Main menu:

Site search

Categories

October 2017
M T W T F S S
« Jul    
 1
2345678
9101112131415
16171819202122
23242526272829
3031  

Tags

Blogroll

Recovery of holiday photos from SanDisk 8GB SD memory card with corrupted controller chip

NAND memory in the form of SD cards (such as SDHC and SDXC), micro SD cards and CF cards have almost replaced 35mm film as the de facto storage medium for most camera devices.

Last week a customer who had photos from a family wedding and a trip to Ethiopia contacted us because his 4TB SanDisk SD card could no longer be read by his Canon EOS camera or his Apple Mac computer. The latter presenting him with the error message “The disk you inserted was not readable by this computer”. This error can sometimes be caused by partition or controller failure. In this case, a quick diagnostic test on our NAND reader made a controller issue the most likely cause.

The controller in NAND memory devices serves the important role of managing read and write cycles. It also performs a process known as “wear-levelling” – a feature which optimises the utilisation rate of all cells evenly across a die. It also performs the important role of logical block addressing, mapping information from the logical block address to the physical addresses. The controller chip also manages bad blocks. Just as a hard disk uses a P-List and a G-List, many NAND chips use Bad Block Omission and Bad Block reallocation algorithms. For cells which have been subject to the erase function, the garbage collection function designates them as “free” for new recording cycles.

Each controller type will use different LBA and page schemes. The accurate determination of these is crucial for successful data recovery. Typically, the page size is 512 bytes. In this particular case, the page size was 512 bytes with a logical block size of 1024 bytes. After having created a virtual image of the disk, we analysed the inversion and XOR used by the controller. Inversion is a type of encoding commonly used in TLC chips to minimise cell wear. This inversion algorithm must be deciphered. Secondly, we had to work out the XOR used by the controller. User data is merged with a XOR key to (rather un-intuitively) create noise. This is needed by TLC NAND to preserve data quality. After working out the XOR, the virtual and block allocation patterns, we now had a logical image of the SanDisk card to work with.
Logical block number and logical page number sequence had to be calculated followed by data block sorting and filtering. This included removal of invalid and duplicate blocks and checking of LBN integrity.
And then to the final stage…the data extraction phase. Most of the file types were .CR2 (Canon Raw Image), JPEG and .MOV files all of which extracted beautifully. The client collected a DVD with all his treasured memories vowing never to trust a camera card again!

 

The perils of sudden power loss: data recovery from LaCie NAS (using Seagate Constellation 2TB ES X 2)

This RAID disk (pictured above) owned by a Dublin-based design and multimedia company was in our lab recently for some data recovery. During building renovations their business premises, experienced a sudden power cut. Such an incident is normally not good for disk health. But thankfully most disks can compensate for sudden power loss by using centrifugal force to move the head disk assembly back to the disk’s parking zone. However, in this particular instance the power cut off; then went back on again momentarily. Now with this type of scenario disks have a little more difficult time. Because when this happens, the head disk assembly, whilst moving back to the centre of the disk, risks getting “stuck” on the platters.

In this particular case, the first disk (disk 0) escaped any mal effects, but the second (disk 1) refused to spin up at all. Instead, the disk, a Seagate Constellation ES, made a humming noise. We brought it into our clean-room and confirming our expectations, we found the HDA stuck midway across the platters. Using customised tools for Seagate disks we gently unstuck the delicate HDA from the platters. The disk was reassembled and connected to our recovery system. It spun up with a reassuring healthy sounding spin. But, as any experienced data recovery technician knows, trusting a repaired disk (not matter how fastidiously repaired) is tempting fate! Thus, to err on the side of caution, we imaged the repaired disk onto a new 2TB NAS-compatible disk – a process which took around 4.5 hours.

Now came the moment of reckoning. Disk 0 and the image of disk 1 were put back into the disk bays of the LaCie NAS and the device was powered up. After a 90 second wait. The volume mounted on the host (running OS Sierra) and appeared to be complete. To verify, we invited a representative from the client company to remotely login to your systems (via an encrypted connection) to view the recovered files. Much to his satisfaction, all Illustrator and Photoshop files appeared to be present.

Lessons learnt

It is for scenarios like this that the Uninterruptible Power Supply was invented. Whilst Ireland enjoys a very stable and reliable power network and we experience few electrical storms, there are always bolt-out-of-the-blue scenarios which merit a UPS (power-cuts during maintenance work, accidental power switch-offs etc,.) Such a device contains batteries which delivers power to your systems even when the mains power has been interrupted. It means that your systems and in particular your hard disks are not subject to sudden shutdowns. A UPS also offers users the opportunity to gracefully save any work still residing in the RAM. Manufacturers such as PowerWalker, APC and Eaton offer an extensive range of UPS devices catering for SoHo environments right up to data centre level.

But, perhaps the greatest lesson from this case is not to have your RAID devices configured in RAID 0 in the first place. It offers no protection should one disk fail. (In fact, NAS manufacturers should really put a sticker on their devices to warn users of this risk). For a two-disk configuration, RAID 1 is much safer. And finally, a NAS device should not be considered a backup. This continues to be a common misconception. The data on your NAS (especially if being used as a file server) needs to be backed up also. This can be to another NAS unit, for instance, or to the Cloud using a service such as Amazon S3.

 

Data Recovery from a Geologist’s Toshiba DTB310 external hard drive (Recovery of Photo and GoPro Footage)

We recently performed data recovery for a customer whose 1TB Toshiba external hard disk (DTB310) stopped working due to an accidental fall. Our customer, a professional geologist, used their GoPro Hero4 which was mounted to a drone for collecting geological survey data. Rather than cluttering up their MacBook, they transferred footage and still photos onto their Toshiba disk and wiped the micro SD card ready for the next use.  Unfortunately, when reviewing footage, the user accidentally let the disk fall from a coffee table whilst it was still on. With much trepidation, he re-connected to his MacBook Air but he could hear it making the dreaded clicking noise. He badly needed almost nine months’ worth of data recovered.

On word-of-mouth recommendation, he delivered the disk to us. We removed the disk from its plastic shell. Inside the case, we found a Toshiba MQ02ABD100 S-ATA disk.  Our equipment revealed that head #1 had totally malfunctioned. We opened the disk up in our clean-room to investigate further.

Damaged head #1 and slider

Magnetic head #1 was damaged as was the slider. The only viable solution in this case would be to perform a head disk assembly replacement. We communicated to the customer the process and cost involved. After formal approval, we got down to work.

Using a Toshiba “head comb” (an instrument specifically designed for the removal of Toshiba head disk assemblies), we removed the damaged HDA from the customer’s drive. Then, using the same process with the donor disk, we extracted its head disk assembly. Using an anti-ESD, electronic tweezers we mounted the new heads into the patient disk. Once aligned correctly, we dismounted the head comb tool and carefully reassembled the disk.  Once reassembly had completed, the moment of truth had arrived. We connected power to the disk along with a S-ATA data cable. This disk spun into life with a smooth spinning noise – always very pleasing to hear. As a preliminary test and before we commenced to image the whole disk, we imaged sectors from LBA 0 to 100000. They all imaged fine. We then imaged the remainder of the disk which completed without incident.

To determine the quality of the recovered images (stills) we used Quik Desktop (available from the GoPro website). Video footage from the GoPro was recorded in .MP4 format (using the .H264 codec). This footage was viewable using the excellent VLC media player (free to download). All still images and video files opened without corruption.

A complete recovery of almost 780GB was collected by our customer saving him hours of laborious drone fieldwork!

Drive Rescue Data Recovery is based in Dublin, Ireland. If you need data recovered from your hard disk – we can help. We can recover from most Toshiba external hard models such as the DTB305, DTB310, DTB320, v63600 and v63700.  Previously we have also recovered data successfully from Toshiba models such as the MQ01abf050, MQ01acf075, MK5065gsxf, and MK5065gsx.   

Hard drives, friction and a data recovery from a Samsung M3 external drive

Hans Peter Jost – the father of Tribology

 

Friction has always been a problem in technology. Ancient Egyptian art depicts workers dragging sleds carrying stone over the ground with workers pouring water on its track. Some of the world’s greatest thinkers from Leonardo de Vinci to Sir Isaac Newton have all pondered on the friction problem.

In September 1964 Hans Peter Jost a German-born engineer living in the United Kingdom attended a steel industry conference in Cardiff. Speaker after speaker from the United Kingdom, Germany, Italy and the United States all talked about failed and broken steel mill equipment and its cost to the industry. In almost every case of equipment failure, the common denominator was friction.  At the time, the friction issue gained so much salience, the UK government commissioned Jost to write a report on it. The Jost Report appeared in March 1966 and highlighted the huge savings industry could make if enough attention was paid to reducing the forces of friction in industrial plant and equipment. Jost’s report was to be the catalyst for the whole new study of Tribology – the science of interacting surfaces in relative motion.

Sixty-one years on from the Jost Report and the powers of friction are still in force albeit to a much lesser extent. Thanks to CAD, engineering designs have become more streamlined, wear-and-tear can be simulated more accurately and lubrication techniques have advanced. Scientists are now researching materials such as graphene with super-lubricity which has the potential for extreme low-friction applications.

But for the time being friction still exists and still presents a problem. The mechanical hard drive demonstrates a classic example of this. To put in context, the average mechanical hard disk has platters (on which data is stored) which spin at 5200rpm or 7200rpm. Moving just above the platters is an actuator arm, which has a slider (or several depending on disk size) on its tip. Mounted on the slider are the read/write heads. They float just above the surface of the platters on what is known as an air-bearing. The distance between the heads and platter surface can be as small as 5 nanometers. In theory, the drive heads should never touch platters, but this can happen due to “asperity events”. These can arise due to imperfections on the thin film coating of the platters. Commonly, for a hard disk asperity events take the form of thermal asperities where the delicate drive heads make contact with the platters producing a higher-than-normal voltage. The increased voltage leads to a “blocking temperature” between the platter surface and heads, which eventually leads to read/write fails.

Friction has been a problem for disk manufacturers since the RAMAC disk of 1956 and several innovations have been introduced to mitigate its effects. Ball-bearings used in the spindle mechanism which often led to non-repeatable run-out errors and were noisy have now been replaced by fluid dynamic bearings. To minimise friction between read/write heads and the platter surface there have been innovations also. For example, U-shaped slider rails have been introduced, but these have had limited success. Some disk manufacturers have introduced error-correcting software to “balance out” signal errors caused by asperities. In other cases, manufacturers use “thermal fly height” control software so the drive heads operate within specific pre-programmed parameters. Another approach has been to introduce special thermal asperity circuits in the disk’s firmware or to add a high-pass filter. The latter being unsuitable for disks using perpendicular magnetic recording as a DC component is used. More recently manufacturers like Western Digital and Seagate have injected helium into the main chamber of the drive to reduce the air friction caused by fast spinning platters.

 

 

Samsung M3 external disk

This week we were recovering data from a Samsung M3 drive which perfectly demonstrated the effects of friction on mechanical storage. The drive was a Samsung M3 external USB drive belonging to a Dublin architect. Upon removing the plastic shell we found a Samsung-branded Momentus drive model ST500LM014 having a capacity of 500GB. Heads #2 and #3 were unable to read data

Inside the case: a Samsung-branded ST500LM014

 

Under our microscope we found both these heads to be touching the surface of the platter. This was causing the heads to heat-up and block the read/write signals. Upon further investigation, the Femto slider on which they were mounted looked out of alignment with the other heads. This was probably the result of shock damage

 

Opened ST500LM014 Drive – Drive heads in “parked” position

We had an exact match head disk assembly already in stock which we used as a donor. In our clean room, the old HDA was removed and the donor HDA fitted. The drive imaged completely and the HFS+ (Apple) volume mounted successfully. All the client’s SketchUp files (.dwg and .dxf) were recovered along with some raw photos (.cr2) taken with a Canon SLR digital camera.

 

Drive Rescue Data Recovery is based in Dublin, Ireland. If you need data recovery from a Samsung M3 (HX-M500TCB/G) external hard drive or other external storage device such as WD Elements, WD Passport or Seagate Expansion Portable –  we can help. You can contact us on 1890 571 571  www.datarecoverydublin.ie                                                                                                                                                                            

 

Giving Back @ Drive Rescue

Brother Kevin Crowley and Robert Scanlon of Drive Rescue

Drive Rescue was recently at the Capuchin Day Centre in Dublin 7 to make a donation towards the superb work which Brother Kevin and his team do to help the needy and homeless in Dublin. This excellent charity spends no money on advertising or PR campaigns and keeps administration costs to a minimum. All funding goes to where it’s needed most. An extremely well run charity, with dedicated staff and all for a very worthy cause.

So who makes the most reliable hard drives?

The reliability of different hard drive brands has been an endless source of debate among computer enthusiasts and professional I.T. users for years.  In the same way that golf enthusiasts extol the virtues of a certain brand of club – some I.T. users have their preferred brand of hard disk. Users will have stories of hard drive brands which have given them stellar performance over the years. Equally, they will have horror stories of hard drive brands which have failed repeatedly or unexpectedly on them.

The problem with most of this anecdotal evidence is that users develop a biased opinion of one hard drive manufacturer versus another brand based on a very small and statistically invalid sample set of hard drives. For example, an I.T. administrator might be dealing with 500 hard drives, all of the same model and all from the same factory batch. If these drives start to show higher-than-expected failure rates, it is likely that he or she might begin to develop a very unfavourable attitude towards their manufacturer. Likewise, personal users are not a great source of information about hard drive reliability either. Most computer users (apart from some of the Drive Rescue crew…), don’t get up in the morning saying “I must run CrystalDiskInfo to check the health of my Seagates this morning”. Users just expect their storage devices to work and that’s the way it should be. Users subject their storage devices to different usage patterns and environmental factors. If a drive does fail taking important data with it; the manufacturer’s name can get etched onto the user’s minds forever. So small sample sizes coupled with different usage patterns and environmental factors can make asking everyday computer users about their perceived reliability of certain brands of hard drive an exercise fraught with bias and statistical error.

Data recovery companies are not a good source of statistically accurate information on hard drive failure rates either.

Data recovery companies are not a good source of statistically accurate information on hard drive failure rates either. After all, they mainly deal with failed drives. The Derstein data recovery laboratory in Moscow (the Russians being world leaders in the field of data recovery) has been collecting drive failure information since the mid-1990’s and some of it’s failure statistics do make for interesting reading. But, as the old saying goes, there are lies, damn lies and statistics. Nowhere in the Derstein survey does it ask users about the usage type of their failed drives, nor does it take into account the environmental factors which the failed drive might have been subjected to. Usage and environmental factors can heavily influence the lifespan of a hard drive. For example, a laptop or portable USB hard drive (which can be subject to more power-up / power-down cycles) owned by a data programmer (higher usage) who lives in a hot country (increased risk of heat-related damage) and travels a lot (increased risk of shock damage) will have a much higher probability of failure than a hard drive sits in an air-conditioned data centre in suburban Dublin.

Data centres have been decidedly cagey about releasing failure rates of their hard drives

This leaves us with data centres as a more statistically sound source of information. Up until now, data centres have been decidedly cagey about releasing failure rates of their hard disks. They would like us all to believe that their disk drives never fail. But there have been some exceptions. In 2007, Google researchers released the results of their study “Failure Trends in Large Disk Drive Population” to the USENIX conference. Their study used a very robust sample of 100,000 S-ATA and P-ATA consumer-grade disk drives ranging in capacity from 80GB to 400GB from their own data centre. They were deployed in rack-mounted servers. The drives were put into service and left powered on for all their service life. The Google survey found that there was a high correlation between the triggering of the SMART early warning system and disk drive failure. It also found that disk temperature and usage levels are less correlated to failure than some people think.  But the findings were not exactly ground breaking and failed to mention any relationship between specific hard disk manufacturers and failure rates.

Enter Backblaze, a US online backup company. With a disk population of 27,000 consumer-level drives (a smaller sample than Google but still fairly robust) and most interestingly a willingness to reveal failure rates according to manufacturer. (See figure 1)

 

Figure 1, Disk failure rates according to manufacturer and disk age.

 

As the above chart above suggests Seagate disks have shortest average lifespan of just 1.4 years and Western Digital drives giving the most longevity.

Figure 2, Failure rates over twenty months for 4TB disks, for HGST, Seagate, Toshiba and WD

 

From April 2013 to the end of 2015 Backblaze undertook a similar study primarily with 4TB drives from HGST, Seagate, Toshiba and Western Digital. (Disk population size being a very respectable 42,301). For 4TB disks, which makes up the main size in their data centre, Seagate again had some of the highest failure rates.

In the context of everyday computing, disks are not always continually running in an air-conditioned data centre.

While the BackBlaze findings are interesting: it still does not give us the complete picture. Because in the context of everyday computing, disks are not always continually running in an air-conditioned data centre. In reality, disks in use outside of the data centre tend to have a lot more power-up power-down cycles. They are subject to more friction and more power abnormalities. They are exposed more temperature variability and tend to have a lot more extraneous software installed on them which can mean more read-write cycles.

It’s the nature of failure and not the failure rate per se which is important

But perhaps the most important insight from the Backblaze studies is their findings on the nature of hard disk failure. While they might have found that Seagate disks have a higher-than-average failure rate, they also found that they “generally signal their impending failure via their SMART stats” and noticed that “drive failures from other manufacturers appear to be less predictive via SMART”.  As a data recovery company that liaises with IT administrators and end-users on an almost daily basis, “sudden death” failure of hard disks is what really catches users out (especially the users who haven’t backed-up). Some disks will experience this expeditious type of failure while other disks – if they do start to fail- will show a marked decrease in performance over a longer period of time before their final demise. In other words, some disks fail more gracefully. For example, sometimes the user will notice a marked decrease in disk performance. Other times, the SMART will get tripped or the disk will cause a “bad block” error to be registered in the host system’s event logs or a warning message will be displayed by the BIOS during POST or in the operating systems’ GUI. All of these warning signs can often be a powerful catalyst for the user or I.T. administrator to back-up the data or get the disk replaced.

Assuming that one brand of hard drive is relatively “safe” compared to another could lead users to a dangerous sense of false security

A treatise on the merits of one hard drive brand compared to another could go on ad nauseam. Worse still, assuming that one brand of hard drive is relatively “safe” compared to another could lead users to a dangerous sense of false security and complacency. Any storage device, whether that be a mechanical or solid state drive is liable to fail. There are too many variables involved that can lead to data loss. Even the most reliable drives suffer power surges, suffer fire or flood damage, get sabotaged by an employee, get accidentally overwritten, experience firmware / PCB failure or get crippled by a ransomware virus.

It all goes back to one thing…

So, it all goes back to one thing: having a good backup system in place and verifying your back-ups regularly.

Drive Rescue Data Recovery is based in Dublin, Ireland. We perform hard disk recovery from failed hard disks including those from Apple MacBook Pro, Macbook Air, iMac, Windows and Linux systems. We also recover from NAS and DAS devices such as Synology, Buffalo, Netgear, LaCie and G-Technology. Our customers hail from throughout Ireland including Dublin, Cork, Limerick, Galway, Drogheda, Dundalk, Waterford, Athlone and Kilkenny.  We can be contacted on 1890 571 571 or find out more about what we do at: http://www.datarecoverydublin.ie/

 

 

In praise of the humble DVD

 

Most computer users are now conversant about SSDs, multi-terabyte drives, Dropbox, iCloud, Google Drive and a host of other backup mediums, however most seem to have forgotten about the simplicity and the reliability of the humble DVD.

Let’s say you have irreplaceable photos or video files of your first born, your round-the-world trip or of a loved one who has shuffled off this mortal coil. Where will you store these photos so in twenty years’ time they will still be intact?  Would you really trust iCloud or Google Drive with these? Maybe. But the reality is that cloud-based storage services are prone to hacking, sabotage and in some instances have been known to corrupt or simply lose data altogether. More worryingly, you have to ask: will these cloud storage providers even be around in twenty years’ time?

There is of course the option of storing your photos on a mechanical hard drive in the hope that in twenty years’ time when connected to your computer (probably via some USB-to-god-knows-what adaptor), it will spin into life (for those familiar with mechanical hard drives… stop sniggering) It might do that – but the risk that you will be greeted with clicking noises or no noises at all are too high.

Or, you could put your data onto an SSD (solid state drive). They have no mechanical parts and storing all your photos or videos on one of these is a much safer bet right? Not exactly because if you have an SSD drive which you stash in a drawer (cupboard, attic, etc.) for a number of years it will eventually start to lose its charge in the same way that a battery loses charge over time. This can have grave repercussions for your data as it is stored using quantum electron tunnelling which is reliant on stored positive and negative electrical charges. Error correction codes such as the Bose-Chaudhuri-Hocquenghem algorithm can be very effective in rewriting failed cells, but there comes a point where the errors become so pervasive that drive becomes unreadable. SSD manufacturers know about this phenomenon, but don’t explicitly state it in their documentation. Maybe buried deep in the small print, they might recommend that their SSD drives are to be used on host devices “periodically” or “at regular intervals”. This basically translates into “if you don’t use your SSD drive regularly, you’re going to lose your data”. Great.

There are of course disk mirroring devices (such as a DAS or NAS) which can be used to replicate your data over two or more disks (mechanical or SSD). While these do lower the risk of data loss – these devices are still subject to same failure factors as standalone disks.

This leaves us with the humble DVD. It is compact, non-magnetic, does not need to be “recharged” and is cost-effective.  For the long-term storage of photos, video footage or documents, it ticks a lot of boxes.

If your laptop or desktop computer did not come equipped with a DVD burner, an external USB DVD drive can be used. The actual recording takes place on the dye layer of the disk which is permanently altered by a highly focused laser beam. The DVD burning process can be tedious but it is time well spent if your data is in any way important to you. The main variants of DVD disk are DVD-RAM, DVD-R, DVD-RW, DVD+R and DVD+RW. For long-term storage, DVD-R has the best compatibility.  These are usually available in capacities of 4.7GB and 8.5GB. Many archival specialists working for state archive departments and archive departments of broadcasters swear by the Taiyo Yuden brand (a Japanese company whose blank DVD’s are also marketed under the JVC and “That’s” brand).  Verbatim also makes their UltraLife Gold Archival Grade DVD-R which are specifically designed for long-term storage are also well respected by archivists.

So, the next time you need to perform a backup of really important files which you would like to access in twenty years’ time, don’t forget about the DVD. When mechanical and SSD disks have long since failed and storage clouds have evaporated, the humble DVD will probably be the last man standing.

Drive Rescue Data Recovery is based in Dublin, Ireland. We recover data from external and internal hard drives (SSD and mechanical), servers, NAS devices and USB memory sticks. Brands we frequently work with include WD, Toshiba, Seagate and HGST disks. Our customers hail from the four corners of Ireland, including Dublin, Cork, Limerick, Galway, Waterford and Kilkenny.

Data recovery from Buffalo Terastation RAID 5 (XFS file system)

buffalo-nas-data-recovery-ireland

 

 

We recently helped a Dublin medical practice recover data from their failed Buffalo Terastation RAID 5 NAS device.

It was being used as a file server between four workstations in their office. One month previously, they had noticed that something might be awry when their NAS started to display error codes its LCD. But as their NAS continued to function, they did not give the error codes much heed. Then last week, their NAS became inaccessible altogether.

Diagnosis

We opened up their Terastation device. Inside we found 4 X 1TB Western Digital WD10EFRX-68PJCN0 NASware “Red” disks. We removed them from their bays and attached them to our recovery system. We discovered they were configured in RAID 5 (using a block size of 256KB) and the array was using the XFS file system. We performed diagnosis on each disk. Disk “0” had a problem with head “3” and disk “3” had extensive bad sectors. Disks “1” and “2” tested fine.

Data recovery solution

We would work with disks “1”,”2” and “3” to rebuild the array. We imaged all of these disks so we would be working with copies and not the originals. We now had the challenge of rebuilding the XFS volume. This took a few hours to manually reconstruct with the aid of a HEX editor. Eventually we had a mountable volume again but still no files were visible. This is quite normal after a reconstruction of an XFS array as there is a high probability that some allocation group header structures will still be “out of place” or some missing inode clusters may still exist. These needed to be rebuilt or corrected using XFS repair commands.

Files found

Once the volume’s files appeared, it was now time to extract them onto a 4TB external USB drive. Most of the files were .DICOM files (x-ray images, all of which were intact) which the client was very pleased to see again.

Beware of “warning fatigue”

Reflecting on this case, the client made two mistakes which eventually led to a data loss situation. Firstly, they had mistaken a file server for a back-up device. They believed that because it was a NAS device, it could not fail on them. This is a common misconception that users have about NAS devices. While they certainly do have a lower probability of suddenly and catastrophically failing, they can still fail, albeit slowly and with more warning than a standalone disk. But, in this case, they did not heed to the warning, namely the “I12” error message which they saw appear on the Buffalo’s LCD”. This is understandable.  The average user is getting bombarded with warning messages about everything from their media player software being out-of-date to low-ink warning messages from their printer.  When it comes to really important messages from, for example, back-up hardware or software, these can get “downgraded” in a user’s mind to “just another error message”.  System administrators or IT support technicians have an important role to play in delineating to users the importance of acting on any messages relating to data backup. Hardware manufacturers also have a role in making their error messages on their devices less cryptic and more comprehensible for your “average” user. For example, Buffalo’s “I12” code to signify it’s RAID is operating in degraded mode means very little to the average user. A more succinct message such as “array failing” might spur a whole lot more users into action and help them avoid the costs of data recovery!

Data Recovery of Toshiba PCIe SSD for MacBook Air (A1465)

macbook air data recovery dublin                                                            (fig 1 .Macbook Air A1465)

 

We were recently helping a corporate user from Cork recover data from their MacBook Air (mid-2013 model). He had been using this system without a glitch since he bought it in late 2013. However recently he turned on his system and received the dreaded flashing question mark on his screen. This ominous warning sign was made worse when he realised that his files were not being backed up to the company’s server and he was not using any local backup system such as Time Machine.  His IT support department were unable to recover data from SSDs but recommended Drive Rescue for data recovery

The user couriered the system to us. After removing the underside cover of his MacBook, we removed the drive from the motherboard. Inside we found a 256GB Toshiba SSD with a PCIe interface. This is an interface which we are seeing a lot more of lately as computing devices get smaller. The PCIe (Peripheral Component Interconnect Express) interface is a bus standard for many newer laptops, all-in-one PCs and desktop systems using ITX form factors. It overcomes the storage performance bottleneck of S-ATA III interfaces as it attaches directly directly to the PCIe host bus.  For example, a third-generation PCIe four-lane bus can handle up to 4 gigabytes/second with ease (depending on drive spec.) Moreover, power draw and I/O latency rates are also reduced. Coupled with the compact size of PCIe connectors, it is no surprise that manufacturers are moving away from S-ATA. But Apple (being Apple) have added a slight twist here designing a proprietory connector (see fig. 2) which is not compatible with standard PCIe connectors.

toshiba ssd data recovery dublin                                                           (fig 2, Toshiba SSD PCIe dive)

 

To connect the drive to our data recovery system we used a proprietary adaptor designed to handle MacBook Air A1465 drives, but we immediately received the BSY (short for busy) status.  When a drive is stuck in this state, it means it cannot receive or output data. To circumvent this problem, it is necessary to put the drive into what is known as “technological” mode. This can be achieved by physically shorting the drive using a laboratory-grade electronic tweezers.  With the BSY status now cleared, we were now able to see information about the drive’s ICs (NAND chips). Next we uploaded some new Marvell microcode to the RAM of our recovery system. After successful upload of the microcode we could see his HFS+ volume and in our recovery tree along with it’s folders and files. We imaged these to a new hard disk drive.

matlab data recovery dublin ireland  (fig 3. Mathlab – a popular mathematical analysis software suite)

Next, our customer was able to remotely log in to our secure servers to view his recovered data. The most important files to him included .XLSX, .PDF, .M and .MAT files. The latter two file extensions belonging to the MATLAB, a mathematical analysis software suite. Having to re-construct them would have been a time-consuming and laborious task. The next day, our more-than-happy financial analyst customer received all his recovered data on an external USB hard drive. He vowed that we would never again ignore Time Machine backup reminders!

Drive Rescue Data Recovery are based in Dublin, Ireland. We can recover data from most MacBook and MacBook Air drives including models such as the A1278, A1286, A1370, A1369, A1439, A1466 and A1502.

 

Drive Rescue @ CeBIT, Germany 2016

WP_20160316_16_06_19_Pro

 

Recently Drive Rescue were at CeBIT in Hannover, Germany checking out some of the latest storage technologies. There was some new and not so new storage devices exhibited there and some interesting speakers. CeBIT, the granddaddy of Europe’s IT exhibitions has certainly changed in the last few years. The days of exhibition halls being filled with Taiwanese motherboard manufacturers and Chinese PC component suppliers with names like Golden Dragon appear to be coming to an end. While there is still some of this, CeBIT is now more about IT innovation, business software, cloud technologies and high-end hardware. Some of that hardware included some of the latest storage evices from manufacturers like Toshiba, Western Digital, HGST and Huawei.

toshiba ssd data recovery ireland

Toshiba – is that an SLC or MLC SSD?

Toshiba were exhibiting their latest range of SSD drives. While their Q300 range uses TLC NAND chips, the Toshiba marketing department have come up with the clever new catergorisation of this range as using “SLC adaptive size technology”.  Nowhere in their marketing bumf does it state that it’s actually TLC NAND…Anyway official read/write speeds are only mediocre. For example, the 480GB version it has read speeds of 86,000 IOPS and write speeds of 520MB/s.

 

 

HGST’s 10 TB Helium SAS drive

HGST 10TB helium drive

This drive was one of the few drives on display that had it’s own glass case! It’s a helium filled 10TB drive with a 7200 rpm, 256MB cache and speeds of 12Gbps. Helium goes a little bit to solving the “magnetic recording trilema” of readability, writability and stability in multi-platter disks as by reducing turbulence inside the disk as the platters spin. Are mechanical drives with helium drives just a stop-gap measure until HAMR (Heat Assisted Magnetic Recording) production techniques get scaled up? possibly.  Helium does not really contribute much to significantly changing the disk read/write process nor does it result in massively increased areal densities. But expect to see these drives around for the next couple of years at least as Western Digital /HGST have invested significantly in helium drive production processes. And now Seagate have jumped on the helium bandwagon having unveiled their own 10TB helium SAS drive in January.

 

 

ssd data recovery service dublin ireland

Huawei SSD Drives

Huawei might be known for their budget smartphones and telecoms equipment, but are now players in the hard disk market. They have leapfrogged the mechanical hard drive market altogether in favour of high-performance and high-capacity SSDs . Their offerings at CeBIT have been far from modest. Pictured above is this whopping size 3.2 TB SSD. It uses PCI express 3.0, NVM and employs smart FLT. It’s NAND chips are from the Samsung and Toshiba stables. Alibaba (a trading platform), Ten Cent (a Chinese internet portal) and AIDA have already deployed these drives for their operations.

aida cruises migrate to SSD disks

German cruise ship operator throws their mechanical drives overboard

For the latter, AIDA a German cruise line operator, mechanical drives were proving to be too slow and too unreliable. Each of it’s ships generate massive amounts of data.  Movements of passengers on-board are tracked. Most retail transactions onboard are cashless. Entertainment systems must be 24/7 online. All of this means requires very fast processing times.  Previously, they deployed 10K SAS mechanical drives, but their IT administrators found these devices simply unable to keep up. And, because a ship is an environment which suffers from a lot of vibration, they were experiencing higher-than-average failure rates.  So, they decided to ditch mechanical drives in favour of SSD technology from Huawei. To mitigate against data loss, they use disk-to-disk on-board replication but also have the facility to peform data replication to any nearby sister ships (within a 100 km radius). Overall, their SSD migration has meant faster online transactions, simplified maintenance and more protected data. All uber efficient onboard AIDA ships ja…

phil zimmerman pgp symantec endpoint encryption

Phil Zimmerman and his journey with PGP Encryption

And talking of protected data Phil Zimmerman, inventor of PGP encryption and author of The Official PGP Users Guide gave an interesting talk on the journey of his well known PGP encryption protocol. His encryption journey intially started back in 1991 when he devised PGP as a human rights project. The strongest block-cipher available at the time was 56-bit DES which could easily be cracked by any nation-state hacker or large organisation. PGP was revolutionary at the time as it used a combination of data compression, symetric-key / public-key cryptography along with algorithms to encrypt session keys.

Back then, the demand for non-military encryption was relatively low. Companies operated in much less risky environments than today.  Most business rivals did’nt have any crypto-analytic capabilities. In the the early 1990’s, the civilian internet was still mostly used by academics and an ethos of “gentlemen do not read other gentlemen’s mail” prevailed. “It was a much more benign environment back then” Zimmerman lamented.

“People would ask you why are you using strong encryption, are you a criminal?”

The end of the Cold War heralded a surge of globalisation. Companies were now moving into countries with oppressive regimes and environments of aggressive signals intelligence. PGP now started to become more of a business tool. But, even still, some perceived encryption as something sinister. “The [US] government tried to put me in prison, for three years I was the target of a criminal investigation” Zimmerman told the audience. “In the 1990’s, if you were using strong encryption there was a stigma associated with that… people would ask you why are you using strong encryption, are you a criminal?” But ironically the publicity surrounding Zimmerman and the criminal investigation surrounding him had the unintended consequence (for governments at least) of making PGP even more popular. When the early 2000’s arrived and the internet becoming more hostile, PGP became even more sought after. In this period, even with many alternative encryption products now becoming available, PGP Whole Disk Encryption became one of the most widely used encryption applications by government bodies and multinational organisations.

From nefarious software to an essential security measure

data recovery from symantec endpoint disk ireland

Leaving aside the issue of government “backdoors” in encryption applications, the legislative environment in most Western countries now “officially” favours strong encryption.  In Ireland, for example, the Data Protection Act 2003 states that encryption “is considered an essential security measure where personal data is stored on a portable device”. In April 2010, Symantec bought PGP for approximately $370 million – a move which gave a company normally associated with anti-virus software a strong foothold in the encryption market. Today, PGP is known as Symantec Endpoint Encryption. It uses 128-bit or 256-bit AES block ciphers and is still widely used by organisations across the world.

 

Drive Rescue are based in Dublin, Ireland. We recover data from encrypted disks using applications such as Symantec Endpoint, Windows Bitlocker, Sophos Safeguard, McAfee Complete Data Protection / Safeboot, TrueCrypt, TrendMicro Endpoint Encryption, Checkpoint Endpoint and Apple File Vault. In most cases, data can be recovered even if disk has physical or electronic faults.