Tierra

Once you have sent in your hard drive what will happen next?

It will of course depend upon exactly what the problem with the drive is, however there is a common set of procedures.

Step one will always be to clone the client drive. All subsequent recovery will then be carried out on the clone created.

Why clone the drive?

This is an essential step in the recovery process (and one that separates the dedicated data recovery specialist companies from those who will simply run recovery software on your drive and hope for the best).

The client’s original drive is the only copy of this vital data in existence and it is held on a device that may fail at any moment, it is essential therefore that the contents are copied to a healthy hard drive which can then be subjected to the rigors of scanning and file extraction. If these procedures are carried out directly on the original drive there is a strong likelihood that the drive will terminally fail during the recovery work leaving nowhere for the recovery effort to go from there.

Obtaining the Clone

Sometimes the client data has been lost because the file system has been corrupted or perhaps a drive has been accidentally reformatted, in such cases the cloning process is typically a fairly straightforward process. More often there is either no or only limited access to the hard drive and in these circumstances there will be a need for remedial work to be carried out before the drive can be cloned.

Among the more common faults to be fixed before cloning can be completed are:

-          The drive doesn’t spin-up at all. This will typically be the result of either electrical problems or can be caused by a mechanical shock to the drive.

-          The drive spins-up but there is no access to the user files and a repetitive clicking sound is heard. This is commonly due to failed read /write heads but does have other potential causes which should be eliminated first. For more information on the range of noises made by faulty hard disks have a look at this article which includes a selection of recordings made from various hard drives.

-          The drive has limited, or intermittent access. This is one of the most common forms of failure. It typically affects older and heavily used drives but even brand new disks are not immune. The problem is the degradation of the chemical coating covering the platters which spin inside the drive and which hold the user files.  As this coating ages and breaks down, parts of the drive become unreadable. Once this process starts it can quickly avalanche and so early action is essential. Specialist equipment capable of cloning a drive sector by sector is required in order to work around the unreadable areas of the drive and build-up as complete a copy as is possible.

Once the clone has been completed the drive is manually analysed, usually using a hex editor (a program which looks at the raw content of the hard drive). This allows us to determine how the hard drive has been configured in terms of partitioning, which file system(s) have been used and which operating system(s). This information is used in order to select the best approach for scanning the clone in order to ensure that all recoverable data is identified.

Once this scanning has been completed the user files can be extracted to a second location.

The last stage is that of confirming that the files recovered are intact. Sadly a simple file list is no guarantee that the files to which the list refers are usable. The list is analogous to the index of a book; you can recover the full index but still have lots of pages missing from the book itself. It is worth keeping in mind that if a single sector in a typical JPEG photograph is corrupted then the photo can be barely recognisable (a typical photo will consists of hundreds of thousands of sectors).

Verifying the data is therefore essential (never trust a file list alone as proof of recovery- it is almost meaningless on its own). The only sure way to test a file is to open it with the appropriate application. Where the number of recovered files is small this is easily done, however the vast majority of hard disks will hold tens if not hundreds of thousands of files. In these cases extensive sampling is required. It is essential that the end user be allowed to request to see screenshots of files which are critical to them, this offer should always be made before recovered data is approved and paid for.

So in summary:

Step 1- Initial testing will reveal whether or not the drive is mechanically intact- if it is then the drive will be cloned. If it is not then the appropriate remedial action is taken in order to obtain the clone.

Step 2- The clone will be analysed to determine the partitioning, file system and operating system in use on the drive. The clone will then be scanned appropriately.

Step 3- The user data will be extracted from the clone.

Step 4- The extracted user files will be then verified and file lists along with screenshots will be produced for the client in order to demonstrate that the files have indeed been recovered in an intact condition.

Step 5- Finally the user data is transferred to a memory stick or external hard drive for supply to the client. As you would expect the data can be shipped encrypted at no charge if required.

We keep both the original client drive clone as well as a copy of the extracted user data for 10 days after shipping. This allows us to re-visit any part of the recovery process should the need arise.

{ 0 comments }