Month: July 2020

Last week, we successfully recovered data from a 2015 iMac, which was using an Apple Fusion Drive. (Samsung PM830 and Seagate ST2000DM001)

The Apple Fusion Drive was first introduced by Apple in 2012 and offers lower latency rates for frequently accessed data. The Fusion Drive concept was introduced at a time when high-capacity SSDs were prohibitively expensive. Apple, always wanting to be one step ahead of the posse, believed that this new hybrid type of storage would give users a foretaste of the future.

A “Fusion Drive” is not the same as a “Hybrid Drive”

Using their Apple Core Storage software, two disks, a solid-state disk and mechanical platter-based one are “fused” together to create one volume. (Many users confuse a “Fusion Drive” with a “Hybrid Drive”. But a hybrid disk (such as the ST2000LX001) is different in that it uses flash memory (NAND) and mechanical platter-based storage all in one self-contained disk. On hybrid disks the flash is used as temporary storage cache, whereas with an Apple Fusion drive, data is copied (not cached) to the SSD component. Frequently accessed files can be stored on the SSD, while those less frequently used are stored on the HDD. For example, all the system files needed for MacOS to boot up are stored on the SSD meaning the iMac will boot up much faster. Users get to enjoy the speed of flash and the high-capacity of platter-based disks – the best of both worlds.

Auto-Tiered Storage is not New

Apple Fusion drive uses a form of “auto-tiering” which adaptively migrates data between the two disks. Even in 2012, it was not an entirely novel consumer-level technology. Intel’s Smart Response Technology – part of their Intel Rapid Storage Technology suite – introduced it for consumer-level computing in early 2011. Apple Core Storage acts as an LVM (logical volume manager) and migrates data between the SSD and HDD in 128KB blocks.

Diagnosing a Failed Apple Fusion Drive

This technology is great until it goes wrong of course. In this case, our customer, a professional video editor, was using a late 2013 iMac with a Fusion Drive (Samsung PM830 120GB blade SSD fused with a Seagate ST2000DM001 2TB S-ATA HDD). The Samsung SSD passed our tests with flying colours. The Seagate 2TB disk, however failed the “read” component of our diagnostic tests almost immediately. As an aside, the ST2000DM001 and its sister disks, the ST3000DM003 and ST4000DM004, have garnered much notoriety the data recovery industry. Due to their inherently unstable firmware and often weak heads, these disks can suffer all sorts of unusual ailments. Moreover, this family of disks are also known for generating all sorts of weird noises, including those of chirping, squeaking, fluttering and even scraping.

Data Recovery from Apple Fusion Drive

The ST2000DM001 disk we extracted from the iMac was no exception. It had multiple read issues and had several firmware “media cache” issues. It also made continual chirping noises akin to a caged budgerigar whose owner had hydrated it with a little too many Nespressos. Despite this, after resolving multiple issues with the disk, we managed to make a good image of it. Now, all we needed to do now was to “re-fuse” its image with the image of the Samsung PM830 SSD. This would enable us to recover the HFS+ volume. “Re-fusing” or repairing a Fusion Drive can be extremely tricky not helped by the limited repair options offered by Apple. For example, “diskutil” commands provide very limited options for manipulating Fusion Drive (Core Storage) data. And their Disk Utility tool provides no functionality for recovering a Fusion Drive.

Fortunately, at Drive Rescue we use forensic-level hardware tools which can be configured to merge two Core Storage image and reconstruct your Apple Fusion drive. For our video editor customer, we attained a 100% recovery rate of all his Adobe Premiere Pro files.

Here are a few tips for recovering from an Apple Fusion drive:

1. Trying to reset your Fusion Drive configuration on a disk(s) which are failing can complicate issues. Refrain from doing this.  
2. Do not attempt to re-format any disks which are part of a Fusion Drive.
3. Do not attempt to re-install MacOS. This will overwrite Core Storage configuration data needed for data recovery.

We can help you recover data from a split iMac Fusion Drive due to physical disk problems, disk bad sectors, firmware problems and from accidental MacOS installation scenarios. We can recover from 21” and 27” iMac models such as iMac 2012, iMac 2015, iMac 2017 and iMac 2019. Successful recovery from your Apple Fusion drive means you can be re-united with previous work-related projects and of course your photos and videos

Yesterday, a previous client contacted us for a bit of advice. Before the lockdown, they needed data recovered from their aging Synology NAS DS411J as some of its WD Red S-ATA disks, configured using Synology Hybrid RAID, unexpectedly went into a “degraded” status. Luckily for them, we were able to recover all their important data.

Recently, they procured a new Synology DS218. In order to avoid the need for data recovery again, they followed our advice and tried to back up the NAS to an external LaCie Rugged disk. So, they connected the external disk to the USB 3.0 port of the Synology and using HyperBackup (part of DSM Explorer), proceeded to copy their files.

Returning an hour later however, the copy process from their new NAS to external disk was running at a miserable 1.2MB/s. It would take days before it would be completed!

Fixing Slow Data Transfer Speeds of Synology

This is a common problem with Synology NAS devices. Unfortunately, DSM Explorer does not play well with NTFS formatted disks. We recommended that they format the LaCie Rugged external disk to EXT4 format first. (This can be performed easily with Ubuntu or any other Linux-based OS.) After changing the formatting from NTFS to EXT4, they retried the copy process. This time round, the data transferred at nearly 90 MB/s. A much better improvement. For disk-to-disk data transfer operations, having both disks use a homogeneous file system can drastically help with file transfer speeds. It’s always the little things, isn’t it…

• 

In the same way that a printed book will have a contents page and index – an NTFS (Windows Formatted) hard disk uses what is known as a Master File Table (MFT). This file, usually 1024 bytes in size, stores information about every file such as its name, size, timestamps and other file attribute information. It also contains “pointers” which help your hard disk find data on your hard disk. It is perhaps one of the most important files on your hard disk. In hard disk volumes using FAT and FAT32, the MFT shares the same function as the File Allocation Table.  

The MFT ($MFT) file was designed with disk access speed in mind because all the file metadata is stored on contiguous blocks. This, for example, saves the operating system having to parse through every file on the disk for a command such as simple file search.

However, underlying disk problems can result in a corrupt MFT. Such problems might be precipitated by a malfunctioning bus controller on a host system. Or sometimes, malfunctioning disk firmware corrupts data or writes data to the wrong location. Moreover, power surges, bad sectors, platter scratches and non-repeatable runout errors can all lead to MFT problems.

Chkdsk will be able to repair some disk issues, but in some cases, it will do more harm than good. Chkdsk will typically run “type checking”. This checks whether the disk cluster conforms to footprint of data type. “Sanity checking” will also be performed, verifying that the data structures meet the normal parameters of the NTFS file system. For example, it will check the metadata location of the boot sector to validate pointer integrity. If this utility does find errors, it can refer back to $MFTmirror (which acts an MFT backup) to reinstate files. However, this will not always work.

Last week, we recovered data from a Seagate Free Agent external USB disk. The NTFS formatted disk was inaccessible. The user let Chkdsk (Checkdisk) run when their Windows 10 computer started up. But, alas, it seemed to have complicated issues. The user received the rather ominous sounding error message:  

“Windows cannot recover the master file table. Chkdsk aborted”

On recommendation of a colleague, he brought his disk to Drive Rescue. The disk was exhibiting multiple problems with bad sectors and firmware. Once these issues had been resolved, the volume was still inaccessible. On further analysis, we found that the disk’s MFT pointer files, namely, RootSecDesc and DirIndxbuf files were corrupted. These files had to be reinstated manually using a hex editor.  All Word, Excel, .avi and almost 9 years of worth of priceless photos were recovered.

Drive Rescue offer a complete data recovery service for Seagate Free Agent external hard disks such as the Seagate Free Agent Desktop 500GB, Seagate Free Agent Pro 750GB, Seagate Free Agent Go 1000GB and Seagate FreeAgent GoFlex 500GB and 1000GB models. Our Seagate data retrieval service is based in Dublin, Ireland.

We had a customer in yesterday with a Dell Latitude Windows 10 laptop. The system, running Windows 10, was requesting a BitLocker key even though the user never remembered this full disk (FDE) encryption application being setup. They were starting to panic because their research on Google informed them that losing your BitLocker key can result in accessible data. BitLocker normally uses XTS-AES (128 or 256bit) which is very strong. One website even advised our customer, if they waited a few years, BitLockered disks could be easily cracked when quantum computing becomes more mainstream. But understandably they were not prepared to wait a few years…

However, this is a problem which Drive Rescue had encountered before. On some Dell laptops, the “Expert Key Management” in the system’s BIOS can sometimes go skewways resulting in a BitLocker Recovery key request window appearing unexpectedly.  

Recovering from BitLocker

The fix for this problem is simple. Enter the BIOS of the Dell system. Navigate to “SecureBoot” and then click to expand the section called “Expert Key Management”. Now you should see a “Restore Settings” button, followed by “Factory Settings”. Select this and then click on “ok”. When exiting the BIOS, don’t forget to save changes. Restart your system. The BitLocker key request box should now be gone and all your files should be fully accessible. No data recovery needed!

Drive Rescue offer a data recovery service in Dublin, Ireland for BitLocker encrypted disks (S-ATA, PCIe, mSata) even in cases where a TPM chip is used. We frequently recover from disks removed from laptop systems such as the Dell Latitude, HP Elitebook, Fujitsu LifeBook and Lenovo Thinkpad T and X Series of laptops. Phone us on 1890 571 571