Month: April 2021

Yesterday, we recovered photos from this ST1000DM003 hard drive. The disk had over 2500 JPEG files ensconced inside a Photos library. This APFS formatted Seagate S-ATA disk had firmware issues, but also had extensive bad sectors (over 36,000). When the disk was connected to another MacOS system via a USB 3.0 dock, it was not being recognised by Finder. The client even tried Target Disk Mode to recover the photos, but this also proved unfruitful.

Under the hood, the JPEG (Joint Photographic Experts Group) file format is a compressed format and as file structures go is actually quite complex. It comprised of multiple constituent parts such as the metadata and payload. When a disk goes bad or corrupt, it is usually the metadata which gets damaged

Problem Solved

Firstly, connected the disk to our recovery system via its S-ATA and power connection. We then connected to disk to our recovery system using its serial port. The serial port on the ST1000DM003 is to the left of the    S-ATA data port and can be recognised as having 4 pins. Connecting the disk this way, gives us direct access to the disk’s firmware modules enabling us to repair the corrupt translator module. We then used our specialised data recovery equipment to long-read the damaged sectors of the disk.  This equipment is tuned to read data from damaged disks where a standard operating system such as MacOS, Windows or Linux would just generate multiple I/O errors.

The Result

We achieved a 96% data recovery rate of the client’s MacOS Photos library which was of extreme sentimental value to them. With their memories restored – they could now treasure and enjoy them for years to come.

If you’re using an SSD and accidentally delete a file or folder in Windows (or in macOS), there is a substantial risk that TRIM, along with some other SSD house keeping functions, will thwart recovery efforts by deleting all data remanence. A simple way to think how TRIM works is just to think of Pac-Man – it operates inside your disk hoovering up deleted files in the same way that Pac-Mac devours the dots. Needless to say, this can be very problematic in terms of recovering data from SSDs.

So, let’s say an SSD user has accidentally deleted an important file or folder. Obviously, they should turn off their computer immediately, but before they do, they should be instructed to turn off TRIM as soon as possible. This just might help to make their deleted data more recoverable. If you are a Windows user, type “powershell” into the Windows search bar and “Powershell” should now appear on the menu. Then right-click to bring up the option “run as administrator”. At the command prompt, type “fsutil behavior set DisableDeleteNotify 1” to disable TRIM. (0 to re-enable). Mac users should go to Terminal and type in “sudo trimforce disable”. TRIM will now be disabled when you restart the computer.

Another way of disabling TRIM is to simply disconnect your SSD from your computer’s S-ATA or PCIe connection and access the disk via a USB dock or caddy. (For most disks, TRIM cannot work over USB). However, even with TRIM disabled, there are other background processes running inside your SSD which can also jeopardise the probability of a successful recovery. These will be discussed in another blog post.