved by way of a replacement. Even if the dreaded head crash does occur, i.e., at the contact point between the heads and the magnetic surface, then it often only involves a small area on the hard disk. A defective read/write head usually means that a significant amount of data can be recovered – but believe us when we say the cost is steep. So when the nightmare happens and your hard drive is clearly physically damaged, you pick up the phone and call firms like CBL Data Recovery or Ontrack, which have the requisite equipment and lab infrastructure to do the necessary job. When one of our editor’s laptop hard disk crashed, we put his precious data in the hands of CBL Data Recovery in Kaiserslautern, Germany. With a defective read/write head, he was understandably very worried that he would never again recover his family photos and other personal files on his busted 2.5“ hard drive.
The Odds Of Getting Your Data Back And The Price To PayA brief search on the Internet usually yields a few candidates for possible recovery of data. If time isn’t a factor, it pays to compare prices: Because we’re talking about a service that is highly customized, costs are very high. Most of the time the process begins by sending in the defective data storage device so that it can be tested by the data recovery company. Only after a diagnosis has been made can the company estimate how much time it will take before they give you a cost estimate. In many failure-related cases, the chances of recovering data from a hard disk range from good to very good. If the electronic system is the only thing affected, then the drive can often be reused after the control panel has been replaced. If, on the other hand, the defect is of a mechanical nature, then recovery will be a bit more difficult. So long as the drive components can be replaced, expenses can be kept to a minimum. However, if special equipment is required, then the bill will quickly run up into the range of four figures. Data recovery only becomes critical once considerable physical damage has occurred, e.g., due to flooding, fire or the drive falling from a long distance. But, even still, hope is not lost: Even in these cases, the chances are good that at least a part of the saved data can be reconstructed. No doubt it’s clear that all this expense can be avoided from the outset. Important data should always be backed up on a regular basis; and preferably in such a way that the data can be stored in another location. If, after completely installing your computer, you create an image of the installation and update it as required, then you’ll have no problem restoring the system’s operability in 30 – 60 minutes after purchasing a hard disk replacement. This is certainly cheaper than a costly data recovery.
Defective SectorsHard drives have two lists for defective sectors, so that the drive’s electronic system can avoid them. With the so-called P sector list, the manufacturer takes this into account, allowing flexibility: The memory disks can accommodate more data than the manufacturer quotes in the end. Therefore, in any event, a sufficient number of sectors is available for the nominal storage capacity to be achieved. In theory, this does impact performance; in practice, the differences are never ever measurable. The second list is called the G list and is compiled during operation. It contains the sectors that have become unworkable during operation, and it can serve as an indicator as to the type of defect.
The Initial ContactCBL Data Recovery’s headquarters are in Canada. The company has a total of 11 other branches worldwide. Due to its relative proximity to our test lab, we chose the company’s German branch in Kaiserslautern. CBL requires you to fill out a form at the start, the purpose of which is to collect patient data. We made an appointment in advance by phone. Once CBL has set up the new work order, they place an order for a hard disk that is similar to the defective model; that is, if they don’t already have such a model on their premises.
Getting Started: Does The Drive Still Run?The first test is relatively banal: In a clean room the drive is hooked up to a power supply to see if it will even start up. Our defective notebook hard drive failed to run at all. Because the failure demon might have affected the electronic system, CBL replaced it first.
Hard Disk SurgeryUnfortunately, the replaced electronic system didn’t improve things, so the disk was unscrewed and opened up in a clean environment. When doing so, no dust can be allowed to come into contact with the hard disk or the magnetic strips/heads. A clean room is not necessarily needed to accomplish that. Powerful extraction systems and an air ionizer are really all that’s required. An ionizer is required in order to clear the air of foreign particles. The negative ions that are emitted bind these harmful substances, which are then big enough to fall to the floor under normal conditions. However, thanks to the powerful extraction system, they’re sucked away from the work surface. After opening up the drive, CBL checked to see that the disk heads were tilted in the center of the disk. The cam must be moved carefully by hand into its resting position. Normally the heads only get stuck if the hard disk receives a strong blow from above or, with a little bad luck, if the notebook shuts down after it’s already been packed up.
Here’s To A New One: Hard Disk ClonesAfter the manual correction CBL tries to duplicate the hard disk contents on another drive. And they even manage to do that with the help of its own software. It’s incredible: Our notebook hard disk came away with only 240 read errors following the head crash. Therefore, it was possible to recover a whopping 99.9% of the saved data. By the way, CBL doesn’t use the damaged hard disk after the cloning procedure. Recovery: If You’re Going To Do It, You Might As Well Go The Whole Hog After the data is copied from the damaged disk, the cloned disk is connected to a lab computer. Then they check to see if the partitions still exist. The data storage device is searched for file information using special software from CBL. Files that had already been deleted are also recovered, among other things. This process takes advantage of the fact that hard disks don’t actually ever delete data contents. Rather, they simply mark them as free sectors which can be used again.
Danger: FragmentationFragmentation refers to the saving of individual files in various pieces. For instance, this happens when several small files are deleted, followed by the saving of a larger file using the now free sectors of the smaller files. If individual files are „in pieces“ spread over the disk, then the hard disk has to carry out additional head movements in order to completely read the file. Consequently, regular de-fragmentation of the hard disk not only makes for quicker reading of files, it also improves the chances for data recovery – especially if really large, heavily fragmented files are involved. For instance, if the MFT (Master File Table with NTFS) is destroyed and data can only be read sequentially, then recovery is rarely possible without using the highest intelligence.
Reconstruction CheckIn any case, once this recovery process is completed it’s not necessarily certain that the information collected together will be in perfect condition afterwards, or that it will correspond to what the customer would like to have back. A destroyed PST file from Outlook would ultimately be of no use to the customer. Therefore, the recovered data is placed on an internal server and the entire data stock is simultaneously checked for viruses and, following that, burned as a workable RAR archive on DVDs, which are then sent to the customer. Naturally, other media or delivery methods can be used if requested.
What Happens With Customer Data?The original hard disk and the copy remain with CBL until the customer confirms that data recovery was successful. Once a positive response is received, the original hard disk is sent back to the customer. After that, all customer data at CBL is deleted. To safely delete hard disks, CBL uses its own program called Data Shredder, which the company makes available free of charge. A hard disk drive is deleted several times in accordance with various methods approved by different governments and institutions. It also makes sense to delete this way if you plan to sell a hard disk and want to be sure that the new owner can no longer recover the data (or have it recovered). Depending on the selected deletion method, which varies particularly with regard to the number of overwrite runs, this can take up to several hours.
Conclusion: High Price, Valuable ServiceThe cost of a recovery procedure falls between $600 and $4,000 – depending on the delay and the extent of work involved. In our case, CBL managed to recover all of the data deemed important – much to the great relief of our editor, of course, who thought his personal data might be lost and gone forever. CBL offers its customers a guarantee that no costs will become payable until it has been able to reconstruct the desired data. This statement speaks highly for the data rescuer, as well for the apparently good chances of recovering most content under usual hard drive defect scenarios. In our case, it was even possible to continue using the hard disk – even though we wouldn’t recommend that.