Month: November 2019

The Samsung Evo range of 2.5” S-ATA and M.2 PCI solid state disks has proved extremely popular in Ireland for their speed, capacities and reliability. Typically, the EVO range (840, 850, 860) uses MLC-NAND coupled with in-house Samsung designed controllers. Capacities include 120GB, 240GB, 500GB, 1TB, 2TB and 4TB.  

While most users enjoy a trouble-free experience, there are occasions when data recovery is needed for your Samsung EVO SSD. Take last week for instance, we had a customer who had a Samsung EVO (MZ-7TD120) which was no longer initialising on their Windows 10 system. They removed the disk and connected it to a second Windows 10 computer using a USB 2.5” enclosure. However, it still remained inaccessible. They tried running some EaseUS data recovery on the drive but that too proved fruitless. They ran Samsung Magician software to help them diagnose the problem but the software could not even recognise the drive. When they attempted to open it, they were thwarted by some Torx screws. They sent the disk to Drive Rescue.

We first removed the metal casing of the SSD using a Pentalobe screwdriver. Then using a multimeter, we tested the voltages on the PCB. They appeared normal. Using a ESD-safe tweezers we applied them to the short points on the disk’s PCB to put it into Safe Mode. This would allow us to use a Samsung firmware emulator to access the NAND. The terminal read-outs from our Samsung SSD recovery equipment indicated that there seemed to be a problem with the FLT layer (Flash Translation Layer) of the SSD. This layer, found in the FW layer (firmware) assists the SSD with functions such as wear levelling and garbage collection. But more importantly, it peforms the vital function of logical block mapping. This maps the Logical Block Address (LBA) to phyical blocks on the NAND chips. Basically, it acts like an internal roadmap for yoru SSD. When it goes corrupt, the data cannot be accessed.

After a couple of hours of FW reparation work, and a few disk re-initisations, a valid NTFS volume was finally retrieved along with all the client’s data!

Drive Rescue are based in Dublin, Ireland and offer a complete Samsung SSD data recovery service for disks such as the EV0 840, 850, 860, PM863, PM863a, PM883, SM843T, MZ-7WD240HCFV, MZ-7WD480N and MZ-7WD4800.

Zyxel a Taiwanese company mainly known for their networking equipment for home and small business users also produce a range of NAS devices. These have proved popular in Ireland, however, like most NAS devices, Zyxel devices are liable to data loss events necessitating data recovery.

Their network attached storage range, which uses the rather unfortunate prefix of NSA, includes models such as the NSA 221, NSA 310, NSA 320, NSA 326 and NSA 542. Most of these models come in two or four disk-bay varieties, using S-ATA2 or S-ATA3 connectors and employ either EXT3 or EXT4 as their default file system. Most of these devices are configured in RAID 0 or RAID 1. Some of their 4-bay models can be configured in RAID 5, RAID 6, RAID 10 in JBOD.

Typical data loss scenarios include:

• Your NAS device gets accidentally deleted.
• Your Zyxel NAS device gets accidentally knocked over (yes, this happens more than you think…)
• The EXT3 or EXT4 file system on your NAS experiences corruption. (Usually either Journal file or SuperBlock corruption)    
• Extensive bad sectors developing on one or more of your disks resulting in your Zyxel NAS not appearing in Windows Explorer or Finder.
• The disk-heads in one or more of your drives degrades or fails resulting in non-responsiveness, freezing or inaccessibility of your NAS.
• The RAID controller on your Zyxel NAS can fail, resulting in accessible data.
• Firmware corruption can occur on your NAS resulting in your device not being seen by Window’s Explorer or by Apple’s (macOS) Finder.  This can occur, for instance, due to a defective FW update or power surge.

Recently, Drive Rescue was performing data recovery from an NSA 320 device which was no longer being recognised by Windows. The user was extremely anxious to recover this NAS as there were over seven years worth of photos and videos stored on it. This content was of extreme sentimental value to him.

Of the the two S-ATA disks inside (Seagate 250GB ST3250824AS, part of the Barracuda 7200.9 family), our diagnostic tests revealed that Disk 1 had a problem with head # 4 – failing a simple read test twice. This explained why the RAID 0 volume was not accessible. Remember RAID is actually very fussy when it comes to reading data on even a simple array. (And with bigger disks being used, more read errors are likely thus making RAID less relevant in a modern IT environment)

This model of Seagate disk uses five heads. Using our data recovery equipment, we were able to manipulate the disk heads in RAM substituting head # 3 for # 4. We then imaged this disk along with Disk 0. With two images on hand, we now had to determine the block size, the offset of the array, the parity pattern, the parity delay pattern and find any spare blocks on the array. If you get any of these parameters wrong, you will end up with corrupted data. Thus, a hex editor, an old-school notepad, time, experience (and lots of patience) come in handy.  

After several hours, the EXT3 RAID 0 volume successfully rebuilt. Hundreds of the the client’s videos files (.m2ts format) from his Panasonic camcorder and (.CR2) files created using hfis Canon camera were all recovered. They were presented to him on a USB external hard disk – memories that he and his family can treasure for years to come.  

Drive Rescue are based in Dublin, Ireland. We offer a complete data recovery service for Zyxel NAS devices along with Synology, QNAP, ReadyNAS and Buffalo. Call us on 1890 571 571. We’re here to help.