Tom’s Hardware: Burned, Dropped, Drowned: HDD Recovery In Pictures
By Chris Angelini, Tom’s Hardware, 5/11/09
On June 12, 2008, Cedar Rapids School District Print Shop was given four short hours to prepare for the impending flood of water heading in their direction. With the deadline looming, shop supervisor Robin Rieke was instructed to “put anything of value on top of furniture that was at least three feet off the floor and evacuate everyone from the building.” For extra safety, she placed all the shop’s computers on surfaces five feet and above.
Surely you can already guess what happens next.
The floodwaters rushed into the building and destroyed the print shop. The water level was more than double what was expected and crested at seven and a half feet, submerging everything under water including all the print shop’s computers that contained vital data for the survival of the shop.
Rieke arrived on the scene a day later, against the recommendation of local officials, and immediately searched for the hard drives. The shop’s waterlogged drives stored documents from over 40 schools in the Cedar Rapids School District, including newsletter layouts, student handbooks, forms, curriculum, and more.
Rieke knew she had little time to recover her shop’s critical data and called DriveSavers, a professional data recovery service provider. According to company representatives, DriveSavers specializes in recovering data from hard drive problems like media damage, directory corruption, and virus attacks, as well as severely traumatized storage devices that have been submerged in water, fire-damaged and more.
Hopefully you’re protecting yourself with regular backups and virus scans. But what happens when catastrophic failure craters a drive with irreplaceable data on it (if you missed Tom’s Guide’s CES 2009 coverage of an external drive being submerged and burnt, check it out here)?
When Reike’s three mud-caked drives arrived at DriveSavers, it was clear they had suffered severe trauma. Their external cases were immediately cleaned and disinfected in the receiving department before delivery to a special clean zone for disassembly. DriveSavers notes that data recovery software of any kind should never be used on hard drives that have been traumatized or on drives where data is critical. They recommend that off-the-shelf data recovery software and other disk utilities be used with extreme caution and only when a clone or disk image of the hard drive has been obtained first.
The company also says it frequently receives drives that are pronounced unrecoverable due to severe media damage (which it says can be caused by attempts at using data recovery software). It is recommended that anyone experiencing the loss of irreplaceable, one-of-a-kind data should seek the assistance of a professional data recovery service.
Recoveries from water-damaged storage devices are extremely complex for several reasons. Despite popular belief, hard disk mechanisms are not sealed. They often have breather holes, which allow air to enter the mechanism and compensate for altitude changes.
Note the small hole in the top cover. Water and other contaminants can seep into the mechanism, causing spots on the platter surfaces.
Once the drives are disinfected, they are taken to a cleanroom, which, at DriveSavers, includes three separate ISO certified zones: ISO 5 (Class 100), ISO 6 (Class 1000), and ISO 7 (Class 10,000). DriveSavers says it has an inventory of over 20,000 parts and drives stored in an ISO 8 (Class 100,000) clean zone, which are used to swap in and out of drives in the recovery process. For more information on cleanroom standards, check out this link.
Cleanrooms are dust-free environments that maximize recovery results. Even the tiniest airborne particles can collect on open hard drives and cause read-write heads to malfunction. If the read-write heads damage the drive platters, valuable data could be lost forever.
During disassembly and cleaning in DriveSavers’ ISO certified cleanroom, rust was found already building up inside the drive’s external enclosure.
A closer look at the circuit board reveals rust on the drive’s metal surfaces, after only a few days out of water.
After removing the drive’s printed circuit board, more water was found underneath the protective foam padding.
Here’s where things get nasty. A large amount of moisture found its way into the drive mechanism.
The platters need to be removed and professionally cleaned to prevent hard water spots from forming.Hard water spots can develop on platter surfaces if platters are left to dry out. The spots are difficult to remove and make recovery nearly impossible.
In very rare cases, platters are removed from hard drive assemblies. In situations such as fire or water damage, the platters must be cleaned using a media sanitation system that DriveSavers says is proprietary.
The company also says that there are situations where platter damage is too severe and data cannot be recovered. In the case of fire damage, heat may have warped, or scorched the platters. With water-damaged hard drives, impurities in the water settle on the platter surface and, if left to dry, can create hard water spots that bond to the platter surface. Fortunately, only a small portion of DriveSavers business is disaster-related.
After cleaning is complete, any minor water spots that remain on the platter must be carefully removed. Due to the water-damage and corrosion, no parts from the original hard drive can be salvaged. This is a true transplant. Therefore, the platters must be mounted inside an identical model drive to complete the recovery.
Four techs are better than one. A typical recovery job will pass through the hands, on average, of four DriveSavers cleanroom engineers. Some engineers specialize in the disassembly and rebuilding of drives, others focus their attention on the cloning process.
DriveSavers says that all of its cleanroom engineers receive specialized training in advanced hard disk drive design principals and concepts, HDD firmware programming, advanced data recovery strategies, including vendor-specific information, and recovery procedures.
A high-powered microscope is used to re-check the media for water spots or debris before the drive is rebuilt. Once the platter surface is restored to pristine condition, the data is imaged onto a target drive.
After cleanroom engineers finish the imaging process, the data recovery is completed. Logical engineers work in the file systems; edit and rebuild damaged directory structures, recover and check the critical files, verify the recovery, and double-check for viruses before data is returned.
DriveSavers is SAS 70 Type II-certified, which means the company has undergone and passed an audit conducted by an outside source. Meeting SAS 70 Type II criteria ensures that customer data is appropriately protected before, during, and after the data recover process.
It took DriveSavers three days to recover Robin’s data from the previously-dead drive. When she received her recovered data she was naturally ecstatic.
Drive recovery isn’t cheap (we didn’t want to pry too much into this particular case study), but sometimes it’s the only option when disaster strikes. Before hooking up with DriveSavers, we had never seen what the process entailed. Now it’s certainly easier to appreciate the delicacy and care that goes into opening a disk up, handling its media, and swapping out parts , all while keeping data intact. If you’d like to take a look at some of the company’s more bizarre disaster recoveries, check out its online museum.
Read the original article and see a hard drive recovery in pictures at Tom’s Hardware.