t
Alandata Flash Drive/ Thumb Drive / Memory Card Data Recovery
- Thumb Drives, SD cards, Flash drives are solid state devices that store data in NAND memory chips.
- Thumb drives often get broken off when users move their computers around.
- NAND memory wears out – they will all eventually fail.
- To minimize the effect of wearing out the memory blocks are shuffled around.
- One way to recover a NAND device is to fix it – this is about 50% successful.
- Another way to recover the data is to read the data directly from the memory chips with a special NAND reader.
Alandata has successfully repaired and recovered many, many thunb drives and memory cards over the last few years. Alandata is one of only a few data recovery companies to have the technology to read the memory directly from the NAND memory chips. This process requires the NAND chips to be desoldered from the thumb drive and read on a special reader. After that the descrambling challenge begins. NAND memory wears out as it is used – eventually they will all fail. To minimize the wear problem the memory is stored in blocks and the blocks are shuffled around. Unfortunately there are no standards as to how the blocks are stored. So every manufacturer uses his own scheme. There are literally thousands of possibilities. The challenge comes in determining the proper configuration – this takes experience, tools and expertise. Alandata has all 3.
NAS Data Recovery
- Alandata wrote our own NAS data recovery utility in 2000 to recover files from one of the first NAS devices (SnapServer).
- Since then Alandata has recovered hundreds of NAS devices.
- NAS means Network Attached Storage means disk drives connected to your network.
- NAS are also usually RAIDs.
- NAS are almost always Linux based computers.
- Your Windows or MAC files are stored in a proprietary Linux filesystem format.
NAS stands for Network Attached Storage. It seems like its just a box with disk drives in it, thats attached to your network. What it really is – is a computer workstation just like yours except it has no monitor, keyboard or mouse. Almost all NAS boxes run some proprietary linux type operating system. Files stored on a NAS are saved in a proprietary linux type of filesystem You may be using Windows XP or MAC, but when you save your files on a NAS they are stored in a linux-like format. Alandata has been developing software for linux since 1994. We long ago wrote utilities to recover files from every NAS device. These NAS filesystems are proprietary so we had to analyze them to figure out how the files are stored and how to recover the data. We can recover data from Snap, Lacie, intellistor, Buffalo, Maxattach – you name and we have probably recovered the data from it. Some NAS devices are also RAIDS – so all the extra issues of RAID recovery also applies.
Alandata Data Recovery Service – RAID Data Recovery
Some of our RAID recovery service highlights:
- In 1998 we developed COPYRAID, our own internal RAID Data recovery software utility.
- We have since used COPYRAID to recover over 360 raids.
- Recovered tiny 3×10gb RAIDS all the way up to monster 20 terabyte SAN arrays with 20 hard drives.
- Recovered 59 RAIDS in the last 2 years.
- Recovered RAIDS running on dedicated RAID controllers, like Adaptec, Dell, HP, Lacie, Snap.
- Recovered software RAIDS like Windows Dynamic Disk, Linux and those found in NAS boxes.
- Recovered RAIDS from Novell, Linux, Unix, Mac, Windows.
- Recovered RAIDS for IBM and States Attorney Generals.
- Recovered RAIDS after the major national data recovery companies have failed.
- 90% of our RAIDS come from other Data Recovery companies (whats that tell you?)
To be good at RAID data recovery you need a few characteristics:
- You need to understand RAID thoroughly. You could say that we ‘wrote the book on RAID‘ – because we wrote our own software to recover RAID.
- Great analyst, dogged determined. A critical step in RAID recovery is the analyzing phase. In this phase we have to determine
- How many drives makeup the array? What kind of array?
- Whats the proper order? Which parity are the using left? right? symmetric?
- Are there any unused hot spares? or partially rebuilt spares? stale spares?
- Whats the blocksize of the stripe?
- Has 1 drive been dead for a long time and its information is stale (ie the array is degraded)?
- Have any drives been rebuilt or swapped?
- etc, etc…
The permutations and possibilities are endless. It requires experience, and patience to analyze all the data and figure out what went wrong, in what order and how to fix it. You have to like puzzles…. soduko anyone?
- Tools. Good analysis tools are essential. COPYRAID has a features to help us look at the data and figure out the configuration. Since we wrote it we can modify the code to help solve difficult configuration issues. Like writing special code to look for certain things. We sometimes write special code to merge data from the good areas of multiple damaged drives.
About 90% of the RAID recoveries we receive come from other Data Recovery companies. That tells you that most data recovery companies do not have the expertise required to analyze and recover a RAID. Frequently we get the RAID after the other company has had it for a week and can’t figure it out.
Case study: RAID-1 2 x 160gb mirrored set: Recently another Data Recovery company brought in a RAID. The customer had reinitialized it, reformatted it and then installed a fresh copy of windows – overwriting 7 gb of a 160 gb raid. The company that brought it to me was out of time – they had had it for 1 week, the customer was demanding it back and all they had been able to recover so far was some small file fragments. We analyzed it, figured it out, and recovered it the very next day. They got back 99% of their data, with names and folders – just about perfect – despite their effort to wreck it….
Case study: RAID-5 4 x 1 tb. Data recovery company brought in a RAID 5 that they had for a few weeks with no luck. We analyzed it. It appeared to be a RAID 5. We determined the order and parity, everything confirmed. We deraided to a new RAID array – but the files were all bad – nothing was lining up. We tried a few more copies using missing drive parity to regenerate the ‘lost’ data – still wasn’t working. Finally after some extra in-depth analysis I figured out that it was a 3 drive raid with a spare – but the customer had rebuilt the drive as a 4 drive raid 5. So it looked like a RAID5, in sync with no parity errors. Normally this would cause all kinds of damage. Lucky for the customer was the fact that he rebuilt the spare so he didn’t cause any damage to his data. He just created a devious puzzle for the data recovery guy….
Q: What if my RAID is very damaged – can anything be done?
A: Yes. Fortunately with RAID the data is spread out over many drives – so often we are able to salvage quite a lot of useable data from the good drives. Unfortunately sometimes we get RAIDS that have been damaged badly. See my POST on the common RAID failure. Oftentimes technicians attempt to recover the data by using the raid software that comes with their system. Like they may swap in a new drive for the one that they think is bad and then rebuild the array. The problem is that they frequently get this wrong and they never back up the individual drives before they do this. If you resync the array with the wrong drive then you create damage across the whole array. Depending on the number of drives and the stripe size you may end up with data thats only good in 512kb fragments. Its like a paper shredder. If the pieces are big enough then you can salvage out some good files as long as they are smaller than 512kb and ‘live’ entirely in a good 512kb chuck. So Word docs are usually 50kb or less so lots of them will be recoverable. Movie and pictures are usually megabytes and compressed so they dont recover well at all. Although many pictures contain an embedded thumbnail that may be good. So it depends on how big the files are that you want back.
The phases of RAID data recovery
The recovery occurs in 7 phases.
- Copy original drives to work images. Working images are created in order to protect the original condition of the drives.
- Scan and map work images. We have developed COPYRAID analysis software which we will run on all the working images. This software maps out the required filesystem markers of interest.
- Analyze maps and estimate prognosis and best approach. Our system engineer will analyze the maps and determine:
- What the original configuration was.
- What the new configuration is.
- What areas have been damaged and overwritten.
- Which areas are undamaged and estimate how much is recoverable.
- De-raid to new array. The previous configuration determines how the RAID will be recreated to its original configuration.
- Clear undesired areas. The ‘new’ areas are purged to prevent recovering undesired new data.
- Extract recoverable files to new ‘copy-to’ drives. Analysis of the damage will determine which are the best methods to use to recover the maximum data. Multiple approaches may be needed.
- Generate file listings and report on quantity and quality of recovered data. We will produce file listing reports showing the files that were recovered and the amount of data located. We will also randomly test files to gauge the integrity of the files and the overall quality of the recovery.
RAID Array – How not to ship a RAID for Data Recovery
How many things wrong can you spot in these pictures ?
RAID 5 array – How not to ship for data recovery
We received this package containing 20 scsi drives from a RAID 5 array. One of the drives on the corner was damaged by an impact – but we were able to fix it.
- The cardboard box is flimsy – too light for the amount of weight.
- There is no padding between the outsides of the box and the drives.
- There is no padding between the disk drives to keep them from banging into each other
- There was a styrofoam insulator in the bottom of the box but they lost the top one and used bubble wrap instead.
If you care about your data then you need to package it better than this! Its a miracle the box didn’t burst open and spill all the drives.
The 4 Main Categories of Data Recovery Companies…
Data recovery companies fall into 4 main types:
- The majors – Nationwide, largest, well connected.
- The Pros – tooled and schooled – can recover most problems.
- IRU’s – Stands for” I Run Utilities”, lowest price – bottom feeders.
- Market and Forwarders: they dont recover anything – just do the marketing.
The major companies have offices nationally or globally. They have lots of resources, R&D departments, programming departments, ties to the drive manufacturers. If it can be recovered they have the best chance. They are also the most expensive. They will charge an evaluation fee. They aren’t perfect. I have recovered drives that they have deemed ‘unrecoverable’.
The Pros are professional local companies (like me…) the have invested in tools and education and can recover 90% of what the majors can do. They are much cheaper, dont usually charge an eval fee. They may also be more willing to work with you personally on your situation. To be a pro they should be able to completely rebuild a drive – that means successfully swap platters and heads into a new body. Be able to repair or build custom boards (its no longer possible to just swap boards). They should be able to fix damaged service areas – this part requires a $20,000 tool and lots of experience. A Pro will have a relationship with a national company and can recommend trying them at their discounted rate.
The IRU’s: these are the ‘I Run Utilities’ guys. There are quite a few companies offering low-cost fixed rate data-recovery. Every computer repair depot offers ‘data recovery’. They buy some software utilities and run ‘em. They make money by volume – they get a lot of cheap recoveries and pick out the simplest and easiest recoveries. You might as well download a free trial and do it yourself. The problem is that software can’t fix drives that are clicking. Utilities only work under the conditions that they understand. We use utilities but first we analyze the drive, diagnose the problem and select the right tool for the job. Many times we must modify the drive before the utility will be effective. These companies may also try to swap boards when the electronics have failed. This used to work but modern drives have custom boards – each board is ‘tuned’ at the factory – it cant be swapped. So what do they do when they can’t recover your drive? They may try to upsell you on their more expensive service and then forward your drive to someone who can really fix it (this is bait and switch). They may also do worse things. We have seen drives that have been opened unecessarily, fingerprints on platters and not original boards. Sometimes they take your good board and put on one of their failed boards – this makes it almost impossible to recover. The only drives that you should send this way are when you really dont care that much about the data.
Marketers: These guys don’t do any recovery at all. They market, market and market. Recently I checked Google and 5 of the first page DR companies were marketers. They forward your drive to the cheapest Pro DR that they can and then mark up the price. Since the Pro DR is working at a discount and is removed from the customer he doesn’t have a big incentive to try very hard. If they ship your drive somewhere that adds to the cost and adds 2 days to the recovery time. Your drive could be lost and further damaged. Why pay a marketer to hand your drive to a Pro?
So how can you detect the IRU’s and marketers? Ask questions, get recommendations, tour the facility. Will they let you talk with the engineer? If you can talk to an engineer did you call him or did he call you? If he called you then it could be because he is actually at another location and they dont want to give you that phone #. Do they charge a flat fee for everything? Think about this – lets say your car breaks down – would you trust taking it to a place that advertised “$200 all repairs – includes parts!”? If your car is out of gas or needs a fuse then they can fix it and make money. If it needs a transmission then they will tell you that its unrepairable. or they can fix it for $1200 but it will take a week or more. So be careful – there are a lot of fakers out there.
Data Recovery of a SCSI drive using a plastic bag…
I developed a new data recovery technique taday. I had 2 SCSI drives that would not come ready. I tried a variety of tricks. Finally what I did was…..
Now you didn’t really think that I was going to tell you did you?
Come-on its a secret…..
But I got both drives recovered with ZERO errors!
YeeHa!
SSD Drive has Epoxied Chips ?! SSDSA1MH080G1HP
I received an Intel SSD drive for recovery, and found a little bonus surprise when I opened it:
Intel ssd ssdsa1mh080gihp has epoxied chips – Alandata
Can you believe this – not only are the chips soldered down they EPOXIED the pins too!
Guess those suckers aren’t going anywhere.
Do they do this just to frustrate the Data Recovery Guy or what?
Anybody know how to dissolve epoxy? Acetone bath maybe….