Samsung EVO SSD Data Recovery

The Samsung Evo range of 2.5” S-ATA and M.2 PCI solid state disks has proved extremely popular in Ireland for their speed, capacities and reliability. Typically, the EVO range (840, 850, 860) uses MLC-NAND coupled with in-house Samsung designed controllers. Capacities include 120GB, 240GB, 500GB, 1TB, 2TB and 4TB.  

While most users enjoy a trouble-free experience, there are occasions when data recovery is needed for your Samsung EVO SSD. Take last week for instance, we had a customer who had a Samsung EVO (MZ-7TD120) which was no longer initialising on their Windows 10 system. They removed the disk and connected it to a second Windows 10 computer using a USB 2.5” enclosure. However, it still remained inaccessible. They tried running some EaseUS data recovery on the drive but that too proved fruitless. They ran Samsung Magician software to help them diagnose the problem but the software could not even recognise the drive. When they attempted to open it, they were thwarted by some Torx screws. They sent the disk to Drive Rescue.

We first removed the metal casing of the SSD using a Pentalobe screwdriver. Then using a multimeter, we tested the voltages on the PCB. They appeared normal. Using a ESD-safe tweezers we applied them to the short points on the disk’s PCB to put it into Safe Mode. This would allow us to use a Samsung firmware emulator to access the NAND. The terminal read-outs from our Samsung SSD recovery equipment indicated that there seemed to be a problem with the FLT layer (Flash Translation Layer) of the SSD. This layer, found in the FW layer (firmware) assists the SSD with functions such as wear levelling and garbage collection. But more importantly, it peforms the vital function of logical block mapping. This maps the Logical Block Address (LBA) to phyical blocks on the NAND chips. Basically, it acts like an internal roadmap for yoru SSD. When it goes corrupt, the data cannot be accessed.

After a couple of hours of FW reparation work, and a few disk re-initisations, a valid NTFS volume was finally retrieved along with all the client’s data!

Drive Rescue are based in Dublin, Ireland and offer a complete Samsung SSD data recovery service for disks such as the EV0 840, 850, 860, PM863, PM863a, PM883, SM843T, MZ-7WD240HCFV, MZ-7WD480N and MZ-7WD4800.

Data Recovery from a Zyxel 320 NAS

Zyxel a Taiwanese company mainly known for their networking equipment for home and small business users also produce a range of NAS devices. These have proved popular in Ireland, however, like most NAS devices, Zyxel devices are liable to data loss events necessitating data recovery.

Their network attached storage range, which uses the rather unfortunate prefix of NSA, includes models such as the NSA 221, NSA 310, NSA 320, NSA 326 and NSA 542. Most of these models come in two or four disk-bay varieties, using S-ATA2 or S-ATA3 connectors and employ either EXT3 or EXT4 as their default file system. Most of these devices are configured in RAID 0 or RAID 1. Some of their 4-bay models can be configured in RAID 5, RAID 6, RAID 10 in JBOD.

Typical data loss scenarios include:

  • Your NAS device gets accidentally deleted.
  • Your Zyxel NAS device gets accidentally knocked over (yes, this happens more than you think…)
  • The EXT3 or EXT4 file system on your NAS experiences corruption. (Usually either Journal file or SuperBlock corruption)    
  • Extensive bad sectors developing on one or more of your disks resulting in your Zyxel NAS not appearing in Windows Explorer or Finder.
  • The disk-heads in one or more of your drives degrades or fails resulting in non-responsiveness, freezing or inaccessibility of your NAS.
  • The RAID controller on your Zyxel NAS can fail, resulting in accessible data.
  • Firmware corruption can occur on your NAS resulting in your device not being seen by Window’s Explorer or by Apple’s (macOS) Finder.  This can occur, for instance, due to a defective FW update or power surge.

Recently, Drive Rescue was performing data recovery from an NSA 320 device which was no longer being recognised by Windows. The user was extremely anxious to recover this NAS as there were over seven years worth of photos and videos stored on it. This content was of extreme sentimental value to him.

Of the the two S-ATA disks inside (Seagate 250GB ST3250824AS, part of the Barracuda 7200.9 family), our diagnostic tests revealed that Disk 1 had a problem with head # 4 – failing a simple read test twice. This explained why the RAID 0 volume was not accessible. Remember RAID is actually very fussy when it comes to reading data on even a simple array. (And with bigger disks being used, more read errors are likely thus making RAID less relevant in a modern IT environment)

This model of Seagate disk uses five heads. Using our data recovery equipment, we were able to manipulate the disk heads in RAM substituting head # 3 for # 4. We then imaged this disk along with Disk 0. With two images on hand, we now had to determine the block size, the offset of the array, the parity pattern, the parity delay pattern and find any spare blocks on the array. If you get any of these parameters wrong, you will end up with corrupted data. Thus, a hex editor, an old-school notepad, time, experience (and lots of patience) come in handy.  

After several hours, the EXT3 RAID 0 volume successfully rebuilt. Hundreds of the the client’s videos files (.m2ts format) from his Panasonic camcorder and (.CR2) files created using hfis Canon camera were all recovered. They were presented to him on a USB external hard disk – memories that he and his family can treasure for years to come.  

Drive Rescue are based in Dublin, Ireland. We offer a complete data recovery service for Zyxel NAS devices along with Synology, QNAP, ReadyNAS and Buffalo. Call us on 1890 571 571. We’re here to help.

What’s the difference between enterprise-class SSDs and consumer ones?

Many customers ask us if enterprise class SSDs are more reliable than consumer ones. In a nutshell, yes enterprise SSDs are more robust. However, enterprise class still disks such as the Samsung PM963, PM853T, SM843 and SM863 still fail and need data recovery.

However, there are a number of reasons why enterprise-level SSDs are more reliable than consumer-level disks.

  • Most enterprise SSDs tend to use controllers which employ smarter ECC engines. For example, some enterprise SSDs come with 24-Bit ECC along with CRC. This is very useful for minimising data corruption.
  • Most enterprise SSDs employ over-provisioning, which means the inclusion of extra or “spare” blocks to increase endurance.
  • Most enterprise SSDs often use an SDRAM cache for a more efficient handling of metadata.

There is another class of SSD which most people forget about and that’s industrial-class SSDs. These tend to be even more robust than enterprise-class models. For example, in the event of a sudden power loss, some industrial-class SSDs use special capacitors which provide enough energy for the SSD controller to finish any operations that are currently being processed. Some industrial SSD manufacturers, like Innodisk, take power loss protection even further by using a “low-power detector” in their disks, which triggers a recovery algorithm (iData) that assists the drive in shutting down gracefully while also preventing data loss and ensuring data integrity. In the event of corrupt data getting written to the disk, table-re mapping is deployed to delete it. Moreover, most industrial-class SSDs have much more resilience to temperature extremes, which is very useful if you are deploying an SSD in a cold store or smelting plant…

Drive Rescue are based in Dublin Ireland. We offer a full SSD recovery service for disks such as the Samsung PM963, Intel S3510, S3520 and San Disk X100, X400 and X600.

Data recovery from a LaCie D2 USB 3.0 Thunderbolt 2 external disk which was not showing up on Mac

LaCie external hard disks have always been extremely popular with Apple Mac users in Ireland. Most of their models of external disk tend to be high capacity and come equipped with Thunderbolt 2 or Thunderbolt 3 ports. Their “Rugged” range of external disks (such as Rugged Mini, Rugged Thunderbolt and Rugged Triple) uses Thunderbolt or USB-C ports. Disks in the “Rugged” range are swaddled in a distinctive orange rubberised overcoat to protect against shock damage

LaCie also offers a range of DAS RAID devices such as their 2Big, 2Big Quarda, 2Big Dock Thunderbolt 3, 4Big, 5Big and 8Big devices which offer high capacity local storage without having to use USB or LAN connections.

And LaCie is perhaps the only hard disk manufacturer to have introduced a range of “designer” external hard disks allegedly based on designs by the Porsche design studio in Germany.

While most users have a trouble-free experience. Unfortunately, some LaCie owners can experience data inaccessibility problems with their disks. These include:

  • Accidental deletion of HFS+, APFS formatted LaCie disk
  • Accidental deletion of HFS+, APFS or NTFS partition
  • Accidental shock damage (e.g. dropping your LaCie disk)
  • Power surge damage to your LaCie disk
  • LaCie disk with corrupted firmware

Such issues can manifest themselves in various ways, such as:

  • Your LaCie disk is not recognised by macOS when connected to your iMac or MacBook.
  • Your LaCie disk no longer spins ups.
  • Your LaCie disk is making a beeping, ticking or a clicking noise.
Data Recovery from a LaCie D2 Thunderbolt drive

Such a case happened only last week to a user in Mayo. They used a D2 Thunderbolt disk in their media production business for many years without incident. However, recently they connected the disk to the Mac computer and it was not recognised. Their local IT support company ran data recovery software which could not even recognise the disk let alone find any data. They sent the disk to us. We opened up the case and found a 4TB S-ATA Seagate IronWolf disk. (This was not really surprising as Seagate now owns the LaCie brand). Our diagnostics revealed 2 weak disk-heads. This explained why the disk was not being recognised. One of these heads was needed to read the Master Boot Record of the disk but couldn’t. In our class-100 cleanroom, we removed the old Head Disk Assembly (HDA) using a customised “head-comb” for Seagate Ironwolf disks. We replaced it with a new HDA. Due to the architecture of IronWolf disks, inter-head alignment (getting all disk heads aligned with each other) was time-consuming (but very important in order to minimise NRRO – non-repeatable run out errors). We then slowly imaged the disk overnight. (Trying to operate a disk which has undergone a “head transplant” at full speed can lead to the new disk-heads getting rejected) The following morning, we were able to initialise the disk but, to our dismay, still no HFS+ volume was showing. Further diagnostics, revealed that the file system just needed some repairing (this can happen occasionally after an HDA swap). After repairs to the file system had completed, we finally got the volume to mount successfully. All files were appeared intact and the volume even retained its “LACIE” name – always a good sign after recovery!     

Adobe Lightroom, MPEG, AVI files, and FCPX (Apple Final Cut Pro) files were all successfully recovered, saving our customer hours and hours of redoing work. He was now able to get on with his workflow with minimal disruption as if nothing had happened.

Drive Rescue offer a full data recovery service for LaCie D2 disks, LaCie Rugged, LaCie Big (RAID) and LaCie Porsche Design USB disks in Dublin, Ireland. LaCie Data Recovery in Ireland Call us on 1890 571 571

The problem of failing disks during RAID rebuilds and why RAID 5 is past its shelf-life.

Many IT admins contact us in a state of disbelief after discovering multiple cascading disk failures during a RAID rebuild. Why does this happen? Well, when you rebuild a RAID, every sector of each disk is read. The rebuild process is the equivalent of an Ironman challenge for your disks. This can make silent disk failures all manifest at once. It’s not that disks actually fail during RAID rebuilds (although this can happen), it just that when every sector of a disk is read, the failure threshold gets tipped. You can help mitigate against this by using disk rotation and employing hot spares on your array.

Avoiding the “bad batch” problem

Cascading disk failure is not the only problem that affects RAID. Another one is the so-called bad-batch problem, which can lead to near-simultaneous failure of RAID arrays. This can occur if there is a flaw in the manufacturing process or a design flaw in the disk. This flaw is then replicated in all of the disks from the same batch. If the flaw is serious enough it can result in near-simultaneous disk failures of multiple disks in your array. Some IT administrators procure the same type of disk from different vendors in order to avoid this problem, which can work. However, some RAID controllers don’t play well with different firmware versions, as is often found on disks procured from different batches. This can introduce a brand new set of headaches.

The one parity scheme, as used on RAID 5

The one parity scheme, as used on RAID 5

Why RAID 5 is now (almost) redundant?

RAID 5 was fine back in the day when arrays of smaller capacity disks were commonplace (like 250GB X 4). Now, with larger disks (2TB, 6TB etc.), the probability of a failed read during a RAID rebuild process becomes too high. During a rebuild, every sector has to be read. If there are any errors on a second disk, the rebuild will halt. With arrays containing individual disks of 2TB+ that is a big ask and makes RAID 5 unsuitable for most modern IT environments.

Two independent parity schemes, as used on RAID 5

Two independent parity schemes, as used on RAID 5

RAID 6 to the rescue

Enter RAID 6. This type of array uses two independent parity schemes. So even if one particular disk develops unreadable sectors, there is a second parity strip and your RAID rebuild should complete successfully.  

Drive Rescue are based in Dublin, Ireland. We offer a complete RAID 0, 5, 6, 10 data recovery service for HP Proliant, Dell PowerEdge, Fujitsu Primergy servers. We also offer a NAS data recovery service for Synology, ReadyNAS and QNAP devices.

Flight Diversions, Liquid Spills and Lost Data

Flight Diversions, Liquid Spills and Lost Data

Here at Drive Rescue, liquid or water damaged MacBooks is a perennial problem we encounter. In fact, accidentally spilt water, tea, soft drinks, coffee or beer is a such a common problem that Apple has strategicially placed around 8 or 10 “liquid contact indicators” on the logicboard of their MacBook and MacBook Air devices to detect spillage events. Seemingly, these sensors save their technicians a lot of time when it comes to diagnosing systems and assists them in deciding whether an Apple Care warranty has been invalidated by a spill.     

We recently helped a customer who experienced such an event. They spilt water on their MacBook Air (2014). They attempted to dry it out using a towel, cotton ear buds and even placed it in a basin of uncooked rice. However, despite their valiant attempts, their cleanup travails did not work. When they powered on their system, all they got was the dreaded White Screen of Death.

This incident could have happened to anyone. In fact recently, it was reported in the Irish media that an Airbus A330 pilot en route from Frankfurt to Cancun had to make an unplanned diversion to Shannon Airport because one of the pilots accidentally knocked his coffee cup onto the cockpit controls!

On recommendation of a colleague, our customer delivered the damaged MacBook Air to us. In the disk bay, we found a third-generation Samsung SSD (Model: MZ-JPV256). This disk uses a 12+16 connector and a PCIe 2.0 X 2 interface. Using a custom PCIe adaptor for Apple SSDs, we connected the disk our data recovery system. Dead as a dodo. After some further diagnostics, we discovered a short circuit on the disk’s PCB. This was remedied, but the disk was still not fully intitialising. Finally, after putting the disk into “technological mode”, we were able to access the HFS+ volume and retrieve the data (Word, PowerPoint, PDFs, .AVI and.VEG files)  

At least the customer could console themselves that the data recovery from their water damaged MacBook probably cost a fraction of what it costs to clean up the instrument panel of a multi-million euro A330 aircraft!

Data recovery of dictaphone recordings from an Iomega Go Portable Disk which was appearing as “not accessible” in Windows 10.

Data recovery from Iomega Go portable disk

The user tried to access the disk on several computers, but kept on receiving a message that their disk was “not accessible” followed by a message “You need to format the disk in drive E: before you can use it. Do you want to format it?” We opened up the plastic enclosure and found a Samsung HM100UI 2.5” 1TB disk.  

We attached it to our recovery systems. The MBR (Master Boot Record) could not be read at all. Further diagnostics revealed that one of the disk-heads was not reading. Using firmware manipulation tools, we disabled the faulty head and used specialised equipment to image the NTFS volume in PIO mode (a very slow data transfer mode). The files needed by the client Excel files and .DSS audio files from their Olympus dictaphone were all successfully recovered.

Adata (HV620S) External Hard causing Not Responding Errors in Windows 10 and no data showing.

A customer recently delivered their Adata HV620S external hard disk to us. When they plugged the 2TB disk into their Windows 10 PC, they received the error message “Not Responding”. The disk made their whole Windows 10 PC freeze and they could not access any data. They even tried to run the Checkdisk utility to fix the disk, but that too froze half-way through. Could Drive Rescue help? Of course, we have successfully recovered data from several Adata external hard disks before (such as the HD650 and HD710) and we were sure this model would be no exception!

We removed the disk from it’s plastic enclosure and found a Samsung Momentus ST2000LM003 S-ATA disk.  Our diagnosis revealed several translator issues and over 73,000 bad sectors. The translator plays a crucial role in the management of the disk’s data. And the disk sectors play an equally important role storing actual bytes of data. We resolved these problems within a couple of hours.

External Hard Disks and “Not Responding” error messages

Our customer wanted to know “why did Windows display the ‘not responding’ error message” every time the disk was connected to their computer?” The reason is simple.  Windows was not designed to work with disks that are failing. Windows (and MacOS for that matter) were designed with the underlying assumption that the attached storage device(s) are good.  

Why Checkdisk (CHKDSK) Cannot Fix Hard Disks

Our customer also wanted to know why the Checkdisk utility built into Windows could not fix the disk. Well, this utility was primarily designed by Microsoft to fix file system errors (FAT and NTFS) and to mark disk bad sectors. It was never designed to fix disk firmware or hardware issues. In fact, for a lot of disk issues, Checkdisk can do more harm than good. So, Checkdisk freezing during an attempted repair volume operation was probably a blessing in disguise!

Anyway, all the customer’s RW2 files (Panasonic Lumix RAW), .DOCX, XLSX and .PPTX files were all successfully recovered onto a new external hard disk. The relieved customer left our offices vowing never to trust a single hard disk with their valuable data ever again!   

Drive Rescue offers a full data recovery and repair service from Adata external hard disks in Ireland. We have previously recovered from models such as the HD650, HD700, HD710 and HD720. www.datarecoverydublin.ie

The story of an electric scooter, a steel fabricator and data recovery from a Toshiba hard disk

A structural designer for a steel fabrication company recently contacted us who experienced a rather unfortunate data loss event. He had been using his Acer laptop in his van to access his Strumis steel fabrication design application before visiting a site. He got interrupted by a phone call, closed the lid of his laptop and placed it on the passenger seat. The phone call ended and he drove off. However, 15 minutes later, when traversing a busy intersection an electric scooter sped off the footpath veering directly into his path. This necessitated some hard braking. This caused his Acer laptop to take flight into the van’s footwell as Mr. Speedy Gonzales scooter driver disappeared down the road.

With much trepidation he opened the lid of the laptop. The screen was ok, but they system had now turned itself off. He powered his Windows 10 system back on only to receive the message:

“Your PC couldn’t start properly. A required device isn’t connected or can’t be accessed”

Upon multiple restarts, this message came up repeatedly. He took the laptop to his company’s IT support department who could not access his files either. They recommended Drive Rescue.  

Diagnosis

Our diagnostics revealed that one of the read-write heads had failed. This problem was not helped be the fact that the laptop was switched on during the fall.

“A hard disk that is on when it falls will cause more damage”

The user was very unlucky in this case because, at the time of the fall, their laptop system was still on and hard disk was still spinning. A hard disk that is on (i.e. spinning) when it falls will always incur more damage. This is because the disk-heads will literally crash into the disk platters damaging themselves and in worst case scenarios scouring areas of the platter which hold data. If the laptop had been switched off before the fall – the user might not have needed a data recovery service at all. This is because, for most modern 2.5” and 3.5” S-ATA hard disks, when the disk is turned off the disk-heads are safely parked on the drive ramp. This is like a special “safe” area where heads can park when not in use.

Data recovery from (MK7575GSX) 750GB Toshiba hard disk

In another sense, this user was extremely lucky as platter damage was minimal. In our Class-100 clean room, we used a customised “head-comb” designed for the “MK” series of Toshiba disk, to gently remove the damaged Head Disk Assembly (HDA) from the chassis. Here extreme care must be taken to avoid any contact that the heads or HDA might have with the platters. Once removed, we inserted a new exact-match HDA locking it into place with the security pin. Once the main chamber was closed, we imaged the disk slowly.

The resulting recovery was very pleasing with 97% of files (Word, Excel, .JPEG and .BSWX Strumis files) being recovered. Months of steel fabrication designs for new building projects across Ireland were reunited with their thrilled creator. And hours of painstaking drawing reconstruction work were saved.

Drive Rescue, Dublin Ireland offer a complete data recovery service for Toshiba 2.5″ and 3.5″ hard disks. We have successfully recovered from models such as the MQ01ABD050, MQ01ACF050, MQ01ABD100, MK3275GSX, MK5075GSX, MK5059GSXP, DT01ACA200, DR01ACA050, P300, L200 (500GB, 1TB and 2TB Mobile Hard Disk), X300 and most models of Toshiba Canvio USB external disk http://www.datarecoverydublin.ie

Can Apple’s Hardware Test Detect Hard Disk Failure?

Like an increasing number of computer manufacturers, Apple includes a built-in hardware diagnostic test in their systems to help users or system administrators diagnose hardware faults. Apple Hardware Test (previously, Apple Diagnostics) comes in short and long variants, will mildy stress components such as an iMac or MacBook’s processor, logic board controller, fan motor, RAM modules and of course the hard disk. For the latter, you would hope that the test is fairly accurate so that your (or your user’s data) is not put in jeopardy.

What does “4HDD/11/40000000: SATA (0,0)” mean?

When Apple Hardware Test does detect a fault with your disk, it will display the rather cryptic error code “4HDD/11/40000000: SATA (0,0)”. This basically means that the AHT has discovered that your hard disk is failing.

How Accurate is Apple’s Hardware Test when testing a hard drive?

But, unfortunately, Drive Rescue has come across a substantial number of cases where the Apple Hardware test (short and long versions) did not detect a fault even when a hard disk was failing.

There are several reasons Apple’s in-built disk diagnostic utility cannot be relied upon:

  • Apple’s Hardware Test performs a random scan of the tracks of your hard disk. It does not scan your whole hard disk. The test could easily miss sectors of your disk which are failing.

  • Apple’s Hardware Test cannot detect firmware problems.

  • Apple’s Hardware Test will not always be successful in determining weak or unstable read/write heads. Often, during tests, random reads are short. In real-life, reads of contigious files can take much longer stressing the disk- heads much more.  

  • Apple’s Hardware Test cannot detect electronic issues with your disk’s PCB.

  • Apple’s Hardware Test cannot detect whether you have a corrupt HFS+ or APFS partition table.

In summary, the in-built testing hard disk which Apple provides with their iMac, MacBook and Mac Mini systems is just rudimentary disk diagnostic tool. It should not be regarded as infallible litmus test of a hard disk’s health.

Drive Rescue Dublin offer a complete data retrieval service for Apple Mac computers in Dublin. We recover data from dead iMacs, MacBooks, MacBook Air and Mac Minis. http://www.datarecoverydublin.ie. Prompt and professional service.