External Drive turned to RAW

[Mike McCall]

But that new SSD drive you sold me is new.
It's under warranty, so won't "they" make it right for me.
Including getting Grandma's photos back.
And the explaining goes on and on.
LOL!

Yes, that was part of the discussion too.

 

[Krynn72]

There you go again trying to make sense out of end user practices. The scheduled backups to the drive took place, but she spread her data onto both her main drive and the external. It's a constant fight ya know.

I remember a situation just like that. A DJ wanted a backup solution using his external drive. About a year later he comes in with the external clicking after it got dropped while DJing. I ask why did he bring his backup drive with him? He then tells me he keeps all his music on there now and only had like 30 songs left on his computer.

It really is amazing how some people just seem to not understand basic concepts when it comes to computers. Like it's not even a technical concept. People understand having a backup for anything else. Have a backup tool in case yours fails in the middle of a job, have a backup plan in case your first plan fails etc.

Throw a computer into the mix and people suddenly have no idea what the word even means.

 

[lcoughey]

Update on this drive:

I received this drive from Mike yesterday afternoon. We found that the heads are starting to crash with some media damage at the front of the drive, the firmware also had a few issues and there was some file system damage. At the end of the day, we were able to recover all the files without any errors with the exception of a backup file from the summer of 2017, which wasn't needed.

All in all, a quick, clean recovery and hopefully a happy client for Mike and his team.

Just for kicks, here are the steps we did to recover the data:

1. Via terminal with the drive in BootROM mode, we saved the ROM using PC3000
2. We programmed a compatible SATA PCB with the saved ROM, modifying it so that the SA zones were blocked using PC3000
3. We forced access to the SA within PC3000 utility
4. We saved module 01, 02 and 11 from the SA with PC3000
5. We reloaded the utility with module 01 being loaded from file with PC3000
6. We disabled SED so that we could have full SA access in normal mode using PC3000
7. We ran a firmware fix to resolve a common slow responding issue as a result of too many bad sectors on these drives using PC3000
8. We reloaded the drive in the utility and saved all the drive's firmware with PC3000
9. We created a task in DE to image the drive, setting the task to decrypt the SED encrypted data on the fly, via the PC3000 utility
10. We imaged the MFT and Bitmap files (a few bad sectors encountered) with DE
11. We selected only the sectors tagged as containing data according the the Bitmap file and imaged those sectors with DE
12. We ran a few cleanup passes to get the number of unreadable sectors down to as little as possible with DE
13. We scanned the MFT & INDX records to be sure we had a clean file structure with DE
14. We saved out the data to a destination drive, separating the good files from the damaged with DE
15. We generated an HTML file listing and sent it to Mike to show that we were successful with SNAP2HTML
16. Original USB PCB was put back onto the drive

Now it is just a matter of invoicing, payment and return shipping.

 

[Mike McCall]

Invoice paid and replacement drive containing recovered data is on its way. Thanks, Luke!

This has been a very frustrating process for me as you may have gathered. Part of me wants to limit any recovery services to those clients who invest in a 3-2-1 backup strategy to protect themselves. But then if they did, recovery would be moot, right? If one is unwilling to adopt a 3-2-1 backup strategy I'm finding myself less sympathetic to their panic. If the person is not a client I can understand the ignorance. However, as a client they clearly have no such excuse as I'm constantly reminding them. I can see my attitude changing in this, and my becoming less sympathetic to their woes.

 

[nerd2u]

Hey Luke do you mind if I borrow your post to show customers why it cost what it does to do a proper data recovery?

Sent from my SM-G870W using Tapatalk

 

[lcoughey]

Hey Luke do you mind if I borrow your post to show customers why it cost what it does to do a proper data recovery?

Sent from my SM-G870W using Tapatalk

I don't see why not

 

[Porthos]

Update on this drive:

I received this drive from Mike yesterday afternoon. We found that the heads are starting to crash with some media damage at the front of the drive, the firmware also had a few issues and there was some file system damage. At the end of the day, we were able to recover all the files without any errors with the exception of a backup file from the summer of 2017, which wasn't needed.

All in all, a quick, clean recovery and hopefully a happy client for Mike and his team.

Just for kicks, here are the steps we did to recover the data:

1. Via terminal with the drive in BootROM mode, we saved the ROM using PC3000
2. We programmed a compatible SATA PCB with the saved ROM, modifying it so that the SA zones were blocked using PC3000
3. We forced access to the SA within PC3000 utility
4. We saved module 01, 02 and 11 from the SA with PC3000
5. We reloaded the utility with module 01 being loaded from file with PC3000
6. We disabled SED so that we could have full SA access in normal mode using PC3000
7. We ran a firmware fix to resolve a common slow responding issue as a result of too many bad sectors on these drives using PC3000
8. We reloaded the drive in the utility and saved all the drive's firmware with PC3000
9. We created a task in DE to image the drive, setting the task to decrypt the SED encrypted data on the fly, via the PC3000 utility
10. We imaged the MFT and Bitmap files (a few bad sectors encountered) with DE
11. We selected only the sectors tagged as containing data according the the Bitmap file and imaged those sectors with DE
12. We ran a few cleanup passes to get the number of unreadable sectors down to as little as possible with DE
13. We scanned the MFT & INDX records to be sure we had a clean file structure with DE
14. We saved out the data to a destination drive, separating the good files from the damaged with DE
15. We generated an HTML file listing and sent it to Mike to show that we were successful with SNAP2HTML
16. Original USB PCB was put back onto the drive

Now it is just a matter of invoicing, payment and return shipping.

This goes to prove if the data is important do not try this at home kiddies.
Just think how many techs did a job like this that failed but could have succeded

 

[GTP]

This goes to prove if the data is important do not try this at home kiddies.
Just think how many techs did a job like this that failed but could have succeded

But we can only be guided by our clients Jerry. Or more importantly - their wallet!