Last week, one of my son?s friends lost a summer of work he?d done filming a documentary. ?It was a crucial college project for which he?d solicited and received considerable financial support via Kickstarter. ?He?d backed up months of footage garnered from extensive travel and interviews to an external hard drive. ?Secure that he had a backup, he deleted the source data to gain more room on his Mac. ?It wasn?t until the external hard drive failed that it dawned on him that a backup isn?t a backup if it?s your only copy.
My son?s friend was distraught and ready to run all manner of over-the-counter recovery programs in a desperate attempt to salvage his labors. ?That would have been about the worst possible thing to do since running these tools against a mechanically compromised or logically corrupted drive often extinguishes any hope of data recovery.
By virtue of the superior genetic material and parenting skills of his mother, my son Madison is a very bright young man and had the presence of mind to intercede and tell his buddy to stop, do nothing and bring the drive to my lab to see what could be done. ?My son also understood that data recovery is uncharacteristically economical when you know someone who will do it for free.
The failed drive was a 2.5? Seagate STBU1000100?enclosure housing a one terabyte?Samsung??drive. ?Though 1TB is the smallest storage unit I use, I?m still awed by these?pocket-sized?marvels: 50,000 time more capacious and 300 times cheaper than my first hard drive!
Unfortunately, the low cost of consumer hard drives isn?t just due to great strides in manufacturing and distribution efficiency; some of the economy stems from corner cutting.? One way manufacturers of?external hard disk drives (XHDDs) cut corners is?by eliminating the conventional SATA interface on the drive and hard wiring to a USB interface. ?The failed drive employed a removable USB 3.0 SuperSpeed interface. ?When I popped it off, I was pleased to see SATA connectors beneath. ?My job just got a lot easier. ?My next objective was to get the drive out of the enclosure and inspect it. ?Plus, I wanted to smell the drive.
No, I am not a technology fetishist (okay, maybe a little). ?Smelling the drive is one of the best ways to assess whether it has suffered an electrical malfunction causing?over-current?damage to components on the logic board. ?If the drive smelled burned, then I?d need to attempt a physical fix before applying power.
Another way XHDD manufacturers save money is through the use of snap-together plastic enclosures. ?These are tricky to open without tearing up?the housing or snapping off closure tabs. ?As protecting the appearance of the drive wasn?t a concern here, I began prying up the seams in the customary way and managed to extract the drive with the enclosure?little worse for wear.
The drive smelled fine (with low notes of cinnamon and black cherry) and the motor spun up without any of the sounds of a hard drive in its digital death throes.
My next objective was to acquire a data dump of the drive before undertaking repair. ?I sought a?bitstream of the physical contents of the medium to have a ?path back? in the event that mechanical failure was imminent or repair efforts might adversely impact the contents. ? if all else failed, I could either land the bitsream on a new drive or carve the contents using binary signatures to recover whatever i could.
I connected the drive to a SATA write blocker and used X-Ways Forensics to acquire the physical bitstream. ?I was using a Windows workstation, so the write blocker insured that Windows couldn?t alter the contents of the drive as WinOSes like to do when they sees a new drive on the bus.
I was relieved to see that X-Ways Forensics identified and correctly interpreted the partitioning scheme on the drive. ?That?augured?well for recovery. ?However, bad sectors were detected, making it all-the-more crucial to secure a bitstream ASAP.
It took 7.5 hours to acquire the?1,000,204,886,016 bytes on the medium and thankfully just seven sectors?proved bad. ?Based on their locations, these sectors weren?t likely to be the sole culprits for why the drive couldn?t be seen by a Mac, but having successfully recovered over a trillion bytes freed me to undertake repair without risking catastrophic,?irreversible?data loss.
To make a long story short, it took me just minutes to resolve the corruption once I?d acquired the data. ?My son?s relieved friend has all his data back, and his Kickstarter investors needn?t hear that their investment died with the drive. ?Further, his nail biting brush with digital oblivion helped my son?s filmmaker friend appreciate that important data must be replicated, not merely moved around, and that a copy needs to be protected from the risks to the source to avoid losing both.
As students (and teachers like me) head back to school, it?s worth remembering that having your laptop and your backup drive in the same backpack is no protection against loss or theft and inadequate protection against damage. ?If someone with sticky fingers gets into your dorm room and sees both a nice laptop and a nice external drive, do you think they won?t steal them both (along with your iPhone, iPad and iPod, too)? ?Drive failure or disappearance isn?t something that only happens to other people. ?ALL hard drives fail, and reportedly about half of all laptops get stolen.
Losing all the data on your computer isn?t the end of the world?but it may feel like it for quite a while. ?So follow these simple rules without fail:
- Backup regularly to a drive that won?t be lost or damaged with the source;
- Periodically confirm that what you backup is present and recoverable;
- Never carry your backup media in the same backpack or bag as your computer.
Note to readers: ?I don?t offer data recovery services to the general public, so please don?t e-mail me asking if I can fix your hard drive. ?There are plenty of talented folks around the world who do data recovery for a living, including the fellow who taught me much of what I know about the topic, Scott Moulton. ?Whatever you do, don?t put the drive in the freezer, rap it sharply to free up sticky platters or follow any of the other terrible advice that well-meaning ?computer ?experts? will swear works for them. ?If the data matters, get the drive in the hands of a full-time data recovery professional without delay, and be prepared to pay what it costs for them to work their magic.
Like this:
Be the first to like this.
conrad murray sentencing conrad murray sentencing urban meyer adam shulman adam shulman nfl power rankings week 13 nfl power rankings week 13
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.