+1 for R-Studio

[Larry Sabo]

Wouldn't that increase the risk of further damage and/or data loss, unless you have a clean-room and the right calibration/alignment equipment?

I open it in a cleanroom environment (Clean chamber with HEPA filter that removed 99.97% of particles 0.3 microns and larger in diameter) . Sorry, I should have stated that. I have a variety of data recovery tools, which cost me approximately $8,000 USD. The worst thing a tech could do, is open a drive outside of a cleanroom environment, followed by messing with heads/platters.

 

[DataMedics]

So, as I understand it, you would always disassemble the drive and assess whether it's safe to spin it up before doing so?

One of the questions we ask whenever a drive is first dropped off is if there's any strange noises. If the customer describes anything other than what sounds like a normal startup (or can't remember what it sounded like), then our first order of business is to open and visually inspect the drive in a clean room. Only if everything there looks good do we power it on. That way we're sure that no additional damage is caused by our powering on the drive at least. However by the time the drive ends up at our lab it's usually been powered on/off a half dozen times by the user, another dozen times by their buddy, about fifty times by their "computer guy", and finally comes to us. I've literally been able to see straight through glass platters at times that had the platinum surface completely sanded off by repeated powering on and off.

 

[lcoughey]

Sadly, for some reason, the default action of the "computer guy" when confronted with a dropped drive is to try to recover the data with his software. Common sense would dictate that a drive that stopped working after it was dropped has physical issues, not logical...not to say that all drops require head changes. But, if you assume the worst and find the best, you just get lucky because the job becomes that much easier. However, if you assume the best and discover the worst, you may find that you made it even worse.

I don't believe that all techs should send all data recovery cases to a professional data recovery lab. If you partner with the right lab, you should be able to communicate with them each case to determine what is safe to do with the equipment and skills you have. My clients range from end users and techs who send everything my way, no matter how simple it could be to some data recovery companies who have the same tools as I have, just not the skills to use them.

Yesterday, alone, I assisted another lab owner in California to fix a Seagate DM firmware issue remotely while I was communicating with another lab tech in Nigeria. A couple days ago, I was assisting a tech in India.

It all comes down to, know your limit and work within it.

 

[eikelein]

... It all comes down to, know your limit and work within it.

AMEN to that!
On a side note: lcoughey's company very recently made me a "family hero" ;-)
The story: Daughter's HDD goes bad. 15 years of pictures of growing young family & 4 kids lost; no backup (do kids ever listen?); terror!
I send the drive to recovery company #1, estimate $1750. We say thanks but NO, thanks.
They come back with "Oh, we think we can do it for $500." I smell a rat and say NO, send the drive back please.
I take #1's sticker off the drive and send it to #2 which is lcoughey's company. They do it wonderfully and quickly for Can$ 350 which is after exchange rate about US$ 290.

What I am trying to say is this:
There are BIG differences between professional recovery services. I unequivocally endorse Recovery Force from Guelph, ON, CA.

 

[Haole Boy]

Universe 2: Tech decides to clone in ddrescue first. Drive fails at the 80% mark same as in Universe 1
Amount of data recovered: 80% or more (depending on how full the drive was) because the sectors were being copied as they were read

Thank you for this info... been thinking about this a little bit but never thought it through. (I don't hit this scenario very often)

Assuming you live in Universe 2 and have a clone of 80% of a drive, how do you extract whatever user files that are within that 80%?

 

[Haole Boy]

...R-Studio was the only one that was able to find those pictures out of all 3 programs I used.

Do you feel comfortable sharing what the other two programs were?

Mahalo,

Harry Z.

 

[therealcrazy8]

Do you feel comfortable sharing what the other two programs were?

Mahalo,

Harry Z.

Absolutely. The other two programs werre Easeus and testdisk. I like test disk and I was actually surprised that it wasn't able to detect those pictures. It worked great on my 2TB drive that I am brokenhearted over. Its got mechanical issues and quite honestly if I could just have my 2TB drive back even if the files were lost, I'd be ok with that...lol

 

[JoeTech]

This thread has a lot of good advice. I have been wanting to figure out how to do a better job at data recovery and when to just tell them we need to send it in for professional help. I haven't had any bad SSD's come in yet, but I'm sure it won't be long before I do, How much harder is it to recover data from them and what do you have to look out for when dealing with them to avoid making things worse?

 

[fencepost]

My non-data-recovery-professional answer on SSDs: What you need to recover data from a bad SSD that's not showing up even as read-only is a backup.

In theory a lot of them are supposed to fail to read-only mode if they're going to stop writing data, but based on the stress tests that I've seen in reviews in the past they generally don't - they just cease to be drives. Because of how wear-leveling writes data all over the storage chips, you must have the indexing information, and if that's what's gone then it's not a drive anymore.

 

[therealcrazy8]

This thread has a lot of good advice. I have been wanting to figure out how to do a better job at data recovery and when to just tell them we need to send it in for professional help. I haven't had any bad SSD's come in yet, but I'm sure it won't be long before I do, How much harder is it to recover data from them and what do you have to look out for when dealing with them to avoid making things worse?

The added bonus with SSD's is that their are no issues pertaining to moving parts, since they have none.

 

[300DDR]

This thread has a lot of good advice. I have been wanting to figure out how to do a better job at data recovery and when to just tell them we need to send it in for professional help. I haven't had any bad SSD's come in yet, but I'm sure it won't be long before I do, How much harder is it to recover data from them and what do you have to look out for when dealing with them to avoid making things worse?

Typical SSD problems include a dead drive, the drive is detected with incorrect size (i.e. 8MB or 0MB), drive IDs but fails when attempting to read data, and the drive is identified with the wrong model number (i.e. "BAD_CTX").

The good news is, there is little anyone without the proper tools can do to make these problems worse (short of upgrading firmware and erasing everything).

Most of these problems can be recovered using high-end SSD tools that deal with the firmware problems (most of the problems listed above). If the flash controller is defective or flash chips are corrupt, then it's possible a "chip off" recovery could help recover the data using something like this: http://www.acelaboratory.com/pc3000flash.php.

Some SSDs cannot be recovered at all (probably by any company regardless of what they say/advertise, at least at this time), include all SSDs with Sandforce controllers. Here is a list of all Sandforce drives: http://forum.acelaboratory.com/viewtopic.php?f=179&t=8701.

 

[DataMedics]

Thank you for this info... been thinking about this a little bit but never thought it through. (I don't hit this scenario very often)

Assuming you live in Universe 2 and have a clone of 80% of a drive, how do you extract whatever user files that are within that 80%?

You just take the clone you were making, and then scan it with R-Studio or another data recovery program and extract them.

 

[Haole Boy]

You just take the clone you were making, and then scan it with R-Studio or another data recovery program and extract them.

Mahalo! (Thank you)

 

[glennd]

You just take the clone you were making, and then scan it with R-Studio or another data recovery program and extract them.

I've been using a program called OSFMount. You take your raw image created by ddrescue and load it up into OSFMount and it creates logical drives in Windows from each partition in the image. You then use your regular windows explorer to go and copy the files.

www.passmark.com or http://www.osforensics.com/tools/

I should warn that Windows insists on writing back to the raw image as it mounts it, ie it won't mount it as read only. So if it's absolutely critical that the image stays 100% intact, you should take a backup of the image.

 

[Haole Boy]

I should warn that Windows insists on writing back to the raw image as it mounts it, ie it won't mount it as read only. So if it's absolutely critical that the image stays 100% intact, you should take a backup of the image.

Thanx for this info. What sort of problems would "writing back the raw image" cause?

 

[glennd]

Thanx for this info. What sort of problems would "writing back the raw image" cause?

something to do with windows access control.

While trying to mount an image in OSFMount you might get this error from the operating system.

X:\ is not accessible.
The media is write protected

With X: being the drive you are trying to mount.

In most cases it is possible to mount NTFS drives as a read only devices ,except in old versions of Windows like Windows 2000. But in some case it seems Windows throws the error above if an image is mounted with the read only check box set, AND the image came from a different machine.

For example we saw the problem mounting an image in Win7 of the boot drive from an old XP machine.

The solution to the problem seems to be to allow both reading and writing to the image when initially mounted on a new machine. After the initial mount as a R/W device, you can then immediately dismount the drive and re-mount it as read only.

Poking around in at a deeper level it seems that Win7 wants to make an update to the "$Secure" file during the first mounting of the image. $Secure is a hidden NTFS file in the file system with the Access control list (ACL) database. So maybe it is adding a SID (Security Identifier) to the ACL for the new machine? If anyone knows the exact details feel free to post them.