Problem
Recently, a user from Athlone was using his HP Elitebook laptop connected to his mains power. (His battery was no longer able to hold a charge). Unfortunately, when rushing to his answer his phone, he accidently tripped over his laptop’s power lead and almost instaneously his system powered off. No worries, he thought. This happened to him before and did not pose much of a concern for him. After a sudden shutdown before, his laptop booted up successfully.
He finished his phone call and went to switch his laptop back on. But this time he got the “operating system not found” error message. He turned it off and back on again. But still, the same error message re-appeared. He brought the laptop to his local computer repair shop. They removed the Intel SSD hard drive from his system. It appeared on their system alright, but it was only detected as having a capacity of just 8Mb! They tried running some data recovery programs on the drive, but any data was proving to be elusive. They referred him to Drive Rescue data recovery.
Using our eqiupment, specialised to recover data from SSD devices, we discovered that the logical-to-phyical table of the drive had gone corrupt. The role of this table is to translate LBAs (logical block addresses) to physical addresses (chip number and page number of chip). When there is the sudden loss of power, this layer often goes corrupt.
Solution
We first put the drive into safe-mode and then used our equipment to find the corrupt L2P module. After we found the corrupt module (containing the corrupt table), we then had to upload a “good” module to match the model number (SA1M160G2HP) and firmware version (02HA). After some extensive searching of our firmware database, an exact-match module was found and uploaded onto the RAM of our recovery system. After installation, a new volume appeared, but it was now only showing 48GB. This was certainly not the size of the original volume. Something else was awry. We decided to change the recovery mode of our system from “tech-command” to “translator-table” mode. With this parameter changed, the whole 160Gb volume appeared. The downside of TT mode is that it automatically changes the read mode from UDMA to PIO which gives a data transfer speed of only 4Mbps. But slow-and-thorough is always better than fast-but-incomplete.
All of the client’s data was recovered, namely his .PST file, his .ACCDATA file (Sage) and his Microsoft Office data files onto a brand new USB external hard drive. The client has informed us that he is now going to decommission his old HP Elitebook which gave him such a nasty surprise in favour of a new MacBook. An early Christmas present to himself.