Data Recovery of Photos library from Seagate Desktop HDD 1000GB (removed from iMac).

Yesterday, we recovered photos from this ST1000DM003 hard drive. The disk had over 2500 JPEG files ensconced inside a Photos library. This APFS formatted Seagate S-ATA disk had firmware issues, but also had extensive bad sectors (over 36,000). When the disk was connected to another MacOS system via a USB 3.0 dock, it was not being recognised by Finder. The client even tried Target Disk Mode to recover the photos, but this also proved unfruitful.

Under the hood, the JPEG (Joint Photographic Experts Group) file format is a compressed format and as file structures go is actually quite complex. It comprised of multiple constituent parts such as the metadata and payload. When a disk goes bad or corrupt, it is usually the metadata which gets damaged

Connection to the disk’s serial port – enables us to access and make reparations to brain of the disk – the firmware!

Problem Solved

Firstly, connected the disk to our recovery system via its S-ATA and power connection. We then connected to disk to our recovery system using its serial port. The serial port on the ST1000DM003 is to the left of the    S-ATA data port and can be recognised as having 4 pins. Connecting the disk this way, gives us direct access to the disk’s firmware modules enabling us to repair the corrupt translator module. We then used our specialised data recovery equipment to long-read the damaged sectors of the disk.  This equipment is tuned to read data from damaged disks where a standard operating system such as MacOS, Windows or Linux would just generate multiple I/O errors.

Nothing evokes memories with such power as a photograph…

The Result

We achieved a 96% data recovery rate of the client’s MacOS Photos library which was of extreme sentimental value to them. With their memories restored – they could now treasure and enjoy them for years to come.

How to disable TRIM on an SSD using Windows Command Line or by using Apple’s Terminal

TRIM hoovers up accidentally deleted files in the same way that Pac-Mac devours the dots…

If you’re using an SSD and accidentally delete a file or folder in Windows (or in macOS), there is a substantial risk that TRIM, along with some other SSD house keeping functions, will thwart recovery efforts by deleting all data remanence. A simple way to think how TRIM works is just to think of Pac-Man – it operates inside your disk hoovering up deleted files in the same way that Pac-Mac devours the dots. Needless to say, this can be very problematic in terms of recovering data from SSDs.

So, let’s say an SSD user has accidentally deleted an important file or folder. Obviously, they should turn off their computer immediately, but before they do, they should be instructed to turn off TRIM as soon as possible. This just might help to make their deleted data more recoverable. If you are a Windows user, type “powershell” into the Windows search bar and “Powershell” should now appear on the menu. Then right-click to bring up the option “run as administrator”. At the command prompt, type “fsutil behavior set DisableDeleteNotify 1” to disable TRIM. (0 to re-enable). Mac users should go to Terminal and type in “sudo trimforce disable”. TRIM will now be disabled when you restart the computer.

Another way of disabling TRIM is to simply disconnect your SSD from your computer’s S-ATA or PCIe connection and access the disk via a USB dock or caddy. (For most disks, TRIM cannot work over USB). However, even with TRIM disabled, there are other background processes running inside your SSD which can also jeopardise the probability of a successful recovery. These will be discussed in another blog post.

Data Recovery from 1TB WD Slim Disk (WD10SPCX) which suffered an oil leak…

When most people think about hard disk components, they usually think of the disk-heads and the platters. Sometimes people will refer to latter as “the silver things that spin around and store the data”. Not very technical, but it gets the point across. Not many people however think of the less conspicuous parts inside a hard disk. Not many people know, for example, that your hard disk has a small air filter inside it to keep out contaminated air. Not many people know that most mechanical hard disks now use a sophisticated system for parking heads when they are not in use. And not many people know that most mechanical hard disks today use a sophisticated voice coil motor which can position disk-heads with nanometre precision. The modern mechanical hard disk is a derivation of different technological innovations, some of which, took decades to develop and refine.

Another of the lesser-known hard disk components is the fluid dynamic bearing (FDB). This is found in most hard disks manufactured since 2002. With the assistance of a motor, these bearings are responsible for moving the disk-heads smoothly and accurately over the disk platters. The concept of using ball bearings to assist in the operation of mechanical devices is not new. The sketchbooks of Italian engineer Vittorio Zona (1568 to 1603) depict bearings in several industrial applications such as paper mills and printing presses.  The concept of using hydrodynamic bearings was first implemented by a British railway engineer named Beauchamp Tower back in 1883.  He drilled a half inch hole to supply lubricant through a shaft and noticed how the oil would rapidly rise due to the immense fluid pressures. He also observed how the friction in the shaft was significantly reduced. Today fluid-dynamic bearings offer mechanical hard disk manufacturers the ability to make low-noise, low-vibration HDDs whilst increasing areal densities.

The traditional ball bearing, commonly used in electro-mechanical hard disks up until the early 2000s

Pre-2002, most hard disk manufacturers used traditional ball-bearings in their spindle motors. These could be extremely noisy and experienced high-levels of NRRO (non-repeatable run-out) meaning their positioning on the platters was not always precise and sometimes even erratic. Moreover, if the disk suffered shock-damage, it was very common for the ball-bearing mechanism to seize resulting in a stuck actuator arm and resultant inaccessible data.

The Fluid Dynamic Bearing – results in smoother running and quieter disks. It also allowed more accurate disk-head to platter positioning. Notice the herringbone shaft in the centre, this means the hydrodynamic pressure in the shaft is more evenly distributed (can be proven by the Reynolds equation) which results in less metal fatigue.

So, what makes fluid dynamic bearings such an improvement? Well, most FDB mechanisms do not use ball-bearings. This means less friction and less noise. Instead, they use an oil-air interface which means the spinning of the disk platters becomes a lot smoother and predictable. The dynamic tilt of the mechanism also becomes more predictable. And it’s not just the oil-air interface which enables these improvements in disk operation. The shaft of an FDB is etched with a herringbone radial pattern. This greatly enhances the stability of the bearing but also greatly helps to dissipate any shocks to the disk.

How Dropping your Disk or Laptop can cause an oil leak…

While the fluid dynamic bearing has been a boon for electro-mechanical disk technology. It’s not perfect. The oil inside the shaft can leak out. This can occur due to external atmospheric pressure, rapid temperature changes, but more commonly occurs if the disk has been dropped by the user. If, for example, your hard disk using a fluid dynamic bearing falls at over 1000G, it is probable that the air-oil interface will disintegrate, breaking the capillary seal and your disk will leak oil. And, if you’re a expecting a mini Exxon Valdez spill on your desk, this won’t happen. The amount of oil used in a bearing shaft is miniscule. In fact, with the naked eye, you probably won’t even be able to see it but you should be able to observe it weeping out with the assistance of a UV light. Once it has been drained from the bearing shaft, the platters will no longer be able to spin and your data will be rendered inaccessible.

“Hard Drive- Not Installed” Dell error message

This is exactly what happened to one of our customers last week. They accidentally dropped their Dell Latitude laptop containing a WD WD10SPCX disk. They booted up the system, but Windows 10 would not load. They ran the Dell diagnostics utility the “Hard Drive-Not Installed” error message was displayed.

How to recover data from the a WD Slim Disk such as the WD10SPCX

Our diagnostics revealed that the fluid dynamic bearing had failed. In this case, the FDB / spindle motor could not be repaired. Instead, using specialised tools, we removed the 2 platters from the problematic disk and migrated them to a chassis of an identical WD10SPCX model. This was an extremely tricky operation. After some precision inter-head alignment and torquing (using a Torx torque screwdriver) of the platter assembly, we closed up the disk. Now there was the firmware issue. If we used the same firmware as the donor disk, it is likely the disk would start clicking immediately. Modern disks are hyper-tuned. Therefore, we uploaded an exact copy of the original firmware onto our data recovery system. This finally gave us full access to the NTFS partition table where we able to recover the data.

This is just one of the problems which can affect WD Slim 2.5” disks. Other problems we’ve come with this Western Digital range of disk include:

  • Your WD Slim 2.5” disk is making a clicking, chirping or ticking noise
  • Your WD Slim 2.5” disk is not registering with your BIOS or on Windows system
  • Your WD Slim 2.5” is spinning, but is not assigned a drive letter.
  • Your WD Slim drive appears as “not formatted”
  • Your WD Slim drive appears as “not accessible” because the “parameter is incorrect”
  • When you connect your WD Slim drive to macOS, you receive the error message “The disk you inserted is not readable”
  • When connected to your Windows computer, your WD Slim disk causes your computer to freeze and display a “not responding” error message.

Drive Rescue, Dublin, Ireland offers a complete data recovery service for Western Digital hard disks including the WD Slim, WD Ultra Slim and recovery of WD My Passport Slim disks. Common models we recover from include the WD5000MPCK, WD10SPCX, WD20SPZW, WD20SPZX and WD My Passport Slim (1TB, 2TB and 4TB) . Call us on 1890 571 571. We’re here to help.

Best way to recover data from a WD Caviar Blue Hard 3.5” S-ATA Disk

The introduction of the “Caviar” range of hard disks by Western Digital in 1990 proved to be a real step change for electro-mechanical hard disks. This range of disks introduced, the then novel, concept of embedding servo (head positioning) information on the data tracks. But, even more importantly, this range of disks eschewed actuator arms powered by a stepper motor in favour of arms powered by a voice coil motor (VCM). Other disk manufacturers would soon emulate WD’s innovative lead.

Disks need servo information to correctly align the actuator arm (on which the read/write heads are mounted) to the data tracks. Up until then, most manufacturers stored most of their servo data on the disk’s ROM or NVRAM chip. However, storing it on the data tracks meant that the positioning information could be more easily modified or tuned during a production run resulting in more reliable disks less prone to non-repeatable run-out (NRRO) errors.

The Voice Coil Motor created a revolution in the hard disk industry by enabling high disk capacities almost overnight.

As already mentioned, the Caviar range introduced electro-mechanical disks which used voice coil motors instead of stepper motors to power and control the disk’s actuator arm. This motor type greatly constrained the number of tracks which the actuator arm (and hence heads) could reach. (Typically, the diameter of the motor casing determined the number of tracks which the head-disk assembly could reach). The continuous variable voltage of voice coil motors along with magnetic hysteresis-free operation resulted in more precise (disk) head-to-platter positioning capability.  This component also gave disk manufacturers the ability to almost double their drive capacities overnight.  

Every year in our Dublin-based data recovery laboratory, we recover from a substantial number of WD Caviar Blue 3.5” HDDs of varying capacities, such as 320GB (WD3200AAKX), 500GB, 750GB (WD7500AZEX), 1TB, 1.5TB (WD15EADS, WD15EARS), 2TB and 4TB(WD40EZRX). While Caviar Blue is Western Digital’s disk for standard uses such as general desktop computing. The Caviar family is also served by the WD Caviar Green line up of disks which are designed for slower speeds (5,400RPM) and quieter operation. While WD Caviar Black models are designed for performance (7,200RPM) and superior caching.

Like with any family of hard disks, there are a number of hardware, firmware and electronic failure modes which can affect Western Digital Caviar hard disks.

Corrupted firmware / damaged System Area (such as damaged translator, G-List, P-list etc.)

Seized or failed spindle motor – A hard disk has a second motor inside it to rotate the platters. Typically, this rotates at 5,200 RPM for Caviar Green, 7,200 RPM for Caviar Blue and Caviar Black.  

Printed Circuit Board Failure (e.g. failed diodes, resistors, etc.,) – This can fail due to over-voltage events. For example, a power surge or accidental liquid spillage can cause a PCB to fail.

Motor Controller Chip – A very common problem with WD Caviar disks is motor-controller failure. This occurs when the motor-controller (typically a Smooth chip) burns out. This can usually be attributed to an over-voltage event happening to the disk.

Pre-amplifier Chip failure – On the underside of a head-disk assembly there is a tiny chip (colloquially known as the “pre-amp”) which amplifies the read/write signals from the head. This component is extremely sensitive to sudden voltage changes. It can fail if the disk experiences a power surge or a liquid ingress event.  

Bad Sectors – While the level of quality of platters used in WD Caviar disks is relatively high, bad sectors can result in your disk failing to boot an operating system or your disk having inaccessible data when connected to a host.

Disk-Heads – Malfunctioning or failed disk-heads are a very common problem. Some disk-heads can malfunction due to wear-and-tear. In other instances, disk-heads on WD Blue Caviar HDDs can fail due to the disk suffering impact damage from an accidental fall. This often results in your WD disk making that dreaded clicking or knocking noise.

Platter damage – This is the often the worst and the most catastrophic type of failure. Platter damage means that even if the disk’s head-disk assembly is changed, most the of data will still be inaccessible. A lot of users ask us why this occurs. Disk-heads traverse along the platter tracks to read, write and erase data. This movement is extremely precise and even a speck of dust can knock the disk-heads off course. So, when the disk-heads meet a section of the platter which is damaged (due to a scratch or notch), they immediately get “derailed”. The means that the head-disk assembly (HDA) can no longer read the data. And even if you replace the HDA with a new one, the same fate will be suffered. In fact, it’s similar to a train trying to traverse a piece of rail track which is buckled. The train might be in perfect condition, but as soon as it reaches the buckled track, it too gets derailed. The same phenomenon happens with disk-heads reading damaged platters except on a more microscopic scale.

Western Digital (WD) Caviar Disk Problem Suggested Solution / Best Way to Recover
You receive a SMART notification in your computer’s BIOS that your Western Digital Caviar Blue disk is about to fail.Backup your data as quickly as possible.
Your disk is making a clicking, knocking, buzzing or scraping noise.Power-down your disk immediately. Re-initialisation of disk risks damaging it further.
CHKDSK (Checkdisk) keeps on trying to repair your WD Caviar Blue disk.Checkdisk is designed to fix small errors on disks.Checkdisk is not designed to fix more serious issues when a disk is failing. Refrain from using it.
Your 3.5” S-ATA Caviar disk spins, but cannot be seen or be recognised by Windows Explorer or by Finder.Try connecting your disk using a USB dock.
You’ve attempted to run the DLGDIAG (Data Lifeguard Diagnostics) test on your disk but the test cannot complete. Sometimes the WD Data Lifeguard cannot be completed by there are unreadable sectors on your disk. This if often due to bad sector or media damage. Backup your data as soon as possible.
Your Caviar disk cannot be detected in your computer’s BIOS.Possible PCB failure. Please note that just swapping the PCB with an identical one will not work. The U12 ROM containing crucial adaptive information chip needs to be transferred over also.
Your NTFS-formatted Western Digital Caviar disk appears as “unallocated” in Windows.Try running a data recovery software application. However, do not run any software on the disk if it is making strange noises as you exacerbate the problem.

Case Study: Data recovery from a WD Blue Caviar 1TB disk

Our client, a civil engineering department of a county council had a WD Caviar Blue (WD10EALX) disk which they needed to recover. Their IT support team removed the disk from a Dell workstation which was displaying the “no operating system found” error message. They slaved the disk to another system, but were unsuccessful in retrieving its data as the disk kept on freezing the host system. They had a lot of BIM files (Building Information Modeling) stored on it which were needed for one of their projects.

Our diagnosis revealed that 3 of the 4 disk-heads on the head-disk assembly (HDA) had failed. We replaced the HDA in our clean-room. We imaged the WD Caviar Blue disk and we able to access 99% of their data on the NTFS volume. The files (.DGN) were created using Bentley Microstation and were needed for a new recreational area the council were planning. The files contained survey, modelling and draft data. Recreating this data would have been extremely time-consuming, not to mention soul-destroying. All the data was delivered to them on a new 1TB external hard disk.  

Drive Rescue Data Recovery is based in Dublin, Ireland. We offer a complete disk repair and data recovery service for Western Digital (WD) disks. Common WD Caviar models we recover from include the WD2500AAKX, WD3200AAJS, WD3200AAKK, WD3200AAKS, WD3200AAKX, WD500AAKX, WD500AAKS, WD500AAKS, WD500AAKX,WD500LPLX, WD6400AAKS, WD10JPVX, WD10EALX, D10EZEX,WD1003FZE,WD20EARS and WD20EARX. Call use on 1890 571 571 or visit WD Caviar Disk Recovery Dublin Ireland

Data recovery from Freecom Tough Drive making a knocking noise

Freecom make a popular range of external hard disks which have been on the Irish market for almost 20 years.   Recently, a customer delivered to us a Freecom Tough Drive USB 2.0 which was no longer being recognised by any of their computer systems. When connected to their Windows computer, it would make a knocking noise. The disk contained thousands of .JPEG and Sony RAW images – all of which were of extreme sentimental value to our client.

There are many reasons why a Freecom external hard disk may fail to be recognised by a Windows or Apple Mac computer. These include bad sectors caused by damage to the magnetic layers of the platters (due to chips, cracks or due to the build up of debris). These can result in constant I/O errors or “disk is unformatted or disk is unallocated” error messages when the Freecom drive is connected to a host system.

Or, a Freecom drive may develop corruption in the disk’s system (or servo) area. This area contains firmware modules vital for the smooth operation of the disk (such as head-to-track positioning and velocity control information) When these instructional modules become unreadable, your disk will no longer be able to initialise.  

A lot of older model Freecom disks (such as Freecom Classic) still use the FAT32 partitioning scheme. This type of partitioning is now finally being deprecated as the de facto file system for external hard disks in favour or NTFS or exFAT. The FAT32 partition table contains information about partition size, cluster size and root directory location. This table also contains metadata pertaining to file attributes such as file names, size and file timestamps. Corruption of your Freecom’s FAT32 partition table can result in your disk becoming inaccessible.

In this particular case, our diagnosis revealed that this Freecom drive (using a Fujitsu 5,400RPM MHY2250BH-ATA disk inside) had developed two faulty disk-heads. (Heads perform the crucial function of reading and writing data to the disk’s platters). Further investigations on this disk revealed that the voice coil motor (VCM) and head disk assembly were unable to get their servo “instructions” from the system area because the damaged heads. Thus, when the disk tried to initialise, it had no instructions on where to position the head disk assembly. Therefore, the actuator arm (on which the heads are mounted), being in a state of limbo, moves frantically across the platters looking for a position whilst generating knocking noises.

We had a replacement head-disk assembly (HDA) already in stock which we replaced in our clean-room. However, even with the HDA replaced and aligning perfectly with the platters, we were still unable to fully access the volume. Our data recovery system could read the disk as far as LBA 23,242,82 and then the volume would be invisible. This will sometimes happen with Fujitsu disks because they have a very temperamental translator. Using our data recovery equipment, pre-loaded with Fujitsu FW modules we were able to regenerate the disk’s translator. We re-powered the disk and finally got access to it’s data!

Drive Rescue offer a complete data recovery service for Freecom external hard disks which are clicking, appearing as unformatted or no longer recognised by your computer. We frequently recover from models such as Freecom Tough Drive 320GB, Freecom Tough Drive 500GB, Freecom Tough Drive 1TB (56057), Freecom Tough Drive 2TB (56331), Freecom Mobile Drive Classic 2.5”, Freecom Mobile Drive MG 500GB Slim, Mobile Drive MG 1TB Slim, Freecom Hard Drive Classic,  Freecom Classic 3.0, Freecom Network Drive 1TB, Freecom Network Drive XS and Freecom 29409, 29492, 33708, 33745 and 35610. Your memories and work projects recovered with excellent success rates. Call us on 1890 571 571.

I’ve spilt water, tea, coffee, beer on my laptop, can I retrieve its data?

Accidentally spilling water, coffee, tea, beer or any other liquid on your laptop is not a nice feeling. But don’t fret your data might still be recoverable.

The liquid itself doesn’t do the damage...

Here is an interesting fact: it isn’t the liquid itself that damages the
electronics, it is the salts and minerals in the liquid (known as dissolved
electrolytes) that damage the circuit. These “impurities” in the liquid –
especially those minerals, which are very good conductors – can create
deposits on the disk’s PCB and cause a short-circuit. This can result in
an unpredictable mode of operation when the device is powered up. For example, if you spill deionized water (which has been treated to remove all ions) directly in the printed circuit board (PCB) of an electronic device, no ionic reaction will occur and you can just dry the device. In fact, during the production process of the components, many manufacturers themselves use deionised water to remove flux and other residues that have been left during the soldering process.

How can liquid damage a disk’s PCB?

Water (or liquids in general) can damage PCB components in three
ways:

Corrosion is the natural degradation of metals caused by a
chemical reaction with the environment. For example, the
interaction of water and oxygen with the metals in the PCB creates
iron oxide (in other words, rust). This reaction typically occurs after
a prolonged interaction period. These mineral deposits on the PCB
can corrode metal (pins and tracks), increasing the probability of a
short circuit. This explains why a user can spill liquid on a laptop
with no immediate effect, only for the system’s motherboard or disk
to fail two months later.

IC package: the majority of integrated circuits (ICs) used on a
solid-state disk PCB have a humidity tolerance. Most of them are
sealed to some extent, but if water infiltrates them, this can cause
an internal short circuit. Moreover, the extraction of this moisture
from an IC can be extremely difficult.

Shorting of components, vias and tracks: impurities in the water
can make it conductive, and once it starts to interact with the disk’s
PCB, current flows can become very erratic. For example, the
current might take the shortest path through the water back to the
power source. This can result in a damaged PSU (power supply
unit) and damaged components due to over-voltage.

Some components are more susceptible to liquid damage than others,
including devices that use micro-electro-mechanical systems (MEMS).
MEMS are the integration of mechanical elements, sensors, actuators
and electronics in a common circuit with micro-fabrication technology as
accelerometers, optical devices, and piezoelectrics. These are typically
found on electro-mechanical hard disks (HDDs).

What to do if you’ve spilt water, tea, coffee, beer etc. on your laptop?


Successful repair of a water or liquid damaged SSD drive depends
on several factors, including the amount of time the liquid stays in
contact with the PCB, whether the device was powered on at the time of
the spill and the remedial actions the user took after the incident
occurred.

Saving your SSD from water damage – what to do if you have spilt
water, beer, coffee, tea or any other liquid on your laptop

1) Don’t panic, keep calm, be safe: prioritise your safety.
Acting in a calm and collected manner reduces the chance of
incurring collateral damage.


2) In certain cases of accidental liquid spillage, try not to
move your laptop.
This can result in the liquid getting agitated
and penetrating deeper into the circuitry of your system.


3) Turn off the device and remove its power source. This can be
done by either disconnecting from its power source or
removing all the batteries, including the CMOS battery. This is
important because voltage flowing through the device will
greatly accelerate the level of corrosion damage incurred by a
liquid spill.

4) Try to mop up excess water around the keyboard and
laptop base.
Take some paper towels or a clean rag and try
to dry up as much of the spill as you can.

5) If your SSD bay (PCIe or S-ATA) is easily accessible and
you have the tools to open your laptop, try to dry up the
excess liquid from around the SSD with a non-static cloth.
Then remove the SSD from the computer.


6) Clean the SSD with isopropyl alcohol or deionised water
with a soft brush. Make sure that all residues are removed
from the PCB components, such as resistors and diodes, and the vias and tracks. If you have access to a spread-spectrum
ultra-sonic bath, use it.

7) Always leave plenty of time to allow your SSD to dry out
properly. Avoid the temptation to switch it on to “see if it
works”. A hot-air gun at set 100C can accelerate the drying
process. Failing that, place the disk in sachets of silica gel
desiccant.


8) If the device, such as a laptop or hard disk, does successfully
turn on, backup the data as soon as possible. Electronics
which have been in contact with liquids cannot always be
relied upon.

For advanced users only: some completely counterintuitive
advice on liquid damaged SSDs.

The following advice may seem counterintuitive, but in certain
cases, it is safer to not completely dry your liquid damaged SSD! Yes,
keep the SSD moist until you send it to a recovery specialist. As
previously stated, the water/liquid itself will not damage the device, it is
the mineral content of the liquid that causes the damage. So, if you do
not dry the SSD properly, the minerals residue can dry and corrode the
PCB tracks, vias and components (capacitors, diodes etc.). This
explains why black box flight recorders recovered from a downed aircraft are kept bathed in a container of water by the salvage team. We are not suggesting that you keep your water-damaged disk submerged in a container of water but there are a number of steps you can take to prevent mineral damage.

Cover the SSD with a damp paper towel, cloth or tissue and
put it inside an airtight plastic container or bag
. Preserving the
SSD in this manner will keep the device moist, minimise damage
and maximise your chances of a successful data recovery
operation.

Clean the SSD’s PCB with isopropyl alcohol or deionised
water to remove any excess minerals, especially if the liquid that’s
come into contact with the SSD has a large number of salts.

Drive Rescue Data Recovery Dublin offer a full data recovery service for liquid damaged hard disks and laptops. We recover data from systems such as MacBook Air, MacBook Pro, HP laptops (EliteBook), Dell (Latitude, Inspiron) and Lenovo (Thinkpad, YogaBook and Ideapad) and Asus (Zenbook and VivoBook) Call us on 1890 571 571. Click here for more on water damaged data recovery.

The Fatal Flaw of Time Machine and Data Recovery from a Seagate Expansion Portable Drive

Let’s face it. Time Machine is great. Plug in an external hard disk. Click on a button, and when the process is done, you have a complete backup of your iMac or MacBook. (In fact, in some cases, this process will be totally automatic – without any user intervention). You’ll be hard pressed to find a backup solution that is so seamless. So, what could possibly go wrong?

Well, last week we came across an interesting case. A user decided to perform a fresh installation of MacOS on his iMac. The operating system on it was running rather slowly. So, using Time Machine (software) in conjunction with an external hard drive, he performed a complete backup of his system. He then proceeded to wipe his internal disk, safe in the knowledge that he had a complete, up-to-date backup stored on his external drive (a Seagate Expansion Portable 2TB).  

On the wiped internal disk, he re-installed MacOS Catalina. In less than 90 minutes, he had a nice and fresh operating system (Catalina 10.15.7) up and running. All he had to do now was to import his old applications and data which were safely backed up (or so he thought). He connected his Seagate Expansion Portable disk via USB and opened Migration Assistant. To his horror, though, no disk was detected. He checked the USB and power connections. They appeared to be okay. He disconnected and reconnected the disk, but no disk showed up.

When a Time Machine backup disk won’t restore…

He phoned Apple technical support. They advised him to start his iMac in Recovery Mode. From there, the option to restore from Time Machine was also presented. In Recovery Mode, he selected this option and his disk was finally recognised. But the about three quarters of an hour into the data migration process, he was greeted with an error message indicating that the migration process “could not complete”.

On his second call to Apple technical support, they suggested to him that he contact a data recovery service!

The fatal flaw with Time Machine

While Time Machine processes such as Fsevents and Spotlight are very clever in backing up files incrementally, TM does not appear to check the condition of the target disk. Coupled to this, MacOS’s Data Migration process is uber-fussy about disk condition. Any hint of a disk problem and the migration process can come to a shuddering halt. So, while MacOS will allow you to back up to a disk which is going bad, it won’t let you restore from one.

Recovery from Time Machine disk

For our customer, we made the process as stress-free and economically as possible. His Seagate Expansion disk had over 47,000 bad sectors and some translator (firmware) issues which were making some disk sectors invisible. While some of his application, files were damaged, we managed to retrieve most of his data files intact.

Solution to the Time Machine Problem

Apple badly needs to incorporate some kind of disk health-check utility into Time Machine. This could save a lot of users the stress and hassle of data loss situations.

In terms of what the user can do to prevent this sort of event, don’t just rely on one backup disk. Use two. Moreover, you can mitigate the risk again by using third-party backup software on your Mac such as Carbon Copy Cloner or Super Duper.

Having problems restoring a Time Machine backup? Drive Rescue offer a complete external hard disk data recovery service for external Seagate Expansion Portable disks. Phone us on 1890 571 571

Data recovery from Seagate Barracuda 1000 GB Hard Drive

This morning we successfully recovered from this Seagate Barracuda 3.5″ ST1000DM003 hard disk for a business client.

This disk is from Seagate’s dreaded “DM” family, which is notorious for developing problems with its media cache, problems with flaking platters and issues with weak heads. This disk had an issue with all three.

Software to recover a inaccessible Seagate disk?

The client’s IT support did try to run data recovery software on this Seagate disk. However, while the disk was recognised. The data recovery software kept on freezing during operation.

Why data recovery software is useless at recovering from ST1000DM001,ST1000DM003, ST2000DM002, ST2000DM0006 ST3000DM007 series disks.

Unfortunately, data recovery software is designed to run on healthy electro-mechanical disks. It is not designed to run on disks with firmware problems or disk-head problems. Nor, it is designed to work on disks which have flaking platters!

We backed up the ROM, P-list, non-resident G-list, translator and firmware overlays. We then resolved the media cache issue which finally took the disk out of its continual “BSY” or “busy” mode. We then modified the head-map and imaged the disk at very slow speed.

All of the client’s Word, Excel, PowerPoint along with their Herbst ERP data files were successfully recovered.  The recovered files were delivered on a new USB external disk to the delighted customer.

Drive Rescue are based in Dublin, Ireland – we offer a complete data recovery service for Seagate failed hard disks

Data recovery from an inaccessible PNY CS900 SSD.

The two main areas of an SSD are the User Area and the System Area. The former stores the actual data while the System Area contains firmware code essential for the operation of the disk. The System Area is one of the busiest areas of the disk because some of firmware code is stored here. (Additional firmware code is stored on the controller chip itself) Every time the disk is intialised, the SA needs to be read. Everytime a Bad Block Management operation is executed, the SA is read. Even when the disk is shutting down, the SA is accessed or written to again as error logs are updated.

The Achilles Heal of SSDs

It’s no surprise then that this area of the disk  wears out the quickest. Moreover, the SA area is not protected by ECC (error correction management) which means small bit errors which develop in this area are not corrected.

As a result, when the oxide-layer of the NAND cells in the SA degrades due to constant wear-and-tear, the intructional code needed for disk operation can no longer be read. This can result in an SSD which is no longer recognisable by your computer.

“Fatal Device Hardware Error”

Last week, we were helping a medical device company in Sligo with this problem. Their PNY CS900 SSD (taken from a HP EliteDesk PC) was no longer recognised. When connected to a Windows PC via a USB dock, they received the message “The request failed due to a fatal device hardware error”. The disk was using a SMI 2258H controller and appeared to have a worn out Service Area. We put the disk into technological mode and used a 2258H loader (on our recovery equipment) to access the file system. We achieved a complete recovery of all their  SLDDRW, SLDPRT and SLDASM (SolidWorks) files.  This recovery, saved their technicians hours of reconstructing some very intricate technical drawings.

Drive Rescue data recovery are based in Dublin, Ireland. We provide a complete SSD recovery service for disks which are no longer recognised in BIOS, not recognised in Disk Management or not appearing Windows or MacOS. Common models of PNY SSD we recover from include the PNY CS900 250GB, PNY CS900 480GB, PNY CS900 960GB and 1TB. We also recover from their XLR8 CS3030 PCIe SSD and the PNY Portable Elite Black USB drive.

Data recovery from Intel SSD – how Covid-19 prevention measures can lead to data loss…



Any measures taken to prevent the propagation of the SARS-CoV-2 in Ireland are laudable. However, we came across an interesting case last week where a preventative measure resulted actually resulted in a data loss situation.

How one bottle of Isopropyl Alcohol and a Frayed Laptop Cable nearly led to disaster…

Let me explain. The staff of a church parish office in the Midlands were using bottles of Isopropyl Alcohol (pure alcohol) as a disinfectant. (Alcohol of over 70% purity being a highly effective agent in deactivating the virus) However, recently one of their alcohol bottles got knocked over, spilling the liquid over a desk and onto their office floor. No big deal right? Well, this is where it gets interesting. The mains power cord connected to their Fujitsu laptop was frayed exposing some bare wiring. In accordance with Murphy’s Law, some of this high-purity alcohol, which is highly flammable, came into contact with this wire. This resulted in an immediate power surge to the laptop along with a dramatic plume of smoke emanating from its rear ventilation grill. This was shortly followed by a strong burning smell. Great – just what you want on a Monday morning! Luckily, no one was injured. The office staff quickly disconnected the power cord from the wall socket.

Parish records up in smoke?

After having composed themselves and with some trepidation, they turned the laptop back on. The system fan momentarily spun up and then spin down. The screen remained black. All the parish records stored in .MDB (Microsoft Access) were stored on the system as well as their Sage accounts file (ACCDATA file). The last backup they had was over eight months old. Updating parish records and reconstructing accounts would have incurred a significant administrative overhead on the office. It would have also been a soul-destroying task.

Their IT support guy removed the Intel 2500 Series SSD (encrypted with VeraCrypt) from the disk bay of the Fujitsu. Using an S-ATA cable he slaved it onto another PC, but alas, it was not showing in Windows Explorer nor in Disk Management. In fact, it was not even detected by the PC’s BIOS. They sent the drive to Drive Rescue to see if we could help.  

Diodes that died…

Our data recovery systems could not recognise the disk either. We removed the metal enclosure surrounding the PCB (printed circuit board). We used our electronic microscope to examine the NAND chips and board components. Nothing really stood out except for the two diodes near the S-ATA connector which looked a bit “off colour”. We zoomed in on them and their appearance looked as if they had been subject to some sort of recent over-voltage event. Using a multimeter, we tested the suspect components. Both gave a reading of “OL” (open loop) in both (current) directions. Neigbouring diodes tested fine. We micro-desoldered the two diodes off the SSD’s printed circuit board. After a lengthy identification process, we were able to identify the diode type. (Intel does datasheets for this SSD model SSD, but not to PCB component level of detail). We ordered identical replacement diodes from a specialist supplier in Germany. Upon arrival, we soldered the new diodes into position. After letting them bed in, our multi-meter tests showed them to be fully operational.

Resurrection of Data…

We connected the SSD to our recovery system again. This disk model and capacity was recognised which was promising but no logical disk volume appeared. So, we put the disk into “technological mode” which finally revealed a volume of randomised data. This is exactly what we were looking for. Unlike encryption applications such as BitLocker or Symantec Endpoint, VeraCrypt does not use encryption signatures. After resolving some disk offset issues, we imaged the volume to another SSD. We then decrypted this volume to finally get a valid NTFS partition with a very healthy looking folder structure showing. We extracted these onto an external USB drive. The parish office got all their records and accounts files successfully retrieved.

Lessons from this case:

  • Always use a power surge protector to act as an intermediary between mains power and your computing devices.
  • Similar to a lot of accidents, a series of small failures or errors in IT systems often culminate in data loss. In this case, if the frayed laptop power cord has been replaced, no power surge would have occurred. It pays to have well maintained equipment. And it pays to resolve small issues with computing devices, backup systems or storage devices quickly before they play a role in a data loss event.
  • And finally, just one up-to-date back-up would have negated the need for data recovery. Get into the habit of backing up or just use one of the many automated backup solutions on the market.   

Drive Rescue data recovery is based in Dublin, Ireland. If your Intel SSD disk is not being recognised or has just stopped working – we can help you recover data from your Intel SSD. We offer a full data recovery service for Intel SSDs such as the 520, S3500, S3510, S3610, S3700, S4500, P3520, P3700, P4500, P5450, 660p and 800p (Optane).