Main menu:

Site search

Categories

September 2018
M T W T F S S
« Jul    
 12
3456789
10111213141516
17181920212223
24252627282930

Tags

Blogroll

Recovering a corrupted Word or Excel document: an easy solution.

You have a Microsoft Office file (such as Word, Excel, etc) which you (or your user) have been working on all week. But now, for whatever reason, the file has either gone corrupt or been over-written.

Hours of work wasted? Maybe not. In Windows, the quickest recovery route possible is the much forgotten and underused feature called Shadow Copy. The steps to recovery are easy. 1) Right-click the overwritten or corrupted file and click ‘Properties’. 2) Select ‘Previous Versions’. 3) If you want to view the old version, click ‘View’. To copy the old version to another location, simply click ‘Copy’ and you’re done. The quickest data recovery ever!

Recover data from a CD-R, CD-RW, DVD-R or DVD-RW disc

Generally speaking good quality CD-R, CD-RW, DVD-R, DVD-RW are a fairly reliable backup medium. This is assuming, however, that they’re kept out of direct UV sunlight and are kept free from deep scratches. But, occasionally user error can result in data loss. Like a gentleman from Kildare we helped last week. He had an Outlook .PST file from his old workplace which he had stored on a Maxell DVD-RW. He inadvertently performed a “quick format” on the disc, erroneously thinking a different disc was in his DVD tray. His heart sunk as he thought that 9 years’ worth of emails and contacts we now gone into the ether. He contacted us.

The data recovery process for this type of data loss is cut and dry. Firstly, we configured the read-speed settings on our DVD reader to read at the slowest possible speed and then ran a utility IsoBuster called on his disc. This recovered his .PST file quickly. However, when this file imported into Outlook, it still would not read. The error “outlook.pst is not an outlook data file” appeared. So, we ran SCANPST on the folder and re-tried. (SCANPST is a utility built into Windows OS to repair minor errors in .PST files). The utility found some errors which it repaired. The second import of the .PST file worked with all the client’s contacts and old emails now appearing. A very quick data recovery case! I hope this post helps someone else who has experienced the same problem.

Drive Rescue Data Recovery are based in Dublin, Ireland. We recover data from most brands of hard disk including Seagate, Toshiba, WD, Samsung, Iomega, LaCie, Intenso, Adata and Transcend. Find out more on: www.datarecoverydublin.ie

Giving Back @ Drive Rescue

Pictured: Robert Scanlon of Drive Rescue and Brother Sean Donohoe of the Capuchin Day Centre

 

Drive Rescue recently presented their annual donation to the Capuchin Day Centre in Dublin. The centre provides 800 meals a day to people who are homeless or in need. The centre also distributes 1400 food parcels in Dublin in 350 in Kilkenny for people on the poverty threshold. It receives only partial funding from the Irish government. The centre does not run PR or advertising campaigns. It generates most of its income from the goodwill and generosity of the Irish people. It was a pleasure being able to help them.  If you would like to help, you can make a donation here:

http://www.capuchindaycentre.ie/Capuchin_Day_Centre_2013/Capuchin_Day_Centre_-_Donations.html

 

Data Recovery from Intel 5400s (Intel 540) Pro 240GB SSD

A customer recently dropped in an Intel 5400s Pro solid-state disk to us for data recovery. They first noticed a problem with the disk when, upon starting their Dell Inspiron laptop, they received the “no boot device found” error message.  They removed it from their laptop and connected to another computer using a USB dock – but the disk could still not be seen.

Disk architecture

The solid-state disk, an Intel 5400 (lately, this model has been marketed as the 540 as Intel has recently abandoned the four-digit naming convention for their SSDs) holds 240GB of data and uses a Silicon Motion 2258 controller. The PCB holds 8 x 30GB SK Hynix memory chips using TLC NAND and uses an S-ATA 3.0 interface.

Diagnosis

Upon delivery of the disk, we connected it to a standard Windows PC. The make or model number was not detected by the BIOS. At this stage, we were beginning to suspect controller failure. But making assumptions in data recovery can easily set your recovery methodology on the wrong track – so more analysis was needed. Physical inspection of the PCB revealed dies tightly bonded to the board and no signs of thermal stress.  Using a multi-meter in voltage mode, readouts showed that all areas of the disk’s PCB were getting the correct voltage. So, we could safely eliminate a power issue as being the problem.

SSD data recovery process

We then put the disk into what is known as technological mode. This is a mode used by disk manufacturers themselves to perform diagnosis on disks which have been returned to them. It helps them spot design defects (with the disk controller, NAND, DRAM, etc.) which are then used by their R&D departments to (hopefully) make reliable disks. But technological mode also allows data recovery technicians to bypass the inbuilt controller and use an emulator. (I’m sure this “backdoor” access to a disk also comes in very handy for the NSA…). The controller plays a vital role in the operation of an SSD. It performs bad block management, logical block addressing, wear-leveling, error correction control and interleaving. We uploaded a Silicon Motion 2258 translator module to our recovery system. The disk successfully ID’ed. The NTFS volume finally appeared, but with errors.  We made an image of the volume and then using this image made reparations to the NTFS partitions.

The result

After several hours work, we now had the disk’s two NTFS partitions fully recovered. The files, mostly V3D (medical imagery) files and one gigantic 33GB PST (Outlook store folder) were extracted onto external USB 3.0 drive for the more-than-satisfied client.

 

Drive Rescue Data Recovery is based in Dublin, Ireland.  We perform SSD data recovery from most brands of SSD including Samsung Evo, Crucial, SanDisk, Toshiba OCZ, Integral, Adata and PNY. For more information log onto www.datarecoverydublin.ie or phone us on: 1890 571 571

Don’t forget to check the “found.000” folder after running CheckDisk.

CheckDisk is a file system integrity checker built into Windows’ operating systems. (It runs a FS integrity check similar to the “verify” command in OS X‘s Disk Utility). For the most part, where small file system errors exist on FAT and NTFS volumes, CheckDisk does a reasonable job at repairing them.  However, occasionally it repairs the file system, but the volume will still be inaccessible to the user. This is because Checkdisk stores the recovered files in a newly created folder called “found.000”. Last week, a customer dropped in an NTFS formatted Samsung Momentus 2.5” disk to us. Another data recovery company in Dublin wanted to charge them hundreds of euro for recovery. But the files were already on the system in the folder found.000! This job took all but 10 minutes to diagnose and resolve. We did not charge anything to the delighted customer. It was a simple fix. Next time you run CheckDisk on a disk with small errors, don’t forget to check the folder “found.000”- you could end up saving yourself a lot of money.

Drive Rescue at IP Expo Europe (London) 2017

Drive Rescue recently attended the IP Expo Europe event in London checking out some of the latest storage devices. The data storage world continues to move at a blisteringly fast pace and there were lots of interesting new technologies on show.

12 TB Helium Disk 

Just arrived (1 hour before above photo was taken) from Seagate’s European hub in Schipol was this 12TB Iron Wolf disk. With a speed of 7200rpm and a transfer rate of 250 MB/s, this range of disks also comes with “Rotational Vibration Sensors” to minimise vibration. Its disk heads use PMR (perpendicular magnetic recording) technology and not SMR (shingled magnetic recording) which one might expect on a disk this size. This is thanks to helium gas used in the disk’s main chamber which reduces platter turbulence and enables increased areal density. After all, 12TB is a lot of bytes for just 7 thin platters. Of course, many years ago Seagate toyed with the idea of injecting helium into the main chamber of their high-capacity disks but abandoned the idea as no economically viable production technique could be found. Then Western Digital came along where Seagate left off. Their production engineers made a breakthrough, developing a helium-injection process suited for mass-scale production. So Seagate have now come full circle and have realised their helium dreams. But “what about reliability?” I hear you ask. Well, Seagate are claiming the MTBF (mean time before failure) for this disk (model pictured) is 1.2 million hours…(stop sniggering). And not so long ago, Seagate said they would relinquish using the MTBF metric and promised they would use AFR (Annualised Failure Rate) instead to quantify disk dive failure rates. I’m guessing they reinstated this awful but more standardised metric not to be disadvantaged when procurement teams  devise HDD comparison matrices. Failure specifications aside, Seagate (with a little prodding from Synology) have developed their own disk health monitoring software for this disk family. This diagnostic and monitoring software awkwardly named “Iron Wolf Health Management” (yes, I know it sounds like a dodgy healthcare insurance company from Ohio) is badly needed as SMART has become well past its sell-by date. According to Seagate’s marketing bumf, it monitors 200 disk parameters which influence disk health as opposed to the 20 paltry parameters used by SMART. The software also promises “intervention action” notifications in instances of imminent disk failure. Moreover, it offers a probability rating of catastrophic failure and gives a longitudinal view of disk health by showing trend analysis rather than the one-snapshot-in-time view offered by so many other HDD monitoring apps. Already, Synology the NAS manufacturer, has integrated the IWHM software into their DSM operating system.

Buffalo NAS – Security in Mind 

 

 

And talking of NAS devices, Buffalo, the Japanese NAS manufacturer were also showcasing their wares. Their flagship Terastation NAS line-up has been re-designed with security at the forefront. Their NAS devices now employ a secure file-access architecture where not even the administrator has root-rights. In terms of encryption, AES-256 hardware encryption is now standard on all the Terastation range. This is a useful feature if the NAS is accessed remotely or in the event of your NAS device being stolen. (And on that note, all Terastations also come equipped with a Kensington lock). There is also the option of enabling pre-boot authentication using a VPN, Windows Server or PC. Buffalo has also introduced its “Drive Recognition Technology” whereby the volume’s disks are digitally “tied” to the hardware. Just in case, all these security features go haywire due to corrupt or bricked firmware, Buffalo have added a feature known as “duplex firmware”. This stores a secondary firmware module to fall back on should the original module go askew. Nice! A Terastation NAS would make an ideal Christmas present for any data protection officer…

QNAP – NAS with ThunderBolt 3, SSD caching and advanced virtualisation (for a NAS…) 

QNAP also presented an innovative line-up. Their TS-456BT3 model comes with two ThunderBolt 3 ports (also compatible with second generation USB 3.1) which is sure to please both Mac and Windows users collaborating in OS agnostic environments. This model also has a dual M.2 SATA interface for disk caching – (SLC or MLC SSD recommended) for faster transfer speeds. QNAP were also displaying their performance powerhouse NAS – the TVS-1282T3. This 8-bay (for 2.5 or 3.5) and 4-bay (2.5” SSD) device is powered using an Intel i3 or i5 processor and can hold up to 64GB of DDR4 RAM. This model also offers link aggregation in the form of four 10GbE ports. Used in conjunction with Thunderbolt 3 this can offer blistering fast data transfer speeds of up to 40Gb/s.

In terms of data backup, QNAP offers their Real-Time Remote Replication (RTRR) feature which can backup files to another NAS immediately or to a remote FTP server. Their QTS operating system (version 4.2 or higher) also allows for volume snapshots using their Snapshot Manager utility. Another innovative feature of this model is that it supports VJBOD whereby unused QNAP devices (selected models only) can be connected to it to create virtual storage pools. These can be managed using QNAP’s Virtualization Station 3 software. So, if you ever wanted to have your own mini data centre – now is your chance.

Synology and their transition to BTRFS

While QNAP might be innovating with NAS interconnectivity and virtual storage pools, Synology are also innovating albeit at a more fundamental level. The BTRFS (developed by Oracle) file system has now become default on most of their mid-to-high range NAS devices. Previously, Synology’s used EXT3 or EXT4. But in 2009 and again in 2015, EXT4 developed bugs which meant several thousand EXT4 based servers and other storage devices got hosed. This might have spurred a decision at Synology Towers to change the file system of their devices altogether. In terms of file systems, BTRFS is still only a baby. Introduced in 2009, it’s still only on version 4 but it does offer some compelling data protection features. For example, it stores two copies of metadata per volume. This could become extremely useful when performing data recovery from a disk with bad sectors or from a damaged disk. Moreover, BTRFS includes native check-summing for data and metadata, making sure data integrity is maintained. So even if bit-rot has set in, file corruption will be detected and automatic recovery using mirrored metadata will initiate (theoretically, at least). And if that’s not good enough, BTRFS offers much better snapshotting capability whilst incurring very little overhead in terms of disk space or performance. Certainly, in this era of crypto-ransomware, snapshotting has become more important than ever. So, maybe Synology’s decision to jump from the EXT ship was probably not such a bad idea.

Drive Rescue Data Recovery is based in Dublin, Ireland. Need data recovery from a Seagate drive? We can help. We are also Ireland’s leading experts in NAS data recovery. We recover from most major brands, including Synology (DS115, DS116, DS210, SD216j, DS216se, DS416J, DS718, DS1517 etc.,) Buffalo (Terastation and Linkstation), QNAP (TS-231, TS-251, TS412, etc.) and LaCie NAS (Big Disk, 2Big Dock, 2big Quadra and 5big Thunderbolt). Call us on 1890 571 571 www.nasrecovery.ie 

Recovery of holiday photos from SanDisk 8GB SD memory card with corrupted controller chip

NAND memory in the form of SD cards (such as SDHC and SDXC), micro SD cards and CF cards have almost replaced 35mm film as the de facto storage medium for most camera devices.

Last week a customer who had photos from a family wedding and a trip to Ethiopia contacted us because his 4TB SanDisk SD card could no longer be read by his Canon EOS camera or his Apple Mac computer. The latter presenting him with the error message “The disk you inserted was not readable by this computer”. This error can sometimes be caused by partition or controller failure. In this case, a quick diagnostic test on our NAND reader made a controller issue the most likely cause.

The controller in NAND memory devices serves the important role of managing read and write cycles. It also performs a process known as “wear-levelling” – a feature which optimises the utilisation rate of all cells evenly across a die. It also performs the important role of logical block addressing, mapping information from the logical block address to the physical addresses. The controller chip also manages bad blocks. Just as a hard disk uses a P-List and a G-List, many NAND chips use Bad Block Omission and Bad Block reallocation algorithms. For cells which have been subject to the erase function, the garbage collection function designates them as “free” for new recording cycles.

Each controller type will use different LBA and page schemes. The accurate determination of these is crucial for successful data recovery. Typically, the page size is 512 bytes. In this particular case, the page size was 512 bytes with a logical block size of 1024 bytes. After having created a virtual image of the disk, we analysed the inversion and XOR used by the controller. Inversion is a type of encoding commonly used in TLC chips to minimise cell wear. This inversion algorithm must be deciphered. Secondly, we had to work out the XOR used by the controller. User data is merged with a XOR key to (rather un-intuitively) create noise. This is needed by TLC NAND to preserve data quality. After working out the XOR, the virtual and block allocation patterns, we now had a logical image of the SanDisk card to work with.
Logical block number and logical page number sequence had to be calculated followed by data block sorting and filtering. This included removal of invalid and duplicate blocks and checking of LBN integrity.
And then to the final stage…the data extraction phase. Most of the file types were .CR2 (Canon Raw Image), JPEG and .MOV files all of which extracted beautifully. The client collected a DVD with all his treasured memories vowing never to trust a camera card again!

 

The perils of sudden power loss: data recovery from LaCie NAS (using Seagate Constellation 2TB ES X 2)

This RAID disk (pictured above) owned by a Dublin-based design and multimedia company was in our lab recently for some data recovery. During building renovations their business premises, experienced a sudden power cut. Such an incident is normally not good for disk health. But thankfully most disks can compensate for sudden power loss by using centrifugal force to move the head disk assembly back to the disk’s parking zone. However, in this particular instance the power cut off; then went back on again momentarily. Now with this type of scenario disks have a little more difficult time. Because when this happens, the head disk assembly, whilst moving back to the centre of the disk, risks getting “stuck” on the platters.

In this particular case, the first disk (disk 0) escaped any mal effects, but the second (disk 1) refused to spin up at all. Instead, the disk, a Seagate Constellation ES, made a humming noise. We brought it into our clean-room and confirming our expectations, we found the HDA stuck midway across the platters. Using customised tools for Seagate disks we gently unstuck the delicate HDA from the platters. The disk was reassembled and connected to our recovery system. It spun up with a reassuring healthy sounding spin. But, as any experienced data recovery technician knows, trusting a repaired disk (not matter how fastidiously repaired) is tempting fate! Thus, to err on the side of caution, we imaged the repaired disk onto a new 2TB NAS-compatible disk – a process which took around 4.5 hours.

Now came the moment of reckoning. Disk 0 and the image of disk 1 were put back into the disk bays of the LaCie NAS and the device was powered up. After a 90 second wait. The volume mounted on the host (running OS Sierra) and appeared to be complete. To verify, we invited a representative from the client company to remotely login to your systems (via an encrypted connection) to view the recovered files. Much to his satisfaction, all Illustrator and Photoshop files appeared to be present.

Lessons learnt

It is for scenarios like this that the Uninterruptible Power Supply was invented. Whilst Ireland enjoys a very stable and reliable power network and we experience few electrical storms, there are always bolt-out-of-the-blue scenarios which merit a UPS (power-cuts during maintenance work, accidental power switch-offs etc,.) Such a device contains batteries which delivers power to your systems even when the mains power has been interrupted. It means that your systems and in particular your hard disks are not subject to sudden shutdowns. A UPS also offers users the opportunity to gracefully save any work still residing in the RAM. Manufacturers such as PowerWalker, APC and Eaton offer an extensive range of UPS devices catering for SoHo environments right up to data centre level.

But, perhaps the greatest lesson from this case is not to have your RAID devices configured in RAID 0 in the first place. It offers no protection should one disk fail. (In fact, NAS manufacturers should really put a sticker on their devices to warn users of this risk). For a two-disk configuration, RAID 1 is much safer. And finally, a NAS device should not be considered a backup. This continues to be a common misconception. The data on your NAS (especially if being used as a file server) needs to be backed up also. This can be to another NAS unit, for instance, or to the Cloud using a service such as Amazon S3.

 

Data Recovery from a Geologist’s Toshiba DTB310 external hard drive (Recovery of Photo and GoPro Footage)

We recently performed data recovery for a customer whose 1TB Toshiba external hard disk (DTB310) stopped working due to an accidental fall. Our customer, a professional geologist, used their GoPro Hero4 which was mounted to a drone for collecting geological survey data. Rather than cluttering up their MacBook, they transferred footage and still photos onto their Toshiba disk and wiped the micro SD card ready for the next use.  Unfortunately, when reviewing footage, the user accidentally let the disk fall from a coffee table whilst it was still on. With much trepidation, he re-connected to his MacBook Air but he could hear it making the dreaded clicking noise. He badly needed almost nine months’ worth of data recovered.

On word-of-mouth recommendation, he delivered the disk to us. We removed the disk from its plastic shell. Inside the case, we found a Toshiba MQ02ABD100 S-ATA disk.  Our equipment revealed that head #1 had totally malfunctioned. We opened the disk up in our clean-room to investigate further.

Damaged head #1 and slider

Magnetic head #1 was damaged as was the slider. The only viable solution in this case would be to perform a head disk assembly replacement. We communicated to the customer the process and cost involved. After formal approval, we got down to work.

Using a Toshiba “head comb” (an instrument specifically designed for the removal of Toshiba head disk assemblies), we removed the damaged HDA from the customer’s drive. Then, using the same process with the donor disk, we extracted its head disk assembly. Using an anti-ESD, electronic tweezers we mounted the new heads into the patient disk. Once aligned correctly, we dismounted the head comb tool and carefully reassembled the disk.  Once reassembly had completed, the moment of truth had arrived. We connected power to the disk along with a S-ATA data cable. This disk spun into life with a smooth spinning noise – always very pleasing to hear. As a preliminary test and before we commenced to image the whole disk, we imaged sectors from LBA 0 to 100000. They all imaged fine. We then imaged the remainder of the disk which completed without incident.

To determine the quality of the recovered images (stills) we used Quik Desktop (available from the GoPro website). Video footage from the GoPro was recorded in .MP4 format (using the .H264 codec). This footage was viewable using the excellent VLC media player (free to download). All still images and video files opened without corruption.

A complete recovery of almost 780GB was collected by our customer saving him hours of laborious drone fieldwork!

Drive Rescue Data Recovery is based in Dublin, Ireland. If you need data recovered from your hard disk – we can help. We can recover from most Toshiba external hard models such as the DTB305, DTB310, DTB320, v63600 and v63700.  Previously we have also recovered data successfully from Toshiba models such as the MQ01abf050, MQ01acf075, MK5065gsxf, and MK5065gsx.   

Hard drives, friction and a data recovery from a Samsung M3 external drive

Hans Peter Jost – the father of Tribology

 

Friction has always been a problem in technology. Ancient Egyptian art depicts workers dragging sleds carrying stone over the ground with workers pouring water on its track. Some of the world’s greatest thinkers from Leonardo de Vinci to Sir Isaac Newton have all pondered on the friction problem.

In September 1964 Hans Peter Jost a German-born engineer living in the United Kingdom attended a steel industry conference in Cardiff. Speaker after speaker from the United Kingdom, Germany, Italy and the United States all talked about failed and broken steel mill equipment and its cost to the industry. In almost every case of equipment failure, the common denominator was friction.  At the time, the friction issue gained so much salience, the UK government commissioned Jost to write a report on it. The Jost Report appeared in March 1966 and highlighted the huge savings industry could make if enough attention was paid to reducing the forces of friction in industrial plant and equipment. Jost’s report was to be the catalyst for the whole new study of Tribology – the science of interacting surfaces in relative motion.

Sixty-one years on from the Jost Report and the powers of friction are still in force albeit to a much lesser extent. Thanks to CAD, engineering designs have become more streamlined, wear-and-tear can be simulated more accurately and lubrication techniques have advanced. Scientists are now researching materials such as graphene with super-lubricity which has the potential for extreme low-friction applications.

But for the time being friction still exists and still presents a problem. The mechanical hard drive demonstrates a classic example of this. To put in context, the average mechanical hard disk has platters (on which data is stored) which spin at 5200rpm or 7200rpm. Moving just above the platters is an actuator arm, which has a slider (or several depending on disk size) on its tip. Mounted on the slider are the read/write heads. They float just above the surface of the platters on what is known as an air-bearing. The distance between the heads and platter surface can be as small as 5 nanometers. In theory, the drive heads should never touch platters, but this can happen due to “asperity events”. These can arise due to imperfections on the thin film coating of the platters. Commonly, for a hard disk asperity events take the form of thermal asperities where the delicate drive heads make contact with the platters producing a higher-than-normal voltage. The increased voltage leads to a “blocking temperature” between the platter surface and heads, which eventually leads to read/write fails.

Friction has been a problem for disk manufacturers since the RAMAC disk of 1956 and several innovations have been introduced to mitigate its effects. Ball-bearings used in the spindle mechanism which often led to non-repeatable run-out errors and were noisy have now been replaced by fluid dynamic bearings. To minimise friction between read/write heads and the platter surface there have been innovations also. For example, U-shaped slider rails have been introduced, but these have had limited success. Some disk manufacturers have introduced error-correcting software to “balance out” signal errors caused by asperities. In other cases, manufacturers use “thermal fly height” control software so the drive heads operate within specific pre-programmed parameters. Another approach has been to introduce special thermal asperity circuits in the disk’s firmware or to add a high-pass filter. The latter being unsuitable for disks using perpendicular magnetic recording as a DC component is used. More recently manufacturers like Western Digital and Seagate have injected helium into the main chamber of the drive to reduce the air friction caused by fast spinning platters.

 

 

Samsung M3 external disk

This week we were recovering data from a Samsung M3 drive which perfectly demonstrated the effects of friction on mechanical storage. The drive was a Samsung M3 external USB drive belonging to a Dublin architect. Upon removing the plastic shell we found a Samsung-branded Momentus drive model ST500LM014 having a capacity of 500GB. Heads #2 and #3 were unable to read data

Inside the case: a Samsung-branded ST500LM014

 

Under our microscope we found both these heads to be touching the surface of the platter. This was causing the heads to heat-up and block the read/write signals. Upon further investigation, the Femto slider on which they were mounted looked out of alignment with the other heads. This was probably the result of shock damage

 

Opened ST500LM014 Drive – Drive heads in “parked” position

We had an exact match head disk assembly already in stock which we used as a donor. In our clean room, the old HDA was removed and the donor HDA fitted. The drive imaged completely and the HFS+ (Apple) volume mounted successfully. All the client’s SketchUp files (.dwg and .dxf) were recovered along with some raw photos (.cr2) taken with a Canon SLR digital camera.

 

Drive Rescue Data Recovery is based in Dublin, Ireland. If you need data recovery from a Samsung M3 (HX-M500TCB/G) external hard drive or other external storage device such as WD Elements, WD Passport or Seagate Expansion Portable –  we can help. You can contact us on 1890 571 571  www.datarecoverydublin.ie