Hard Drive Repair Explained

Hard Drive Repair is a term that can conjure up a lot of misunderstanding. Most clients that call in needing hard drive recovery, tell me, “I don’t need the hard drive repaired, just the data off of it!”

Yep we know that, but if your hard drive is clicking or isn’t spinning up, you need hard drive recovery. The hard drive recovery process includes repairing the disk to the point that an engineer can read the file system and recover your data! Often times, the hard disk is repaired and cloned sector by sector to stable media. At that point the data recovery truly begins.

While it is true that you don’t care about that old hard drive, just your data, we still have to repair it. For more information about hard drive repair or why hard drives fail visit our site or call: 1-866-438-6932

The data recovery industry explained is a great article about what actually happens when we get in a drive for hard drive recovery.

Give DTI the chance to work for you. Call Toll Free: 1-866-438-6932 or fill out an online quote form.

How To Set Up Your Computer The Right Way

If I were a Technician how would I set my machine up to keep my data safe from Spyware, Malicious)ware and viruses? Although this article actually has little to do with actual “data recovery” if you are attacked by any of these issues it will cause to have data recovery done.Also, I thought it would be nice to share with you how I have my machine set up so that I stay safe. Firstly, I am going to go over your Internet connection and how to stay secure from the infamous 13 year old hacker. This defense, applies directly to my broad band friends out there (cable modems, dsl, etc.). If you are live on the Internet at all times, with your own ip then you should NEVER EVER have that connection going directly into your computer from the cable modem your ISP has provided you with.

It is imperative that you put a wall between you and your computer, and this can easily be done with a router. You can pick up router at most large electronics retailers for a very reasonable price. In many markets the cable company will provide you with a router if you tell them you need one.

I know many of you use a software firewall, but it has been my experience that they do not do a proper job. A software firewall like Zone Alarm just adds more headaches then it is worth in my opinion, and can end up being a data recovery nightmare if you ever decide you want to actually remove the software.

Now we move on to our most important daily protection for our computer. First, how do we scan for this spy ware and malware? I have used a lot of products, tested everything I could get my hands on, and after years of dealing with this problem one thing is clear. It does not get any better the Ad-Aware by Lava Soft. First of all, this software is free for use on a single home computer (you need to pay for it you are going to be running it at a business or in a network environment). Secondly, they are diligent in keeping their offender database up to date. The software is easy to use and allows for many different types of scans.

I run Ad-Aware 2-3 times a week depending on how much Internet surfing I am doing. The next thing we need to do is block the offending malware, and spy ware sites from even getting access your computer. In order to do this I use Spybot Search and Destroy. This product has an extensive list of sites of known spyware offenders and will add blocks to your machine so that they cannot install any of their nasty little pop-ups. Make sure you install the product and then update it. After that, you only need to use the IMMUNIZE feature.

Doing this will block the sites. I IMMUNIZE about once a week. As for virus protection, the product I use most is Norton Anti Virus. This product has a proven record and has long time been an industry leader. I do not recommend installing all of Norton system tools, just the virus scanner. Make sure you keep live the updates setting on and set the weekly scan up. I would also make sure you turn on the email protection. When it comes to trying to block spam, in your email, there are thousands of products. I have tried setting up rules in outlook to deal with this problem and have had little luck with it actually filtering all the bad guys out.

After looking long and hard for a decent product for this I finally found CloudMark. I cannot say enough about their service. Now it does have a subscription fee but is minimal compared to the headaches they prevent. IF one of the baddies does happen to sneak by you have an easy button to click and this will prevent you from getting email from them again. Finally, to toolbar or not to toolbar that is the question. For me the answer was easy.

Yes! With the toolbar battle raging I have found the Google tool bar to be the most flexible and reliable. The toolbar makes searching a snap, as well as blocking pop-up’s. It adds that extra oomph needed to really keep them at bay. Make sure you have your Internet Explorer pop-up’s turned off also. I hope that this article has at least been a little helpful in keeping your Internet browsing as safe as possible.

Why Use Data Recovery Experts

Why Use Data Recovery Experts? Before attempting any form of self data recovery from information gathered from web sites that offer suggestions about hard drive recovery, you need to be informed about what data recovery is and why it takes an expert with a clean room for most data loss scenarios that involve repairing a hard drive.

Do it yourself Hard Drive Repair & the Risks

What is the problem?
Does the drive spin?
If so does it click?
Does the armature kick out?
Do the drives heads vibrate to initiate?
Is there an odd smell to the drive?
If it doesn’t spin do you here a slight or faint ticking sound?
Does the BIOS see the drive?
Does the BIOS see the drive as the correct model?
Are there funny characters showing on boot?
Does the operating system blue screen?

Important things you should be aware of before you do anything to a suspected failed hard drive
Static discharge will kill a hard drive when handling… especially the internal components Dust will destroy your data… DO NOT OPEN!

In my experience I see so many hard drives destroyed by helpful neighbors when the problem was not situated internal of the hard drive assembly. Just because it clicks doesn’t always represent an internal failure.

Swapping the electronics runs the risk of further damage, especially if the revision number of the PCB is different. You will have a greater success of recovery with less risk if the original electronics is repaired.

Full Diagnostic Imaging This is a bit by bit, sector by sector cloning operation of a failing hard drives with bad sector reporting & remapping System Area Repair at Manufacturing Levels The system area of a hard drive is NOT common knowledge.

This is an area of the hard drive that is purely communication between the internal workings of the hard drive assembly (HDDA) & the printed circuit board (PCB)… Unlike data that is stored from track zero, that most commercial data recovery software has access too.

The system area starts at minus zero that proprietary equipment is needed to gain full access to this area for data recovery PCB Chipset Replacement & Reprogramming There is a lot involved when a chip on the printed circuit board that shows signs of failure, this can be caused by a more serious fault or even daisy chain through circuitry when replaced… meaning if you repair one chip it only reveals others that were also affected by the failure Class 100 Dust Filtration Systems Essential for Platter Replacement This is very important if every other diagnostic has pointed to the extraction of the Platters internal of the drive hard disk drive assembly to be removed and reinserted into another matching HDDA.

Any form of contaminants on the platter surface will result on loss of data. but this is not the only precautionary matter, there is platter alignment and balancing to take into account as well. If you mis align a bottom platter to the top platter by a micron it is practically impossible to realign CRC Error Checking Control CRC also known as cyclic redundancy check is where an unreadable bad sector is skipped due to its error reporting system acknowledging that there is an error… if this is disabled there is a higher chance of retaining data Parts The correct parts are sometimes very hard to find… and when you do they are wrong.

One model of a hard drive can be manufactured in three different parts of the world with altered components… yet still retain the same model number, Also a hard drive is very smart; they are designed to work around imperfections of the platters surface.

They will move failing sectors without your knowledge causing what we call a shift point. What this means is there is now unique information hard-coded on the hard drive’s surface that is now unique to the drives electronics. So even if you have the exact printed circuit board with matching numbers on all components, there is no guarantee this will work. If you have suffered data loss and your hard disk is physically damaged, call DTI Data. We are experts at hard drive recovery.

 24 Hour Hard Drive Recovery & Server/RAID Recovery Hotline:
Toll Free 1-866-438-6932 or direct 1-727-345-9665.

Extended Software Support:
8 AM to 11 PM EST 7days a week!

Undelete Files With Bad Sectors

Using Dart Undelete XP with drives that have bad sectors. Hard drive manufacturers have the monumental task of designing a device to store data knowing that by design, the device will fail. The shear physics of a hard drive make it doomed to failure. The steps that manufacturers have done to lessen data loss are two fold.

First, there is the implementation of the S.M.A.R.T. technologies. This system was designed to give the user a heads up when the drive may be failing. Several components such as drive speed, track to track time, head placement and many other tests are performed on the drives daily. These tests are used in a comparison over time manner and can show a pattern of device degradation. During the degradation cycle there is a manufacturer assigned percentage used that will alert the user of impending data loss. For instance, if a drive has been spinning at 7200 RPM for several months, then over the last several weeks the RPMs drop to 7000 RPM, this may be flagged as an impending problem and the user will be notified that possible data loss may occur in the near future. It is up to the user to backup the data and replace the degrading device.

Secondly, built in to every hard drive is a sector map. This map consists of two lists. The primary list, which is set at factory, maps all bad sectors out. These bad sectors are found and mapped before the drive is sold. In other words, hard drives are expected to have bad sectors. There is no such thing as a perfect hard drive. The reason for this is that a hard drive would cost several thousand dollars if procedures were introduced that would guarantee a perfect hard drive. In order to keep costs down drive remapping is used.

Now, once the list of all the bad sectors are made at the factory the drive is then shipped and sold. As the drive performs its day to day functions more bad sectors will appear. It is inevitable. These bad sectors are then mapped to another list. Both of the bad sector lists are mapped to a reserved area of the hard drive. There are only so many reserved area sectors for the firmware to remap to. Once these sectors are exhausted the firmware cannot remap and the bad sectors become part of your live data.

Signs that a drive has used its reserved sector area are, slow reads, slow boot sequence, operating system may seem to lock, may have to reboot several times before the operating system comes up. A chronic bad sector problem will eventually cause file loss, and ultimately the drive will not be able to identify itself to the BIOS and your data is either lost, or can be very expensive to recover.

If your drive is in a state where you have several bad sectors and you then either delete files, or the files just “disappear” the following is a list of symptoms that DART Undelete may exhibit.

1. It may take several minutes before the logical drive list is created. This is because you may have a slow reading, or intermittent reading sector(s) in the operating system boot area, or parameter blocks. The Master File Table primary entries may also have the same type of sectors.
2. The scan and build of the file list may take a very long time if bad sectors are embedded in the Master File Table. The Master File Table is the table of contents for your entire drive and tells the operating system where all your data is stored. If bad sectors are found in the Master File Table, then your problems have been compounded to an even higher degree and file loss is almost guaranteed.Three, during the copy of the deleted files to another drive the copy runs sluggishly. The copy could actually look as if it is frozen and the operating system may appear to be locked up. This is an indication that there are bad sectors in the data itself and the file you are trying to recover will more than likely be corrupt.If DART Undelete exhibits one or more of these symptoms all is not lost. However, using DART Undelete to try and recover the files using the standard method when you have bad sectors may actually exacerbate the problem on the drive and could eventually cause more data loss. So, the first thing to do is to stop using the software on a damaged drive. The next this to try is outlined in the following steps.
   

   Using Dart Undelete Data Recovery Software

   In order to recover deleted files from a drive that has bad sectors embedded in either the Operating System Boot Area, Master File Table, or Data Area it is necessary to move the data from the damaged drive to another working hard drive. To do this, you must use a piece of drive cloning software. There are several pieces of software that will clone drives for Windows, however, using cloning software in Windows can cause more problems.

   Here’s why.

   When software makes a request for a sector read from the hard drive it is passed to the operating system, the operating system then sends the request to the device driver, the device driver then sends a request the kernel. The kernel runs at ring zero. The kernel passes the request to the bus, the bus to DMA, then the firmware on the drive, and finally the head is engaged, moved to the proper cylinder, and the correct sector is read. The data is read, sent to DMA, this is then passed to kernel memory, then passed up to operating system memory and finally the application receives the sector data. Each one of these steps has a CRC check, some have multiple CRC checks, as well as compression checks and a plethora of other data checks. If any of these checks fail, the step will retry. You can have as many as a thousand retries for a single sector read request. If the request is at ring zero, that is considered a priority request and the operating system will sit and wait for a response. This is when the application seems to lock up, or freeze. It can actually slow the operating system down due to the prioritized task manager.

   With all of these requests for a single read, an already damaged drive is grinding away trying to pull the data off of the platter. The retries will actually wear down heads, platter media, it will heat up the drive so that the spindle will heat and the viscosity of the lubricant on the spindle can degrade and will eventually freeze the drive like an automotive engine with no oil. What we want to do here is to minimize the amount of read retries. The best way to do that is to run a simple operating system, and an application that does not have any retry requests. DTIDATA has such a piece of software, it is called Speed Clone and it runs from a floppy and uses FreeDOS as its operating system. The software is $49.50 and can be found on our website for download. There is also Knoppix for Linux that will allow you to use Linux cloning tools to copy the data from one drive to another. Knoppix can be a bit overwhelming for anyone who is not familiar with Linux, but, it is an excellent tool.

   Once you have decided on the proper imaging software you are going to have to place your source, and destination drives in the computer to do the copy.

• Open your computer and take out the bad drive.
• Make that your master drive by setting the jumpers on the drive.
• Take the drive that you are going to make the image on and make that your slave drive.
• Place the drives back in the computer with the proper cabling and air flow set up.
• Make sure that you have at the very least a 450 watt power supply in order to run all the fans, and hard drives that are now in your computer.
• Place Speed Clone in the floppy drive and boot your computer.
• Make sure that your BIOS is set to boot from the floppy first, then any other media. You want Speed Clone to boot the system.

If you have set up the software properly the operating system will boot right into the software. Both your drives should now be displayed in the window of Speed Clone. Since you have made the hard drive with the bad sectors the ‘master’ that drive should show up first in your ‘Source Drive’ list.

Mark the first drive as your source drive, and the second drive as your destination drive. Before you begin the clone make sure that your source drive is the drive with the bad sectors, and the destination drive is the new drive. The destination drive must be the same size or larger than the source drive.

This is of primary importance, Speed Clone takes no prisoners. If you have set up the drives wrong, if you choose the wrong source and destination drives Speed Clone does not care, it will destroy all data on the destination drive by using the data from the source drive, so please be very careful when using the application.

Editors Note 11/20/06: For a step by step tutorial on how to set up a slave drive with pictures and everything visit our “Data Recovery Tutorial setting up a hard drive as a slave”

Speed Clone will make an image on the destination drive and any bad sectors will be copied as zeroes. In other words, no data will be copied. A list of bad sectors will be created by Speed Clone. This list can be printed out and you can make a determination of how corrupt the file system may be.

That is for another article, and exceeds the scope of this one. If the drive has more than ten thousand bad sectors in the first 3 gigabytes of the drive, that’s not good and your file system will probably be fairly corrupt. If you have more than fifty thousand bad sectors in the first twenty to thirty percent of the drive that is also bad and your data as well as the file system is probably corrupt.

No matter, once the clone is finished reset your system to boot from XP, and make the new cloned drive the slave. All you need do now is run DART Undelete as normal and copy your deleted files onto the master drive. Everything depends on how clean your clone is. The fewer bad sectors, the better the data recovery will be.

Download DART Undelete:
DART Undelete File Recovery Software

Why You Should Defrag Your Hard Drive

I more then likely average about 3 to 4 calls a day from people who have formatted and reinstalled their operating system. Usually by using the manufactures (i.e. Dell) system restore feature, not realizing that this will bring the machine back to the way it was when purchased. All of the data that was on this drive now seems to be gone forever.But this is not the case; most of the data should still be fairly intact. You will have to use what is called a file harvester, or raw data scan, piece of software in order to find these files. The way these pieces of software work, is they start at the beginning of a hard drive and begin to scan looking for unique file header information. These file headers, are unique to the type of file (i.e. JPG is FF D8 FF E0) and therefore the software can try to “piece” the drive back together. If you have defragged your hard disk recently there is a much higher recovery rate because there will be no trash data in your file. If you have not defragged, the likelihood of recovery diminishes greatly, because the software you are using can not tell where a file starts and ends, if it is fragmented.

So I still have not explained what Defragging does. In a perfect world when we wrote data to our drive we would never delete it, but that is just not the case. As we delete files and add files there is “empty” spaces left on our hard drives. These spaces have actual data in them but it is no longer part of any file. As we go forward with normal pc use, we continue to cause the drive to be fragmented and not contiguous. Running Windows defrag on a weekly basis will up the performance of your machine, free space on your hard disk, and leave you in a better data recovery situation should that happen to you. Windows Defrag will move your files around to make them contiguous and therefore more easily accessed by Windows. You can schedule a weekly defrag by following the directions below.

How To Schedule a Weekly Defrag:

Click on the Start Menu and go to the control panel.

Now click on Performance and Maintenance

Once in that screen click on the Scheduled Tasks option

Now double click on Add Scheduled Task

Then Click Next

Click Browse, and now let’s go to the windows/system32 folder, and select defrag.exe, and click Open

Now use the wizard to set a schedule for when to run the defrag.exe program.

When you are asked for your password be sure to enter it, and click next.

Check Open advanced properties for this task when I click Finish box, and then click finished.

The following window will pop up.

In the RUN text box add the drive you are wishing to run Defrag on, in most cases this will be C:, to the end of the line.

Click ok and your computer should run defrag on your main hard drive once a week! This will make it better for anyone who might need to perform hard drive data recovery on your hard drive.

Where To Copy Recoverd Data To

Where To Copy your Recovered Data?

I recently had a call from a customer who had tried used our DART File Undelete software to recover their data. Unfortunately once he saw his data, he then clicked copy and selected to copy it back down to the drive he was trying to recover from.

He had a good reason for why he did this; the main drive in the machine he was running the software on did not have enough room for all the data he wanted to restore. What I had to explain to him was the first rule of thumb with deleted files; never write anymore data to the drive once you realize you have deleted something important. 

The reason for this is Windows wants to write to areas of the drive it has written to before first. (go ahead and take a second to read that again LOL) The reason that they do that is in an effort to keep the file system contiguous, since people do not defrag often enough. So if you find yourself in the situation this customer was in it is better to save off little bits, check the data, and then write it off to CD, then it is to put any data on the hard drive with the deleted data.

NOTE: Even surfing the Internet on a machine with deleted files could overwrite them.