WEBVTT 00:00:00.530 --> 00:00:05.790 Deep spar located in Ottawa, Ontario is a data recovery company 00:00:06.110 --> 00:00:10.210 but not in the way that you might think like you can't just 00:00:10.910 --> 00:00:15.310 Drop in with your dead hard drive and ask them to fix it for you 00:00:16.490 --> 00:00:18.490 their business is 00:00:18.690 --> 00:00:20.450 developing the software 00:00:20.450 --> 00:00:27.530 Hardware and the techniques that are used by everyone from mom-and-pop shop technicians to huge 00:00:27.530 --> 00:00:34.750 data recovery houses right on the other side of this wall is actually the classroom that they use to train police and 00:00:35.030 --> 00:00:38.310 other government agencies on data recovery 00:00:38.850 --> 00:00:41.890 So they sponsored our trip out here to do two things 00:00:42.510 --> 00:00:48.310 one to show consumers how to save money on data recovery service and 00:00:48.890 --> 00:00:56.770 Number two to show repair shops how they can dramatically improve their chances of recovery for their customers 00:01:04.560 --> 00:01:08.960 Scenario one of hard drive failure is clicking and clacking noises 00:01:09.540 --> 00:01:12.260 Sometimes without being detected by the system. Oh 00:01:15.620 --> 00:01:20.380 Okay, this happens it's probably a physical problem 00:01:20.380 --> 00:01:24.360 So if the data is important don't do anything 00:01:25.220 --> 00:01:27.760 Unplug your drive and send it to a pro 00:01:28.280 --> 00:01:35.200 immediately or your chances of a successful recovery will be dramatically lower or possibly even zero a 00:01:35.200 --> 00:01:39.740 Pro is going to use tools like these and a laminar flow 00:01:39.940 --> 00:01:46.380 workstation like this one or even a full-on clean room like the one that I checked out over at drive savers to 00:01:46.660 --> 00:01:51.860 physically swap components into the failed drive from donor drives 00:01:52.260 --> 00:01:59.860 Sometimes this needs to be done multiple times in cases where one bad part is causing the other ones to fail prematurely 00:02:00.380 --> 00:02:04.580 They'll also use professional tools from companies like deep spar 00:02:04.580 --> 00:02:11.760 So I didn't know it, but I was actually using disk imager 4 when I performed my own head swap in that video 00:02:12.380 --> 00:02:18.340 Scenario number two is an electronics problem. Maybe a broken SATA connector or 00:02:18.900 --> 00:02:19.980 a 00:02:19.980 --> 00:02:25.520 Burned chip on the PCB could be causing the drive to not be detected by your system 00:02:25.860 --> 00:02:28.100 the most common symptom here is 00:02:29.200 --> 00:02:30.660 total silence 00:02:30.660 --> 00:02:36.420 Now sometimes you will need to call a pro for this and if the data is mission-critical 00:02:36.780 --> 00:02:43.420 You should always call a pro but for nice-to-have rather than need-to-have data 00:02:43.600 --> 00:02:48.220 this type of failure actually exposes the platters of the drive and 00:02:49.140 --> 00:02:52.040 Therefore the data to much less risk 00:02:52.080 --> 00:02:57.940 So in some cases you can attempt a home repair if you're handy with a soldering iron now 00:02:58.620 --> 00:03:00.620 DeepSpar had this whole demo 00:03:00.660 --> 00:03:08.820 Planned for me the the TVS chip actually handles over current protection for the drive and can fail due to an external issue 00:03:08.980 --> 00:03:10.160 so just 00:03:10.160 --> 00:03:16.040 Removing it from the PCB can possibly brick the drive because you're removing the over current protection 00:03:16.100 --> 00:03:22.140 But in many cases it can allow the data to be recovered if it's hooked up to a known good system and power source 00:03:22.140 --> 00:03:28.720 But we are throwing that demo out the window because I brought DeepSpar an unexpected present 00:03:29.040 --> 00:03:30.500 This is 00:03:30.500 --> 00:03:35.200 Terran's personal dead hard drive that failed when we hooked it up to a 00:03:35.540 --> 00:03:40.660 Faulty power supply cable while he and I were at the office late upgrading his system 00:03:40.980 --> 00:03:45.540 Now he would likely be quoted three to five hundred US dollars 00:03:46.020 --> 00:03:52.240 Minimum to fix this and since he's Terran and he doesn't remember exactly what's on it 00:03:52.280 --> 00:03:59.660 He's not gonna pay that much to get it back. So we're gonna see how we do with a DIY grade repair. Yarek, you ready? 00:04:01.810 --> 00:04:05.430 So what we're gonna do first is we're gonna verify the diagnosis now 00:04:05.430 --> 00:04:08.830 I'm already pretty sure that we're gonna power up this drive 00:04:09.590 --> 00:04:11.880 And we're gonna hear a whole lot of nothing 00:04:12.200 --> 00:04:17.040 So that means there's a good chance that this is an electronics problem then 00:04:21.200 --> 00:04:23.200 Okay, so we power down 00:04:25.540 --> 00:04:33.160 Now unfortunately swapping out a PCB on a drive isn't as simple as going to the hard drive PCB store and buying one 00:04:33.580 --> 00:04:34.080 Yeah 00:04:34.080 --> 00:04:36.080 If only life were that easy, right? 00:04:36.820 --> 00:04:38.820 Look at him. He's defeated. He's defeated 00:04:39.760 --> 00:04:45.000 So eBay and Craigslist are your friends now, fortunately in Terran's case 00:04:45.320 --> 00:04:49.680 He already had a donor drive that looks like it's gonna be suitable 00:04:49.680 --> 00:04:54.360 So there's a couple things to watch for you need the drive model to be the same 00:04:54.640 --> 00:05:00.600 so not just this drive model, but also this model number right here, so these look good and 00:05:01.480 --> 00:05:03.980 You even need the PCB review 00:05:04.080 --> 00:05:09.360 To be the same now these two are a slightly different color here, but that's not important 00:05:09.360 --> 00:05:14.100 What matters is that they're both revision a and they both have exactly the same model 00:05:14.100 --> 00:05:17.040 So these should theoretically be suitable 00:05:18.300 --> 00:05:24.340 Okay, now we're at the point where most amateurs would screw up this kind of a recovery. They'd go. Okay 00:05:24.340 --> 00:05:28.400 Well now we take the good PCB put it on the bad drive and bippity boppity off to the races, right? 00:05:29.080 --> 00:05:30.140 wrong 00:05:30.140 --> 00:05:34.140 data density on modern drives is so high that the 00:05:34.500 --> 00:05:40.480 Manufacturing tolerances are nowhere near good enough that every drive will just work out of the factory 00:05:40.580 --> 00:05:43.540 so they have to build in compensation and 00:05:44.340 --> 00:05:47.460 Calibration that is unique to your individual drive 00:05:47.580 --> 00:05:54.120 It's usually stored on a little 8-pin ROM chip that looks like this and that specialized data 00:05:54.380 --> 00:05:57.720 Has to be brought over. So you want to show us how to 00:05:58.580 --> 00:06:03.280 Desolder and resolder a ROM chip. All right, let's do it. Let's not screw these up. Which one's which? 00:06:04.340 --> 00:06:06.340 D on this one. Okay, we're good 00:06:08.780 --> 00:06:13.280 There's a pro tip right there my friends better to market first 00:06:24.010 --> 00:06:29.980 Now we're ready to put the PCB back on and we can go test it, right? All right 00:06:30.600 --> 00:06:36.220 Here goes nothing. It's not picking up. Do you want to have a look at it? 00:06:38.390 --> 00:06:43.650 Okay, so unfortunately sometimes when you hook up to a bad power source, it kills more than one thing 00:06:44.130 --> 00:06:46.370 So we fixed our PCB problem 00:06:46.690 --> 00:06:48.930 But we're still getting this zero capacity 00:06:49.450 --> 00:06:52.970 nonsense here and we're getting kind of like a chirping noise and 00:06:54.250 --> 00:06:59.630 Jarek like drive whispered with the horse whisperer for hard drives over here and 00:07:00.210 --> 00:07:04.870 Told me that what he thinks is that it's the pre amplifier chip. Is that right? 00:07:05.370 --> 00:07:11.210 So that's a component of the drive head, which means that we actually need to dig a little deeper on this thing 00:07:11.210 --> 00:07:13.930 We're gonna take it over to the laminar flow workstation and tear it apart 00:07:14.570 --> 00:07:21.150 So what this station does is it uses a really thick filter here to pull all the dies? 00:07:21.750 --> 00:07:27.130 and then you can take it out of the air and then you've got this constant flow of clean air so that none of the 00:07:27.130 --> 00:07:30.710 Contaminated air around us can get into the drive 00:07:30.790 --> 00:07:33.690 That's really important with how close the head is to the platter 00:07:34.070 --> 00:07:40.810 Even the smallest speck of dust could cause catastrophic damage to the platter as it's flying over it 00:07:41.210 --> 00:07:45.070 So now we're swapping the known good heads from the working drive 00:07:46.030 --> 00:07:48.540 into our bad drive 00:07:48.540 --> 00:07:52.140 And actually now that I come to think of it by known good 00:07:52.140 --> 00:07:57.070 I have not actually tested this drive. 00:07:57.070 --> 00:08:00.310 Presumably Taren checked it before he gave it to me. 00:08:00.310 --> 00:08:03.370 If it helps at all for the tension of this situation, 00:08:03.370 --> 00:08:08.650 I still don't know that this will actually work 00:08:08.650 --> 00:08:09.490 the way we want. 00:08:09.490 --> 00:08:10.990 I mean, we could have screwed something up, right? 00:08:10.990 --> 00:08:13.010 What's your confidence level right now? 00:08:13.010 --> 00:08:16.590 I would give it 80%. 00:08:16.590 --> 00:08:17.810 That's not bad. 00:08:17.810 --> 00:08:20.930 All right, let's go give it a shot. 00:08:20.930 --> 00:08:24.010 So this is it, moment of truth. 00:08:24.010 --> 00:08:27.070 I'm not superstitious, but I'm gonna cross my fingers. 00:08:27.070 --> 00:08:28.330 I'm not gonna knock on wood though, 00:08:28.330 --> 00:08:30.870 cause then we might like bump the drive. 00:08:30.870 --> 00:08:34.630 Hey, no, I think we're gonna get it. 00:08:34.630 --> 00:08:37.110 Now that's actually a really important point. 00:08:37.110 --> 00:08:40.510 Just because we are able to read data off of this drive 00:08:40.510 --> 00:08:43.570 does not mean that Taren can take it, 00:08:43.570 --> 00:08:46.290 pop it back in a system and start using it again. 00:08:46.290 --> 00:08:48.790 This is still a dead drive. 00:08:48.790 --> 00:08:51.630 So what we're doing right now is we're pulling 00:08:51.630 --> 00:08:53.890 a bit for bit copy of all of the data 00:08:53.890 --> 00:08:55.930 off and we're putting it onto a new one. 00:08:55.930 --> 00:08:59.710 We are imaging the drive at 97 megabytes a second. 00:08:59.710 --> 00:09:01.450 Fingers crossed. 00:09:01.450 --> 00:09:03.070 No, no, no, sorry. 00:09:03.070 --> 00:09:04.730 Sorry, okay, so what, I have to do this 00:09:04.730 --> 00:09:05.930 for another six hours? 00:09:05.930 --> 00:09:09.240 Six hours. 00:09:09.240 --> 00:09:12.680 Scenario number three is a firmware problem. 00:09:12.680 --> 00:09:16.080 Now for unusual issues, deep knowledge 00:09:16.080 --> 00:09:19.680 of hard drive firmware design and a professional tool 00:09:19.680 --> 00:09:22.960 like a PC 3000 is necessary. 00:09:22.960 --> 00:09:24.840 But the fees that you can expect to pay 00:09:24.840 --> 00:09:26.180 to someone who can interpret 00:09:26.180 --> 00:09:28.660 this matrix level stuff right here 00:09:28.660 --> 00:09:33.660 would be anywhere from $500 to easily thousands of dollars 00:09:33.760 --> 00:09:35.620 depending on the complexity of the problem. 00:09:35.620 --> 00:09:39.100 The good news is that many common firmware issues 00:09:39.100 --> 00:09:42.320 can actually be solved with pretty much a button press. 00:09:42.320 --> 00:09:47.320 And that is where DeepSpar's tool, the RapidSpar, comes in. 00:09:58.390 --> 00:10:01.200 Wow, this is taking a really long time to detect. 00:10:01.200 --> 00:10:03.560 Drive still works. 00:10:03.560 --> 00:10:05.220 Oh, here we go, well, hold on a second. 00:10:05.220 --> 00:10:06.060 It's really, those are just- Yeah. 00:10:06.060 --> 00:10:07.020 We've got three partitions. 00:10:07.020 --> 00:10:09.160 We've got three partitions off of it already, though. 00:10:09.160 --> 00:10:10.000 And then we're just waiting on- 00:10:10.000 --> 00:10:11.880 The partition is still loading. 00:10:11.880 --> 00:10:15.050 What a frustrating and tedious line of work. 00:10:15.050 --> 00:10:18.270 But you get to deliver people their data back. 00:10:18.270 --> 00:10:19.880 It's our customers. 00:10:19.880 --> 00:10:21.660 Right, but someone gets their data back. 00:10:21.660 --> 00:10:22.500 Someone. 00:10:22.500 --> 00:10:23.520 So it only took five minutes. 00:10:23.520 --> 00:10:24.340 There we go. 00:10:24.340 --> 00:10:26.300 Okay, so now then we're good. 00:10:26.300 --> 00:10:28.600 It's just that every time we have to plug in this drive, 00:10:28.600 --> 00:10:30.400 it takes a long time to detect. 00:10:30.400 --> 00:10:31.240 Oh, sure, yeah. 00:10:31.240 --> 00:10:33.640 Let's see what happens when we try to copy files. 00:10:33.640 --> 00:10:36.240 So wait, so everything is slow like this. 00:10:36.240 --> 00:10:37.080 You're right. 00:10:37.280 --> 00:10:40.060 Funny story, I was actually here two weeks ago, 00:10:40.060 --> 00:10:44.000 but we lost part of the data from that shoot. 00:10:44.000 --> 00:10:45.880 Last time we were able to show 00:10:45.880 --> 00:10:48.000 that the data was transferring at such a speed 00:10:48.000 --> 00:10:50.920 that it would take infinitely long to get it off, 00:10:50.920 --> 00:10:53.140 meaning that the drive would be guaranteed to be dead 00:10:53.140 --> 00:10:55.660 by the time we actually managed to recover anything from it. 00:10:55.660 --> 00:10:57.620 But it's going even slower, why? 00:10:57.620 --> 00:10:58.820 It's just getting bogged down, 00:10:58.820 --> 00:11:00.940 doing something that it's not supposed to be doing. 00:11:00.940 --> 00:11:02.860 So instead of giving us the data, 00:11:02.860 --> 00:11:04.720 it's just kind of running in circles. 00:11:04.720 --> 00:11:07.380 Eventually it's just not gonna identify whatsoever. 00:11:07.380 --> 00:11:08.680 But we'll still be able to fix it, 00:11:08.680 --> 00:11:10.060 because it's only a firmware problem. 00:11:10.060 --> 00:11:13.140 So we are going to stop this process, 00:11:13.140 --> 00:11:15.980 and we're gonna connect our drive. 00:11:15.980 --> 00:11:19.160 And this is completely custom hardware and software, 00:11:19.160 --> 00:11:20.000 is that right? 00:11:20.000 --> 00:11:22.260 Correct, we rebuilt everything from this from scratch. 00:11:22.260 --> 00:11:23.760 It's made in Canada as well. 00:11:24.980 --> 00:11:27.480 We coded everything from scratch in assembly code. 00:11:27.480 --> 00:11:30.360 The reason is that off-the-shelf operating systems 00:11:30.360 --> 00:11:32.880 make certain assumptions about the hardware, 00:11:32.880 --> 00:11:34.880 namely that it works. 00:11:34.880 --> 00:11:36.860 So as soon as the hardware doesn't work, 00:11:36.860 --> 00:11:38.180 it starts running into issues. 00:11:38.180 --> 00:11:41.400 And that's why any software product 00:11:41.400 --> 00:11:45.500 is going to get stymied by certain drive malfunctions. 00:11:45.500 --> 00:11:48.120 Whereas when you build your own thing from the ground up 00:11:48.120 --> 00:11:50.860 that expects problems, 00:11:50.860 --> 00:11:52.580 well, you can have a different experience. 00:11:52.580 --> 00:11:55.140 So what Serge is doing right now in their software 00:11:55.140 --> 00:11:57.940 is he's running a diagnostic test on the drive 00:11:57.940 --> 00:12:01.060 to determine what exactly the firmware problem is. 00:12:01.060 --> 00:12:03.240 So this process takes a couple of minutes, 00:12:03.240 --> 00:12:04.840 and what it's doing is it's going through 00:12:04.840 --> 00:12:06.820 and it's finding any discrepancies 00:12:06.820 --> 00:12:08.680 in the firmware of this drive 00:12:08.680 --> 00:12:10.700 compared to what's supposed to be there, 00:12:10.700 --> 00:12:12.200 and then it's overwriting them. 00:12:12.200 --> 00:12:14.740 And that doesn't make it so the drive loses any data. 00:12:14.740 --> 00:12:15.580 No. 00:12:15.580 --> 00:12:16.420 No, okay. 00:12:16.420 --> 00:12:19.160 So now all that's left is power down the drive. 00:12:21.800 --> 00:12:23.790 Touch interface. 00:12:23.790 --> 00:12:24.750 Nice touch. 00:12:26.080 --> 00:12:30.280 Then, theoretically, we pop this guy 00:12:30.280 --> 00:12:32.590 back into our drive dock here. 00:12:32.590 --> 00:12:37.040 And now, oh, I thought I heard. 00:12:37.040 --> 00:12:38.680 Sorry, okay. 00:12:38.940 --> 00:12:40.960 We're on the drive. 00:12:40.960 --> 00:12:42.440 Hey, there it is. 00:12:42.440 --> 00:12:44.720 Oh, that's way faster. 00:12:44.720 --> 00:12:49.740 Of course, though, the acid test is a file copy. 00:12:49.740 --> 00:12:52.480 Can we get data off of this drive now? 00:12:52.480 --> 00:12:55.760 Now that discovery process is going faster. 00:12:55.760 --> 00:12:57.300 Hey, there we go. 00:12:57.300 --> 00:12:58.940 This is much better. 00:12:58.940 --> 00:13:00.420 Awesome. 00:13:00.420 --> 00:13:01.260 Here we go. 00:13:01.260 --> 00:13:02.240 There we go. 00:13:02.240 --> 00:13:03.540 Fantastic. 00:13:03.540 --> 00:13:04.920 So with the rapid spar, 00:13:04.920 --> 00:13:08.080 we went from not being able to copy the data 00:13:08.080 --> 00:13:09.140 at any kind of reasonable speed, 00:13:09.140 --> 00:13:12.440 to now we are copying all the data off this drive. 00:13:12.440 --> 00:13:17.440 Now, one of these guys does cost about $2,000. 00:13:17.700 --> 00:13:20.300 So end users aren't expected to buy one, 00:13:20.300 --> 00:13:23.040 but since it's so simple to use, 00:13:23.040 --> 00:13:26.720 if you, the end user, can find a shop that has one, 00:13:26.720 --> 00:13:29.440 you should expect to pay about 300 bucks 00:13:29.440 --> 00:13:31.480 for a recovery that it can handle. 00:13:31.480 --> 00:13:33.420 So, I mean, maybe that's still not worth it 00:13:33.420 --> 00:13:36.020 for photos of that night of binge drinking or whatever, 00:13:36.020 --> 00:13:38.920 but if your tax records and your will 00:13:38.920 --> 00:13:42.320 are on your hard drive, it's worth considering. 00:13:42.320 --> 00:13:43.820 In scenario number four, 00:13:43.820 --> 00:13:45.340 we're gonna see another solution 00:13:45.340 --> 00:13:47.180 that you can actually try at home, 00:13:47.180 --> 00:13:50.220 and this time without any specialized tools. 00:13:50.220 --> 00:13:55.220 All we need is a USB drive dock, our drive, and a computer. 00:13:55.300 --> 00:13:58.760 So this is an example of logical corruption. 00:13:58.760 --> 00:14:01.140 We're gonna go ahead and plug in our drive and power it on, 00:14:01.140 --> 00:14:02.180 and you're gonna see something 00:14:02.180 --> 00:14:03.420 that you might've seen before. 00:14:03.420 --> 00:14:06.820 So this can be caused by accidental formatting, 00:14:06.820 --> 00:14:09.060 viruses, or Windows errors. 00:14:09.080 --> 00:14:09.920 See this? 00:14:09.920 --> 00:14:11.400 You need to format the disk in drive D, 00:14:11.400 --> 00:14:13.200 but hold on a second, I had data on this. 00:14:13.200 --> 00:14:17.780 Okay, step number one, don't click format, cancel. 00:14:17.780 --> 00:14:20.420 Then we're gonna use a software called RStudio, 00:14:20.420 --> 00:14:22.280 but there are actually free options out there 00:14:22.280 --> 00:14:23.940 that are somewhat similar. 00:14:23.940 --> 00:14:26.300 We're gonna go ahead and we're gonna click on our drive here. 00:14:26.300 --> 00:14:28.560 We're gonna double-click empty space, 00:14:28.560 --> 00:14:32.260 and if it's not actually a hardware issue, 00:14:34.100 --> 00:14:37.020 so no bad sectors, and look at this. 00:14:37.020 --> 00:14:38.420 Here's all our files. 00:14:38.420 --> 00:14:41.180 They are ready for recovery. 00:14:41.180 --> 00:14:42.400 Fantastic. 00:14:42.400 --> 00:14:44.780 This type of software can also help us 00:14:44.780 --> 00:14:47.540 diagnose scenario number five. 00:14:47.540 --> 00:14:51.000 So the thing is is that unless you drop it or something, 00:14:51.000 --> 00:14:54.560 a hard drive doesn't generally go from working perfectly 00:14:54.560 --> 00:14:57.710 to completely dead in an instant. 00:14:57.710 --> 00:15:01.330 Read instability almost always comes first, 00:15:01.330 --> 00:15:05.070 and these types of drives, these mostly dead drives 00:15:05.070 --> 00:15:08.010 that haven't fully failed yet make up the majority 00:15:08.450 --> 00:15:11.210 of the cases that get sent in for data recovery. 00:15:11.210 --> 00:15:13.450 The symptoms of these drives can include 00:15:13.450 --> 00:15:15.630 not being detected in the BIOS, 00:15:15.630 --> 00:15:17.710 preventing the computer from booting, 00:15:17.710 --> 00:15:19.130 spitting out random errors, 00:15:19.130 --> 00:15:21.250 or just getting so slow 00:15:21.250 --> 00:15:23.430 that you can't do anything with them anymore. 00:15:23.430 --> 00:15:27.790 You shouldn't have any noticeable knocking or clicking yet, 00:15:27.790 --> 00:15:29.330 and that's exactly the situation. 00:15:29.330 --> 00:15:32.860 So we're gonna fire up RStudio here, 00:15:32.860 --> 00:15:34.950 and oh, that's interesting. 00:15:34.950 --> 00:15:38.400 Our computer is completely frozen up. 00:15:38.400 --> 00:15:39.900 One of these partitions has shown up, 00:15:39.900 --> 00:15:42.430 but this one's just not populated. 00:15:42.430 --> 00:15:45.930 Here's a little Windows hack that you might be able to use 00:15:45.930 --> 00:15:48.430 to get access to a drive like this. 00:15:48.430 --> 00:15:51.270 All you need to do is start up the command prompt 00:15:51.270 --> 00:15:52.670 as an administrator, 00:15:52.670 --> 00:15:55.670 start up Windows' built-in partition tool. 00:15:55.670 --> 00:15:58.310 Oh, I gotta, right, the computer's completely locked up. 00:15:58.310 --> 00:15:59.810 I gotta power down this drive first. 00:15:59.810 --> 00:16:00.650 There we go. 00:16:00.650 --> 00:16:02.310 Now everything, see, now everything comes back. 00:16:02.310 --> 00:16:04.030 Then we just need to run a command prompt. 00:16:04.030 --> 00:16:05.230 Oh, there we go. 00:16:05.230 --> 00:16:06.630 We've run a couple of commands, 00:16:06.630 --> 00:16:09.490 auto-mount disable and auto-mount scrub. 00:16:09.490 --> 00:16:11.750 With our tweak, what's gonna happen here 00:16:11.750 --> 00:16:15.190 is that Windows isn't gonna try to load a drive letter, 00:16:15.190 --> 00:16:16.990 and that's actually a good thing 00:16:16.990 --> 00:16:20.210 because it can hang the entire operating system 00:16:20.210 --> 00:16:22.490 while Windows tries to mount the file system, 00:16:22.490 --> 00:16:24.310 and it'll try and then time out, 00:16:24.310 --> 00:16:26.730 and then it'll restart and do it forever, 00:16:26.730 --> 00:16:29.850 doing more damage to what is already a damaged drive 00:16:29.850 --> 00:16:30.730 in the first place. 00:16:30.730 --> 00:16:32.730 So now that we've done this, 00:16:32.730 --> 00:16:35.230 we can open up Disk Management, and boom! 00:16:35.230 --> 00:16:36.390 There it is. 00:16:36.390 --> 00:16:38.330 There's our 300-gig drive, 00:16:38.330 --> 00:16:41.550 and we can actually launch our RStudio software now 00:16:41.550 --> 00:16:43.850 because the system isn't completely locked up. 00:16:43.850 --> 00:16:48.390 In cases where the drive doesn't have a ton of bad sectors, 00:16:48.390 --> 00:16:51.910 we actually can attempt a recovery. 00:16:51.910 --> 00:16:53.830 That's looking pretty... 00:16:53.830 --> 00:16:58.400 Oh, this is taking longer than it should. 00:16:58.400 --> 00:17:01.520 So this is the point where, as a data recovery technician, 00:17:01.520 --> 00:17:05.160 your gut feeling should be to stop what you're doing, 00:17:05.160 --> 00:17:07.720 because we're only 17% of the way through, 00:17:07.720 --> 00:17:10.700 and this drive has many bad sectors, 00:17:10.700 --> 00:17:15.680 which are taking anywhere from one to three minutes 00:17:15.680 --> 00:17:17.940 to detect each time. 00:17:17.940 --> 00:17:19.120 Now, the problem here is that 00:17:19.120 --> 00:17:21.560 this is a typical software behavior 00:17:21.560 --> 00:17:23.640 where the drive encounters a read error, 00:17:23.640 --> 00:17:26.560 and it just keeps trying and keeps trying and keeps trying. 00:17:26.560 --> 00:17:29.160 This puts a lot of strain on the drive 00:17:29.160 --> 00:17:32.760 and can cause it to fail right in the middle 00:17:32.760 --> 00:17:34.860 of this type of recovery attempt. 00:17:35.160 --> 00:17:37.540 We are gonna switch over to the RAPIDS bar 00:17:37.540 --> 00:17:40.260 and talk about that method. 00:17:40.260 --> 00:17:43.340 So all we're gonna do is plug our drive in here, 00:17:43.340 --> 00:17:44.720 go ahead and power it up, 00:17:44.720 --> 00:17:46.780 and then there are a couple of things 00:17:46.780 --> 00:17:50.620 that might make us think that this, the RAPIDS bar, 00:17:50.620 --> 00:17:52.960 is gonna work better than a standard computer. 00:17:52.960 --> 00:17:56.360 For one thing, if it encounters a bad sector, 00:17:56.360 --> 00:17:58.580 instead of reattempting and reattempting, 00:17:58.580 --> 00:17:59.920 wearing out the drive, 00:17:59.920 --> 00:18:02.660 it will actually cut off its reattempts 00:18:02.660 --> 00:18:04.380 after a couple of hundred milliseconds. 00:18:04.380 --> 00:18:05.340 This dramatically reduces the rate of error. 00:18:05.340 --> 00:18:07.440 This dramatically reduces the stress on the drive. 00:18:07.440 --> 00:18:11.580 For another, it actually borrows a lot of DNA 00:18:11.580 --> 00:18:13.040 from their higher end products. 00:18:13.040 --> 00:18:15.480 So this is the disk imager. 00:18:15.480 --> 00:18:18.580 So when we set our source drive parameters here, 00:18:18.580 --> 00:18:21.740 we select the brand and the interface, 00:18:21.740 --> 00:18:25.720 and what it's doing is it's actually taking information 00:18:25.720 --> 00:18:28.680 about the behavior of our drive as it scans it, 00:18:28.680 --> 00:18:31.100 and it's uploading it to DeepSpar servers 00:18:31.100 --> 00:18:33.440 where it compares it against a database. 00:18:33.440 --> 00:18:35.940 Their server then sends our RAPIDS bar 00:18:35.940 --> 00:18:38.700 some recommendations for how to deal with it 00:18:38.700 --> 00:18:40.440 to help accelerate the recovery. 00:18:40.440 --> 00:18:41.780 Pretty cool, right? 00:18:41.780 --> 00:18:44.400 So we can double click partition one here, 00:18:44.400 --> 00:18:46.860 and boom, we're running a scan. 00:18:46.860 --> 00:18:47.820 So you can see here, 00:18:47.820 --> 00:18:49.860 we already hit one of those bad sectors, 00:18:49.860 --> 00:18:52.500 but instead of trying for two minutes, 00:18:52.500 --> 00:18:54.600 it's only gonna try for a couple of seconds 00:18:54.600 --> 00:18:55.700 before it moves on. 00:18:55.700 --> 00:18:57.440 Now, we're never gonna get back any data 00:18:57.440 --> 00:18:58.640 that was on those sectors, 00:18:58.640 --> 00:19:01.920 but at least we can get back whatever's on either side. 00:19:01.920 --> 00:19:02.780 So check this out. 00:19:02.780 --> 00:19:04.260 We didn't get everything. 00:19:04.260 --> 00:19:06.440 You can see there's some corrupted stuff here, 00:19:06.440 --> 00:19:11.500 but even though this drive had hundreds of bad sectors, 00:19:12.380 --> 00:19:15.260 instead of taking two minutes 00:19:15.260 --> 00:19:17.320 every time it hit a bad sector, 00:19:17.320 --> 00:19:20.960 this whole scan only took us about seven minutes, 00:19:20.960 --> 00:19:22.460 much less wear and tear. 00:19:22.460 --> 00:19:24.320 And there's some other cool stuff too. 00:19:24.320 --> 00:19:25.400 For this trick, 00:19:25.400 --> 00:19:28.340 we need a drive that is in much worse condition. 00:19:28.340 --> 00:19:32.440 Let's go ahead and power this on. 00:19:32.440 --> 00:19:33.780 That's the hard drive. 00:19:33.780 --> 00:19:34.860 That's less fine. 00:19:34.980 --> 00:19:36.380 That's not fine at all. 00:19:36.380 --> 00:19:40.180 Ah, ah, turn it off. 00:19:40.180 --> 00:19:44.000 But the RapidSpar has another borrowed trick up its sleeve. 00:19:44.000 --> 00:19:46.140 So all we gotta do is plug this in, 00:19:46.140 --> 00:19:48.360 but we're not gonna power the drive on right away 00:19:48.360 --> 00:19:50.600 because we don't want it to start thrashing. 00:19:50.600 --> 00:19:53.660 Instead, we're gonna let the software interface 00:19:53.660 --> 00:19:54.940 power on the drive 00:19:54.940 --> 00:19:58.360 and then start issuing commands to it immediately 00:19:58.360 --> 00:19:59.660 so that it doesn't get a chance 00:19:59.660 --> 00:20:04.520 to try to click itself to death here. 00:20:04.520 --> 00:20:05.720 So it's powering it on, 00:20:05.720 --> 00:20:08.120 and then hopefully we're not gonna hear a ton of clicking 00:20:08.120 --> 00:20:12.660 because that would mean the potential for our dead head 00:20:12.660 --> 00:20:14.260 to cause our other head to fail. 00:20:14.260 --> 00:20:15.620 That's something that's really common. 00:20:15.620 --> 00:20:17.580 Once you've got one head gone, 00:20:17.580 --> 00:20:20.270 the other ones tend to follow suit. 00:20:20.270 --> 00:20:21.290 Smart failed. 00:20:21.290 --> 00:20:24.210 Okay, that makes sense. 00:20:24.210 --> 00:20:25.110 Now in a moment here, 00:20:25.110 --> 00:20:27.050 it's gonna start checking the heads and media. 00:20:27.050 --> 00:20:29.070 We're probably gonna hear a couple of clicks here 00:20:29.070 --> 00:20:30.830 because you can't check if the head works 00:20:30.830 --> 00:20:35.480 without trying to move it. 00:20:35.480 --> 00:20:36.600 Diagnostics are done now. 00:20:36.600 --> 00:20:38.120 So 19% of our tested sectors do contain data. 00:20:38.120 --> 00:20:39.060 So 19% of our tested sectors do contain data. 00:20:39.060 --> 00:20:41.260 There's something to recover here. 00:20:41.260 --> 00:20:42.680 As we expected, 00:20:42.680 --> 00:20:46.620 one of our three heads is at 46% health. 00:20:46.620 --> 00:20:48.540 Now we're not getting back anything 00:20:48.540 --> 00:20:50.380 that's on that platter with the bad head, 00:20:50.380 --> 00:20:53.100 unless we do a head swap and put a new head in the drive. 00:20:53.100 --> 00:20:55.020 So if this stuff isn't mission critical, 00:20:55.020 --> 00:20:57.560 what we're gonna do is we're gonna build a head map here. 00:20:57.560 --> 00:20:59.640 Then we're gonna disable that head 00:20:59.640 --> 00:21:01.800 and see how much of the data we can pull off. 00:21:01.800 --> 00:21:03.760 All we gotta do is click this, 00:21:03.760 --> 00:21:05.980 skip anything on head one, 00:21:05.980 --> 00:21:07.060 click apply, 00:21:07.060 --> 00:21:09.060 and now we're getting a new sector map. 00:21:09.060 --> 00:21:10.060 All right, heads. 00:21:10.060 --> 00:21:11.600 Here comes our files and directories, 00:21:11.600 --> 00:21:13.380 and boom, there it is. 00:21:13.380 --> 00:21:14.660 File tree, baby. 00:21:14.660 --> 00:21:15.500 Love it. 00:21:15.500 --> 00:21:17.100 And through all this accessing, 00:21:17.100 --> 00:21:19.060 you don't hear any clicks anymore 00:21:19.060 --> 00:21:21.480 because that head has been parked 00:21:21.480 --> 00:21:24.100 as long as we're using the RapidSpar. 00:21:24.100 --> 00:21:26.040 So this thing is really cool, 00:21:26.040 --> 00:21:29.900 but to be clear, the RapidSpar is also not magic. 00:21:29.900 --> 00:21:33.000 So of the jobs that come into your shop, 00:21:33.000 --> 00:21:35.620 some of them are gonna be solvable with software. 00:21:35.620 --> 00:21:37.620 And then of the ones that remain, 00:21:37.620 --> 00:21:40.660 about half of them can be dealt with with the RapidSpar. 00:21:40.660 --> 00:21:41.900 And then the other half 00:21:41.900 --> 00:21:44.460 are still gonna have to be outsourced to a professional 00:21:44.460 --> 00:21:46.520 that's armed with more powerful tools 00:21:46.520 --> 00:21:48.080 and probably a clean room. 00:21:48.080 --> 00:21:49.800 So DiskImager 4, 00:21:49.800 --> 00:21:51.980 along with the software that accompanies it, 00:21:51.980 --> 00:21:53.700 allows very fine control 00:21:53.700 --> 00:21:55.680 of things like the reattempt threshold. 00:21:55.680 --> 00:21:57.620 It has a ton of configuration knobs 00:21:57.620 --> 00:21:59.100 that a professional can tune 00:21:59.100 --> 00:22:00.820 and can be used to work on drives 00:22:00.820 --> 00:22:03.580 that the RapidSpar can't even interface with yet. 00:22:03.580 --> 00:22:05.620 Like for example, a PCI Express NVMe SSD. 00:22:05.620 --> 00:22:06.620 The RapidSpar is a very powerful tool. 00:22:06.620 --> 00:22:07.620 It's a very powerful tool. 00:22:07.620 --> 00:22:09.740 The RapidSpar can handle a regular SATA SSD, 00:22:09.740 --> 00:22:13.120 which by the way, can have bad sectors as well. 00:22:13.120 --> 00:22:14.560 So that's pretty much it. 00:22:14.560 --> 00:22:17.320 So hopefully whether you're an IT manager 00:22:17.320 --> 00:22:18.740 or you run your own shop, 00:22:18.740 --> 00:22:20.140 or you're just an end user, 00:22:20.140 --> 00:22:21.200 you've gained some knowledge 00:22:21.200 --> 00:22:23.000 about the data recovery business 00:22:23.000 --> 00:22:25.060 and how it works behind the scenes. 00:22:25.060 --> 00:22:27.080 Now, of course, DeepSpar, 00:22:27.080 --> 00:22:28.460 just wanna throw this in, 00:22:28.460 --> 00:22:30.160 DeepSpar values your business, 00:22:30.160 --> 00:22:32.320 but any video about data recovery 00:22:32.320 --> 00:22:34.740 would be incomplete without a reminder 00:22:34.740 --> 00:22:36.940 that in a perfect world, you wouldn't need it. 00:22:36.940 --> 00:22:38.780 Please back up your data 00:22:38.780 --> 00:22:41.440 because the DeepSpar guys would love nothing more 00:22:41.440 --> 00:22:44.000 than to live in a world where no one loses their data 00:22:44.000 --> 00:22:46.860 and they can just sit on a beach somewhere drinking cocktails 00:22:46.860 --> 00:22:49.770 instead of hanging around with me all day. 00:22:49.770 --> 00:22:50.770 So thanks for watching, guys. 00:22:50.770 --> 00:22:52.830 If you disliked this video, you can hit that button. 00:22:52.830 --> 00:22:55.790 But if you liked it, hit like, get subscribed, 00:22:55.790 --> 00:22:57.790 and maybe consider checking out where to buy the stuff 00:22:57.790 --> 00:23:00.310 that we featured in the video description. 00:23:00.310 --> 00:23:05.190 This would be a great addition to any tech shop out there. 00:23:05.190 --> 00:23:06.030 While you guys are at it, 00:23:06.030 --> 00:23:06.910 we've got our merch store, 00:23:06.910 --> 00:23:08.570 a list in the video description as well, 00:23:08.570 --> 00:23:10.270 and a link to our community forum, 00:23:10.270 --> 00:23:12.740 which you should totally join. 00:23:12.740 --> 00:23:15.020 You look very satisfied right now. 00:23:15.020 --> 00:23:16.700 It's like, yes, this drive is broken 00:23:16.700 --> 00:23:19.420 exactly the way I wanted it to be for this demo.