Hard Disk Recovery

Here is a list of things to have ready when you call for technical support, this is in order to try and make the experience a little nicer. Most people who call me are very frustrated already, due to the loss of data, and I find that sometimes that frustration is enhanced when they are unable to answer my questions.

1. Be at the computer with the problem when you call.
2. Know what operating system the computer is running
3. Know how many partitions the hard drive has.
4. Make a mental not of what happened to the drive and the steps you have taken to get the data back.
5. Know which pieces of hard drive recovery software you have run on the hard drive
6. If it is a memory card you are trying to recover, be sure it is mounting as a mass storage device. This means either in a camera that mounts like a hard drive, or in a card reader.
7. If this is a Raid, make sure you let the technician know that ahead of time, data on Raids is written differently the data on a non raid drive.
8. Make sure you have administrative rights to the computer you are trying to recover.
9. Have a pen and paper ready, in case the technician has a list of steps they would like for you to perform.
10. Write down any errors you have received, I will be asking you.
11. If you have taken the machine to a computer repair shop, what they told you and that they did would be helpful to know.

I hope this helps make things a little easier, and of course if you have none of the above I will still be able to help!

By now everyone has some sort of MP3 digital music player such as an iPod. We have actually gotten quite a few in here for data recovery. An iPod or any other portable MP3 player for that matter uses solid state storage to store songs and video. Solid state data recovery is something that DTI data recovery has been doing since the beginning of digital storage.

Even though on Apple’s website they call the iPod’s storage a “hard drive”, it isn’t. The storage is flash media or solid state, not a drive with platters and heads.

DTI Data has the capabilities to recover all files that reside on an iPod, music, pictures, video, etc.

Icon	Model	Year-Month introduced	Scrolling device	Capacity	Current iPod Software Version
	iPod shuffle (2nd generation Early 2008) (2 GB)	2008-02	n/a	2 GB	1.0.3
	iPod touch (32 GB)	2008-02	multi-touch display	32 GB	1.1.3
	iPod touch (8 GB or 16 GB)	2007-09	multi-touch display	8 GB or 16 GB	1.1.3
	iPod classic (80 GB or 160 GB)	2007-09	Click Wheel	80 GB or 160 GB	1.1.1
	iPod nano (3rd generation)	2007-09	Click Wheel	4 GB or 8 GB	1.1
	iPod shuffle (2nd generation) (1 GB)	2006-09	n/a	1 GB	1.0.3
	iPod (5th generation late 2006) (30 GB or 80 GB)	2006-09	Click Wheel	30 GB or 80 GB	1.2.3
	iPod nano (Second Generation) (2 GB, 4 GB, or 8 GB)	2006-09	Click Wheel	2 GB, 4 GB, or 8 GB	1.1.3
	iPod nano (1 GB)	2006-02	Click Wheel	1 GB	1.3.1
	iPod (5th generation) (60 GB)	2005-10	Click Wheel	60 GB	1.2.3
	iPod (5th generation ) (30 GB)	2005-10	Click Wheel	30 GB	1.2.3
	iPod nano (4 GB)	2005-09	Click Wheel	4 GB	1.3.1
	iPod nano (2 GB)	2005-09	Click Wheel	2 GB	1.3.1
	iPod with color display (60 GB)	2005-06	Click Wheel	60 GB	1.2.1
	iPod with color display (20 GB)	2005-06	Click Wheel	20 GB	1.2.1
	iPod photo (30 GB) (also known as iPod with color display)	2005-02	Click Wheel	30 GB	1.2.1
	iPod mini (4 GB Second Generation)	2005-02	Click Wheel	4 GB	1.4.1
	iPod mini (6 GB Second Generation)	2005-02	Click Wheel	6 GB	1.4.1
	iPod shuffle (512 MB)	2005-01	n/a	512 MB	1.1.5
	iPod shuffle (1 GB)	2005-01	n/a	1 GB	1.1.5
	iPod photo (40 GB) (also known as iPod with color display)	2004-10	Click Wheel	40 GB	1.2.1
	iPod photo (60 GB) (also known as iPod with color display)	2004-10	Click Wheel	60 GB	1.2.1
	iPod (20 GB Click Wheel)	2004-07	Click Wheel	20 GB	3.1.1
	iPod (40 GB Click Wheel)	2004-07	Click Wheel	40 GB	3.1.1
	iPod mini	2004-01	Click Wheel	4 GB	1.4.1
	iPod (20 GB dock connector)	2003-09	touch wheel	20 GB	2.3
	iPod (40 GB dock connector)	2003-09	touch wheel	40 GB	2.3
	iPod (10 GB dock connector)	2003-04	touch wheel	10 GB	2.3
	iPod (15 GB dock connector)	2003-04	touch wheel	15 GB	2.3
	iPod (30 GB dock connector)	2003-04	touch wheel	30 GB	2.3
	iPod (10 GB touch wheel)	2002-07	touch wheel	10 GB	1.5
	iPod (20 GB touch wheel)	2002-07	touch wheel	20 GB	1.5
	iPod (10 GB scroll wheel)	2002-03	scroll wheel	10 GB	1.5
	iPod (5 GB scroll wheel)	2001-10	scroll wheel	5 GB	1.5

A lot of times when I am speaking to customers I need them to make changes to their files or look at their files in a specific way. I will often tell someone to open Windows Explorer and tell me what they see. In many occasion I have had customers open Internet Explorer instead. Because Windows Explorer is a valuable tool that I think everyone should understand and know how to use, at least at a beginner level, I have decided to take a few weeks and write about it.

Click on Start then Accessories and then two from the bottom is Windows Explorer.  Click on it and you will then be given the following program. 

Windows Explorer defaults to the “My Documents” Directory. As you can see all the files and folders you have in your My Documents folder are now displayed.

Below that is “My Computer” clicking the plus sign next to it will now display any mass storage devices Windows sees connected to the machine (i.e. your C drive and CD-Rom drive). From here you can also see your Control Panel, Mobile Devices, as well as Shared Documents and your My Documents folder again. We go further into the Control Panel and Shared Documents in a later blog, for now we are just trying to see what we are able to look at in Windows Explorer.  You will notice you also have access to your Recycle Bin and any folders that reside on your desktop. (Note: You now have full access to your files, if you delete from here it will be sent to the Recycle Bin.)

To Be Continued…

I think I have mentioned before that Western Digital is one of my favorite hard drive manufacturers. I was reading around on the internet today and came across this. It is really a sweet little portable drive. With a max capacity of 320Gb and only weighing in at 5 ounces it is an awesome answer to all of the huge files need to move around now. I am a little concerned about heat on this guy though, and would not recommend running it all the time. It would be best to just plug it in when you need to do your data transfers. It is not in need of a power source either, because it is powered by your USB port. I tried to look and see if anyone is talking about problems they have had with it and the only negative I could find was people thought the price should be lower. On this point I have to disagree, you can get the 320 for 200 bucks on their site, so I am sure there is a deal to be found on them. They come with special encryption software, as well as synchronization software. This can be very useful if you are transporting a PST file between 2 places (i.e. home and work). It is USB 2.0 compliant so you will get transfer rates around 450 to 480(MAX) Mbps. Let me know guys if you have any trouble with this guy.

     In one of my articles I tried to define the mathematics of a RAID 5 stripe and how it relates to data recovery.  Using the eXclusive ORing truth table we can continue to run the array even when one drive has dropped out of the array.  This RAID state is known as degraded and must considered by the IT professional as a temporary state.  Once in a degraded state the prudent technican should try to do the following:

     1. Take every user off of the server.  Although the RAID is designed to run in a degraded state, it is not a run time solution.  Ignore management, ignore the user, and log everyone off.

     2. Make a complete and full backup. 

     3. Check your complete and full backup.  Many a time I have heard a tech tell me that he did a full and complete backup only to find out the some obscure accounting piece of software had some hidden flat file buried 27 folders deep that had the entire companies payroll for the last 36 years and was not in his “complete backup”.

     4. Pull every drive from the array and make a complete sector by sector image of each drive.  Take those images and guard them with your life.  If when you are trying to bring the array back online, and something goes amiss, you will have a clean starting point.  This method is called the ‘hindsight is definitely 20 20′ school of thought and has saved my derriere on many occasion.

     5. Check every cable, every slot, every dust laden chip to make sure that something hasn’t ‘broken’ loose. 

     6. Put the working drives back in the enclosure and replace the bad drive.  Bring the array back online.  Go into the RAID BIOS and make sure that any rebuild is pointing to the right drive.  Although there may be meta data that tells the RAID card who is what, where, and how. Double check anyway.

     7. Rebuild the array.  If you get a stall, a hang, or a reboot then stop everything.  Execute step 5 again, and try the rebuild just one more time.  If it fails again, then do a surface check of all the drives in the array, including the new drive.  The fact that a drive is new does not necessarily mean that it will work out of the box.  Many a time I have pulled a new drive out only to have it fail the ’smoke test’.  A surface check will hopefully expose any flaws on the media during the read tests.

     If you have reached this point and still do not have a defined solution then you must weigh time constraints, user complaints, and management breathing down your neck as to whether to spring for a new server and reload, or to continue beating your head against the wall of an older server, using older software, running on an older operating system.  Data is almost always exportable in a simple comma delimited format and can then be imported into almost any application.  Maybe now is the time to upgrade and you can use this incident as leverage to pry money from management for a new server.

     No matter what you decide, if you have followed the above steps, your data will be relatively safe. It is the seasoned IT professional that can think out of the box and bring his company back online with a minimum of aggravation.

So in an effort to make our data available to us from anywhere Maxtor/Seagate has come up with a really cool idea. The Maxtor Shared Storage II line, which comes in 500gb and 1tb, now has the ability to allow users to log into a safe internet browser site and gain access to their network attached storage (NAS) from anywhere. You don’t need any special downloads or installs. Also there is no reason to open ports on your fire wall or router to gain access to your data. I found this idea to be a long time coming, and think it is awesome that Maxtor is offering it free of charge with this line of NAS device. In the past I have expressed my dislike in the decline of what in the early 90’s was the Caddy of hard drive lines, and finally I think Seagate is moving that area of the company in the right direction. I know I personally spend a lot of time out of the office and have found it difficult even with having a PDA/Phone to be able to gain access to my files I need to email easily. I am seriously considering the purchase of this product in the near future and will let you all know how that works out. I am very interested to see how the transfer rates are and if the ease of use is really what they are touting it to be. If anyone has one of these devices let me know what you think.

        One of the many attributes of a RAID 5 that make it popular is that if a drive goes down in the array the RAID will remain functional.  In such a case the following events should occur.  An alarm should sound.  An alarm that would wake the dead.  An alarm that would make raking your fingernails across a chalkboard sound pleasurable by comparison. An alarm that by all known standards would be considered inhumane in most modern cultures.  This alarm will sound incessantly, unwavering in its pursuit to be heard until the technician hits it with a keyboard, kicks the server plug out, or kills a chicken and offers a sacrifice to the alarm gods.  In other words, you can’t miss this alarm, and if you do, see the reference to ‘wake the dead’.  

        Secondly, an email will be sent, advising you that the four years worth of data that you thought was being backed up, but you discovered two days ago wasn’t,  is now in peril of being lost into the never never land of lost bits and socks that inexplicably disappear from the dryer.  Yes, your job, your home, your marriage, all will be lost unless you heed the email warning and immediately shut down the server, to the chagrin of 427 end users who are reading about American Idol. HAH! Welcome to the party pal! (Quote circa 1976:  Bruce Willis: Die Hard)

        Keep in mind that although there are many RAIDcards, as well as on-board RAID interfaces that perform these functions, your particular RAID firmware, as well as its current configuration may not       
        The reason that a RAID 5 can have a drive go down and still run is the mathematics of XORing (eXclusive ORing) the data.  This method for keeping the data relatively safe in a RAID 5 is called parity. It is a manipulation of bits in each byte of data.  For the unwashed a byte is eight bits. 
       
        In order to under stand XORing it is imperative that you understand the XOR truth table.  Figure 1 is the truth table for eXclusive ORing.

                                                                                           Figure 1
        Figure 2 is an example of XORing and how it relates to a four drive RAID 5 and the parity.
       

                                                                                           Figure 2

The data is arranged thusly:
‘R’ is the ASCII letter
52h is the ASCII hexadecimal value of ‘R’
0101 0010 is the ASCII binary representation of the letter.
As you can see each letter has is set up the same way.

     For illustration purposes the following can be assumed.  Each line is considered a single byte of a stripe as conveyed by Figure 3.  If we take the ‘R’, and the ‘F’, and the ‘T’, and XOR them together, we get the value in D4, where each bit, of each byte is individually XORed across the stripe. 

                                                                                         Figure 3

Using Figure 4 as a base, and the truth tables we can see the following:

       1          2                  3    4
L1: 0 XOR 0 = 0 XOR 0 = 0
L2: 1 XOR 1 = 0 XOR 1 = 1
L3: 0 XOR 0 = 0 XOR 0 = 0
L4: 1 XOR 0 = 1 XOR 1 = 0
L5: 0 XOR 0 = 0 XOR 0 = 0
L6: 0 XOR 1 = 1 XOR 1 = 0
L7: 1 XOR 1 = 0 XOR 0 = 0
L8: 0 XOR 0 = 0 XOR 0 = 0

Figure 4

 Now, lets say we lose D2 (drive two) in the array.  The following is how the RAID card firmware handles it.

     1            3                 4    2
L1: 0 XOR 0 = 0 XOR 0 = 0
L2: 1 XOR 1 = 0 XOR 1 = 1
L3: 0 XOR 0 = 0 XOR 0 = 0
L4: 1 XOR 1 = 0 XOR 0 = 0
L5: 0 XOR 0 = 0 XOR 0 = 0
L6: 0 XOR 1 = 1 XOR 0 = 1
L7: 1 XOR 0 = 1 XOR 0 = 1
L8: 0 XOR 0 = 0 XOR 0 = 1
Figure 5

     We have built drive 2 on the fly.  We do not need to know the data since we can use the XOR truth table and the remaining three drives data to calculate the value of drive two. In the above example the process was illustrated for one byte across one stripe on a four drive array.  All of these calculations are done in an instant on a stripe by stripe basis.  The full stripe is recalculated for every write, and if a drive is out of the array for every read of the down drive.  With all these calculations you would think it would slow down the processing. To a degree, it does, however, bus I/O is infinitely slower than any XOR math a CPU may have to perform.  A way to emphasize this point is imagine you are standing on a bridge.  Below you is a river.  Each byte of data is a boat that passes under the bridge.  The boat travels from the hard drive, down the river, to memory, and to the CPU.  As one boat passes, you wait for the next boat.  The next boat will not pass for one hundred years.  The CPU is in a perpetual wait state.  It is always waiting for data to process.  So, if you want to speed up your PC, by high speed I/O smart boards that can RAID, on a high speed bus. 

To be continued…

The Seagate Momentus® 5400.4 hard drive recovery review.
At the end of January, Seagate started shipping the much talked about Momentus® 5400.4 hard drive. This drive is the newest in a line of laptop hard drives they have been developing. It uses a second-generation perpendicular magnetic recording (PMR) technology. Which means instead of storing the data in conventional ‘longitudinal’ magnetic recording, in which the bits are directed circumferentially along the track direction, they are storing them perpendicular pointing up and down to the track.

What is good about this is the ability to get much higher storage as they can stack the data. On a laptop hard drive that means huge storage capacity never before seen. The 5400.4 is a 250 gig hard drive using SATA 300 and running at 5400 rpm. I did a lot of reading about this drive and really haven’t been able to find anything positive or negative about it. It is mass shipping to laptop manufacturers and I will update the status as soon as it is in the hands of the masses. Let us know if you have any questions about hard drive recovery by leaving a comment in this post.

Recently, it was my task to take sixteen drives, spanned across three RAID fives, and recover a set of hundreds of AVI files. These files were used for research and although not time sensitive, were critical to the conclusions of the research. 

We have been asked to do many similar jobs where the archive of a set of data has been compromised.  Many lawyers have databases of all of their scanned briefs as well as all documentation pertaining to a particular case. If that information is lost and the case reopened for appeal it could be devastating to not be able to review the documentation in a timely manner. I mention this because it took me over a month to complete this task, and although interesting, was very tedious.

What made this recovery interesting was that the drives were in two physical devices.  The first device was a four drive SNAP array that was used as the head. The other device was a twelve drive SNAP server that was broken up into two RAID fives.  The challenge for this recovery was that no one knew which drives were in which array, no one knew the drive order of any array, the configuration given to me by the SNAP server was in error, no one knew the stripe size of the array, and finally, the data recovery company who had the array before me, marked the drives out of order. In other words, I was handed 16 drives and told to figure out a triple spanned RAID five.

So here are the steps I took to solve this data recovery problem for my client.

Step one, I had to find out which drives went with each other.  I would have hoped that each RAID was equal in size.  In other words, I hoped the RAIDs would all be four drives for the head in one array, and eight drives each for the other two RAIDS, but this was not the case. In order to find which drives went with which array I had to know several things. 

First, I had to know the SNAP layout for arrays.  Each drive in a SNAP array is basically broken up into two parts, the operating system, and the data area.  In order to find the size of each you must look at the master boot record (MBR) of each of the drives.  The MBR houses the partition table which is a listing of the active partitions.

SNAP partitions are divided into three basic areas, an operating system partition, a swap partition and a data partition.  SNAP Appliance designed their device so that if one of the drives went down the firmware would roll to the next drive to load the operating system, network interface, and RAID handler.  The important piece of information is what the standard offset to the data area is. The data area of each drive is used for the RAID 5.  I have found the data area sector offset for the Guardian OS series to be LBA sector 2216970.  This information may change from version to version, but all the Guardian operating systems I have worked with have been the same.

Now that we know the data area offset we can take the next step, which is to determine which drive sets comprise the three RAID sets.

RAID Data Recovery

Hard drives fail, and they do it much more often than we’d like to think. Even if you’ve set up automated hard drive backups, you’re not necessarily getting the best backup bang for your buck—especially if your operating system’s main hard drive fails. Even if you’ve been backing up your important files, you’ll still need to reinstall your OS and go through the pain of copying your files back to your new hard drive, installing new applications, and setting up your system to how you had it. There’s a better way, my friends. With a RAID 1 array, you’ll always have a perfect backup of your hard drive so that—in the event that one drive fails—the other will seamlessly pick up where it left off. That means no reinstalling your operating system, no reinstalling applications, and no time lost in the event of a hard drive failure.