Data recovery question

[Haole Boy]

Aloha! A customer brought in a Western Digital My Passport Ultra 2TB USB3 external drive that he dropped at some point, and asked if I can extract any of the data from the drive (pictures of his kids). You can physically see where the corner of the case is a little dented where it hit the ground. But, no clicking sounds and the drive does spin up (I can feel slight vibrations that start when the drive is connected to a machine).

Connecting it to a Windows machine results in the "device connected" sound, followed by the "device disconnected" sound, and nothing shows up in disk management.

At this point I usually extract the drive from the enclosure and put it in my hard drive docking station. Unfortunately, this drive only has a USB3 connector. NO SATA connector inside the case. :-(

So, I connected it to my bench machine via USB3 cable and booted Parted Magic and ran ddrescue. Much to my surprise, ddrescue started recovering some of the data! The bad news is that the recovery was very slow:

====================================================
root@PartedMagic:/media/sdb2/Andy# ddrescue -d /dev/sdd1 andy.img andy.logfile
GNU ddrescue 1.20
Press Ctrl-C to interrupt
rescued: 34275 kB, errsize: 0 B, current rate: 0 B/s
ipos: 34275 kB, errors: 0, average rate: 31018 B/s
opos: 34275 kB, run time: 18m 25s, remaining time: 209d 21h
time since last successful read: 1s
Copying non-tried blocks... Pass 1 (forwards)
====================================================

The value for remaining time fluctuates. At one point, it was over 1 year! I decided to interrupt ddrescue and seek some assistance. So, here are my questions:

1) Am I possibly damaging the disk by running ddrescue (considering that it will probably take several days)?

2) Is there anything I can do to speed up this data recovery?

Mahalo for your assistance!

Harry Z.

 

[labtech]

Aloha!
So, here are my questions:
1) Am I possibly damaging the disk by running ddrescue (considering that it will probably take several days)?

Yes, more than likely. Why? Because the drive being dropped implies a physical failure/deterioration of the internal read-write mechanism, that in turn is causing all kinds of disk errors while reading data from it (imaging - with ddrescue - is a read operation). These compounding errors, it has caused certain firmware components in the drive to become corrupt (hence, slow behavior, instability, etc).

2) Is there anything I can do to speed up this data recovery?

No, not without advanced knowledge of how to overcome the USB3 interface problem, knowledge and proper equipment to handle firmware alteration to prevent the drive's poor unstable behavior, as well as having to properly diagnose whether the drive's heads are damaged or not. More than likely at least one of the heads is toast, which will require clean room work, donor compatible drive to rebuild the drive's mechanics, and so on. Lastly, a couple more things: the drive also is likely to have its data hardware encrypted by WD design without the user/customer's awareness, so need advanced knowledge to overcome this problem; also need to have proper advanced imaging equipment. For degraded drives, ddrescue and any other software based tool will not do the job.

If the customer's data is important, then seek a data recovery specialist. We can also help if you are interested (send a private message with any questions you may have). Furthermore, here is a list of companies off the TechNibble forum: https://www.technibble.com/forums/resources/professional-data-recovery-labs.19/

 

[cyde_ePhex]

Maybe you could have tried cloning the drive first to get an image and then tried recovering data from the image? Could have saved you some time?

 

[Larry Sabo]

@cyde_ePhex, he did try cloning it, using ddrescue, which is what was taking so much time. When a drive has been dropped, if there is data of any value on the drive, it's best to have the heads checked in a cleanroom environment before attempting to clone/read from the drive, to be sure the heads are not deformed/detached and likely to scrape the media bare. @labtech's advice was spot-on.

 

[cyde_ePhex]

@Larry Sabo thank s for the correction. It was early and I clearly didn't read well enough. Thanks again

 

[nlinecomputers]

If the drive has been dropped you should never try ANY recovery method. Not if you value the data. Too many techs try to be heroes thinking they somehow can run some magic software and overcome MASSIVE PHYSICAL DAMAGE. Stop trying. You are only ruining the one chance a true professional with $30,000+ in equipment and a lot more training and experience than you can.

 

[Haole Boy]

If the customer's data is important, then seek a data recovery specialist. We can also help if you are interested (send a private message with any questions you may have). Furthermore, here is a list of companies off the TechNibble forum: https://www.technibble.com/forums/resources/professional-data-recovery-labs.19/

Mahalo for sharing your expertise also for the link to the list of data recovery specialists (I did not know that this list existed). Now to give the customer the bad news....

 

[DataMedics]

From what you're describing the recovery would most likely run $450 here at our company, just to give you a baseline.

These My Passport drives, like all WD drives, are prone to firmware issues after they start to develop bad sectors. Probably the drop caused a large area of bad sectors to form which in turn botched up the firmware when the drive attempted to re-allocate all those sectors. So basically what we have to do is to replace the USB native PCB on it with a SATA one programmed to work with it, patch up the firmware, test and verify the heads to see if they are still viable, and then image the data.

We do around 2 or 3 of these a week usually.

If you push it too far and end up killing the heads from all the strain of days of attempted imaging, the price will end up higher.

 

[Markverhyden]

Mahalo for sharing your expertise also for the link to the list of data recovery specialists (I did not know that this list existed). Now to give the customer the bad news....

And maybe reinforce that a backup is NOT storing the data on an external device, it's having two copies at all times.

 

[Your PCMD]

And maybe reinforce that a backup is NOT storing the data on an external device, it's having two copies at all times.

^ This, this and this!

 

[DataMedics]

And maybe reinforce that a backup is NOT storing the data on an external device, it's having two copies at all times.

Customer: "But I saved it on my Seagate Backup Plus that died, so I did have a backup"
Me: "Where was the original then?"
Customer: "I just told you, on my backup drive"
Me: