|
Data Recovery Myths and Misconceptions By Steve Burgess, 2007 In the very early 80's, IBM introduced the IBM PC, progenitor of most modern personal computers. That same year, undoubtedly, the first PC hard disk failed and someone was screaming about their data and cursing IBM. Shortly after that, we started the data recovery industry and created most of the established practices and recovery techniques in use today. Over the years we've seen quite a few pieces of misguided advice about recovering data in the popular media, and heard many others. I don't know if we've heard it all, but we've heard these: Slap it, heat it, hit it, freeze it, drop it, tap it, swap the board, open it and spin it, use Norton, spin it with a drill, use a higher voltage, it will fix itself, and pray. I'll address a few of those here. Hit it and its variations: slap it, tap it, and drop it. Sounds like a substitute for Snap, Crackle, Pop, and their brother, doesn't it? And surely, the frustration that comes with a hard drive that won't give it up is enough to make one want to hit and slap, with maybe a little kick and toss thrown in. But all of these are bad ideas if you want your data back. We've seen many variations in user magazines over the years. The problem: The drive won't spin. Older drives had an issue called, "stiction," a contraction of "stick" (as in, "stuck") or "static" with "friction." The basic problem of stiction is that the read/write heads have adhered to the platters inside, and the motor doesn't have enough torque to get started spinning. This isn't the only reason drives don't spin — in fact; it is not the major reason. Modern drives (those since 1995 or so) almost never get stiction. The solution: If your drive actually has stiction, you might try our patented* "stiction spin." Hold the drive by opposite corners, parallel to the floor. Imagine a post coming up from the floor through the center of the drive (you might have already imagined this!), and rotate the drive around the axis of that imaginary pole abruptly. In other words without letting go, spin the drive abruptly a half turn. Repeat twice. Be careful not to let it go Frisbee-ing across the room! Now apply power and see if it works. If it doesn't work, the drive probably does not have stiction and needs to be sent to a data recovery house. Heat it, freeze it: When a drive won't spin, some have recommended applying heat with a hair dryer or heat gun, or putting the drive in the freezer - or both alternately. The problem: The drive won't spin or there's a circuit board problem. The idea behind unsticking a drive with heat or cold is that the contraction or expansion of components inside a drive will knock the heads loose form the media so the drive can spin. Unfortunately, both hair dryer & freezer are pretty bad ideas. While they've been known to work once in a while, they've been known to destroy the drive as well. Heating can destroy any number of components on and in the drive. A freezer can cause moisture to condense on the platters inside, rendering them further damaged. The solution: If the drive has stiction, use the (non) patented stiction spin, described above. If the circuit board has a hot spot, it may be able to be kept cool with a fan, or occasional application of canned freeze spray (really), or by holding canned air upside down and spraying. It's very cold, so don't spray your skin! One of the weaknesses of using freeze mist is that a) the abrupt intense cooling can damage an electrical component, and b) your can of cold stuff will run out in a minute or so. If blowing cool air with a fan will not keep the drive cool enough, there's something seriously wrong and you probably need to send the drive in for recovery. Swap the board: The idea behind this approach is to take the circuit board from another disk drive and use it on the bad one. The problem: Sometimes the first problem a drive has is the circuit board frying. This can yield a number of secondary problems, most notably partition and file structure getting nuked when the board fries. In such a case, a board replacement will not get the data back, although the drive may function physically. If other components, such as the motor, heads, head assembly driver or cabling has shorted, hooking up another circuit board may simply blow the new board out. Still, if there was no file structure or partition damage, and no internal shorts, this approach used to work fairly well on older drives, before manufacturers were making components in different factories all over the world, before drives gained some internal intelligence, and before drive sales became so dramatically competitive. Now drives may differ from week to week, from factory to factory. In many cases, using a board from a drive with an identical model number won't work. It will fix itself: Hey, sometimes just leaving it alone for a while and trying it again later works. If it works for you, remember the Boy Scout creed: Be Prepared! Have media standing by to back up your important data immediately! Use a higher voltage: Don't do it! It will just burn something out. Spin it with a drill: Need I say it? Just don't do it. If the drive is not spinning fast enough, and even if you could get it spinning at exactly the right speed with a drill (something I'd like to see...) spinning it faster won't help. The drive's internal tachometer and motor electronics are intimately intertwined. Spinning it externally won't help. Use Norton: There are a number of utilities, including Norton Disk Doctor, whose purpose it is to repair file structure. The problem: Anything that writes to the drive is overwriting something already on the drive. If a utility writes the wrong thing, it can make the problem worse to the point of making the data unrecoverable. We have seen hundreds of drives in this condition, so this is not a light warning. Furthermore, if the problem with the drive is media damage (about 10% of the time), then the longer it runs, the worse it gets. A drive can be destroyed within a few minutes once the media begins to become compromised. The solution: If you must use utility software, try to use something that does not write to the drive. There are certain errors that are very likely to cause damage - in particular trying to let software repair any error condition with the word "node", "tree", "branch", "FAT", or "MFT" is quite dangerous. If the utility lets you save an undo file, it's best to use that option. If the utility has an option to allow you to select what repairs to do- select that option. It may take longer, but it's best to keep it from automatically performing repairs. If you hear any suspicious noises — clicking, grinding, or erratic spinning, stop! Open up the drive: Drives are manufactured under extremely clean environments. You can't get your office or home clean enough to make it safe to open a drive unless recovering the data is not important. A small piece of dust is dozens of times wider than the gap between head and platter inside the drive, and at 7200 or 10,000 RPM, a piece of dust packs quite a punch. Even a fingerprint is like a small mountain at this scale. Furthermore, the insides of the drive are aerodynamically designed to exacting conditions, and lifting the lid destroys that environment. Furthermore, removing the screws to remove the drive's lid may well move components inside by a critical thousandth of an inch - rendering your data unreadable. Opening the drive will be interesting, but unlikely to yield any progress in an office or business environment. Prayer: Works sometimes too. Still back up your data! Because the next time you may not have a prayer! Steve Burgess is a freelance technology writer, a practicing computer forensics specialist as the principal of Burgess Forensics, and a contributor to the just-released Scientific Evidence in Civil and Criminal Cases, 5th Edition by Moenssens, et al. Mr. Burgess may be reached at http://www.datarecoveryworldwide.com or via email at info@datarecoveryworldwide.com
Related Articles -
data recovery, crashed hard disk,
|
