Don't Waste $1000 on Data Recovery
Linus Tech Tips
·Linus Tech Tips
·2019-05-06
·
4,065 words · ~20 min read
0:00
Deep spar located in Ottawa, Ontario is a data recovery company
0:06
but not in the way that you might think like you can't just
0:10
Drop in with your dead hard drive and ask them to fix it for you
0:16
their business is
0:18
developing the software
0:20
Hardware and the techniques that are used by everyone from mom-and-pop shop technicians to huge
0:27
data recovery houses right on the other side of this wall is actually the classroom that they use to train police and
0:35
other government agencies on data recovery
0:38
So they sponsored our trip out here to do two things
0:42
one to show consumers how to save money on data recovery service and
0:48
Number two to show repair shops how they can dramatically improve their chances of recovery for their customers
1:04
Scenario one of hard drive failure is clicking and clacking noises
1:09
Sometimes without being detected by the system. Oh
1:15
Okay, this happens it's probably a physical problem
1:20
So if the data is important don't do anything
1:25
Unplug your drive and send it to a pro
1:28
immediately or your chances of a successful recovery will be dramatically lower or possibly even zero a
1:35
Pro is going to use tools like these and a laminar flow
1:39
workstation like this one or even a full-on clean room like the one that I checked out over at drive savers to
1:46
physically swap components into the failed drive from donor drives
1:52
Sometimes this needs to be done multiple times in cases where one bad part is causing the other ones to fail prematurely
2:00
They'll also use professional tools from companies like deep spar
2:04
So I didn't know it, but I was actually using disk imager 4 when I performed my own head swap in that video
2:12
Scenario number two is an electronics problem. Maybe a broken SATA connector or
2:18
a
2:19
Burned chip on the PCB could be causing the drive to not be detected by your system
2:25
the most common symptom here is
2:29
total silence
2:30
Now sometimes you will need to call a pro for this and if the data is mission-critical
2:36
You should always call a pro but for nice-to-have rather than need-to-have data
2:43
this type of failure actually exposes the platters of the drive and
2:49
Therefore the data to much less risk
2:52
So in some cases you can attempt a home repair if you're handy with a soldering iron now
2:58
DeepSpar had this whole demo
3:00
Planned for me the the TVS chip actually handles over current protection for the drive and can fail due to an external issue
3:08
so just
3:10
Removing it from the PCB can possibly brick the drive because you're removing the over current protection
3:16
But in many cases it can allow the data to be recovered if it's hooked up to a known good system and power source
3:22
But we are throwing that demo out the window because I brought DeepSpar an unexpected present
3:29
This is
3:30
Terran's personal dead hard drive that failed when we hooked it up to a
3:35
Faulty power supply cable while he and I were at the office late upgrading his system
3:40
Now he would likely be quoted three to five hundred US dollars
3:46
Minimum to fix this and since he's Terran and he doesn't remember exactly what's on it
3:52
He's not gonna pay that much to get it back. So we're gonna see how we do with a DIY grade repair. Yarek, you ready?
4:01
So what we're gonna do first is we're gonna verify the diagnosis now
4:05
I'm already pretty sure that we're gonna power up this drive
4:09
And we're gonna hear a whole lot of nothing
4:12
So that means there's a good chance that this is an electronics problem then
4:21
Okay, so we power down
4:25
Now unfortunately swapping out a PCB on a drive isn't as simple as going to the hard drive PCB store and buying one
4:33
Yeah
4:34
If only life were that easy, right?
4:36
Look at him. He's defeated. He's defeated
4:39
So eBay and Craigslist are your friends now, fortunately in Terran's case
4:45
He already had a donor drive that looks like it's gonna be suitable
4:49
So there's a couple things to watch for you need the drive model to be the same
4:54
so not just this drive model, but also this model number right here, so these look good and
5:01
You even need the PCB review
5:04
To be the same now these two are a slightly different color here, but that's not important
5:09
What matters is that they're both revision a and they both have exactly the same model
5:14
So these should theoretically be suitable
5:18
Okay, now we're at the point where most amateurs would screw up this kind of a recovery. They'd go. Okay
5:24
Well now we take the good PCB put it on the bad drive and bippity boppity off to the races, right?
5:29
wrong
5:30
data density on modern drives is so high that the
5:34
Manufacturing tolerances are nowhere near good enough that every drive will just work out of the factory
5:40
so they have to build in compensation and
5:44
Calibration that is unique to your individual drive
5:47
It's usually stored on a little 8-pin ROM chip that looks like this and that specialized data
5:54
Has to be brought over. So you want to show us how to
5:58
Desolder and resolder a ROM chip. All right, let's do it. Let's not screw these up. Which one's which?
6:04
D on this one. Okay, we're good
6:08
There's a pro tip right there my friends better to market first
6:24
Now we're ready to put the PCB back on and we can go test it, right? All right
6:30
Here goes nothing. It's not picking up. Do you want to have a look at it?
6:38
Okay, so unfortunately sometimes when you hook up to a bad power source, it kills more than one thing
6:44
So we fixed our PCB problem
6:46
But we're still getting this zero capacity
6:49
nonsense here and we're getting kind of like a chirping noise and
6:54
Jarek like drive whispered with the horse whisperer for hard drives over here and
7:00
Told me that what he thinks is that it's the pre amplifier chip. Is that right?
7:05
So that's a component of the drive head, which means that we actually need to dig a little deeper on this thing
7:11
We're gonna take it over to the laminar flow workstation and tear it apart
7:14
So what this station does is it uses a really thick filter here to pull all the dies?
7:21
and then you can take it out of the air and then you've got this constant flow of clean air so that none of the
7:27
Contaminated air around us can get into the drive
7:30
That's really important with how close the head is to the platter
7:34
Even the smallest speck of dust could cause catastrophic damage to the platter as it's flying over it
7:41
So now we're swapping the known good heads from the working drive
7:46
into our bad drive
7:48
And actually now that I come to think of it by known good
7:52
I have not actually tested this drive.
7:57
Presumably Taren checked it before he gave it to me.
8:00
If it helps at all for the tension of this situation,
8:03
I still don't know that this will actually work
8:08
the way we want.
8:09
I mean, we could have screwed something up, right?
8:10
What's your confidence level right now?
8:13
I would give it 80%.
8:16
That's not bad.
8:17
All right, let's go give it a shot.
8:20
So this is it, moment of truth.
8:24
I'm not superstitious, but I'm gonna cross my fingers.
8:27
I'm not gonna knock on wood though,
8:28
cause then we might like bump the drive.
8:30
Hey, no, I think we're gonna get it.
8:34
Now that's actually a really important point.
8:37
Just because we are able to read data off of this drive
8:40
does not mean that Taren can take it,
8:43
pop it back in a system and start using it again.
8:46
This is still a dead drive.
8:48
So what we're doing right now is we're pulling
8:51
a bit for bit copy of all of the data
8:53
off and we're putting it onto a new one.
8:55
We are imaging the drive at 97 megabytes a second.
8:59
Fingers crossed.
9:01
No, no, no, sorry.
9:03
Sorry, okay, so what, I have to do this
9:04
for another six hours?
9:05
Six hours.
9:09
Scenario number three is a firmware problem.
9:12
Now for unusual issues, deep knowledge
9:16
of hard drive firmware design and a professional tool
9:19
like a PC 3000 is necessary.
9:22
But the fees that you can expect to pay
9:24
to someone who can interpret
9:26
this matrix level stuff right here
9:28
would be anywhere from $500 to easily thousands of dollars
9:33
depending on the complexity of the problem.
9:35
The good news is that many common firmware issues
9:39
can actually be solved with pretty much a button press.
9:42
And that is where DeepSpar's tool, the RapidSpar, comes in.
9:58
Wow, this is taking a really long time to detect.
10:01
Drive still works.
10:03
Oh, here we go, well, hold on a second.
10:05
It's really, those are just- Yeah.
10:06
We've got three partitions.
10:07
We've got three partitions off of it already, though.
10:09
And then we're just waiting on-
10:10
The partition is still loading.
10:11
What a frustrating and tedious line of work.
10:15
But you get to deliver people their data back.
10:18
It's our customers.
10:19
Right, but someone gets their data back.
10:21
Someone.
10:22
So it only took five minutes.
10:23
There we go.
10:24
Okay, so now then we're good.
10:26
It's just that every time we have to plug in this drive,
10:28
it takes a long time to detect.
10:30
Oh, sure, yeah.
10:31
Let's see what happens when we try to copy files.
10:33
So wait, so everything is slow like this.
10:36
You're right.
10:37
Funny story, I was actually here two weeks ago,
10:40
but we lost part of the data from that shoot.
10:44
Last time we were able to show
10:45
that the data was transferring at such a speed
10:48
that it would take infinitely long to get it off,
10:50
meaning that the drive would be guaranteed to be dead
10:53
by the time we actually managed to recover anything from it.
10:55
But it's going even slower, why?
10:57
It's just getting bogged down,
10:58
doing something that it's not supposed to be doing.
11:00
So instead of giving us the data,
11:02
it's just kind of running in circles.
11:04
Eventually it's just not gonna identify whatsoever.
11:07
But we'll still be able to fix it,
11:08
because it's only a firmware problem.
11:10
So we are going to stop this process,
11:13
and we're gonna connect our drive.
11:15
And this is completely custom hardware and software,
11:19
is that right?
11:20
Correct, we rebuilt everything from this from scratch.
11:22
It's made in Canada as well.
11:24
We coded everything from scratch in assembly code.
11:27
The reason is that off-the-shelf operating systems
11:30
make certain assumptions about the hardware,
11:32
namely that it works.
11:34
So as soon as the hardware doesn't work,
11:36
it starts running into issues.
11:38
And that's why any software product
11:41
is going to get stymied by certain drive malfunctions.
11:45
Whereas when you build your own thing from the ground up
11:48
that expects problems,
11:50
well, you can have a different experience.
11:52
So what Serge is doing right now in their software
11:55
is he's running a diagnostic test on the drive
11:57
to determine what exactly the firmware problem is.
12:01
So this process takes a couple of minutes,
12:03
and what it's doing is it's going through
12:04
and it's finding any discrepancies
12:06
in the firmware of this drive
12:08
compared to what's supposed to be there,
12:10
and then it's overwriting them.
12:12
And that doesn't make it so the drive loses any data.
12:14
No.
12:15
No, okay.
12:16
So now all that's left is power down the drive.
12:21
Touch interface.
12:23
Nice touch.
12:26
Then, theoretically, we pop this guy
12:30
back into our drive dock here.
12:32
And now, oh, I thought I heard.
12:37
Sorry, okay.
12:38
We're on the drive.
12:40
Hey, there it is.
12:42
Oh, that's way faster.
12:44
Of course, though, the acid test is a file copy.
12:49
Can we get data off of this drive now?
12:52
Now that discovery process is going faster.
12:55
Hey, there we go.
12:57
This is much better.
12:58
Awesome.
13:00
Here we go.
13:01
There we go.
13:02
Fantastic.
13:03
So with the rapid spar,
13:04
we went from not being able to copy the data
13:08
at any kind of reasonable speed,
13:09
to now we are copying all the data off this drive.
13:12
Now, one of these guys does cost about $2,000.
13:17
So end users aren't expected to buy one,
13:20
but since it's so simple to use,
13:23
if you, the end user, can find a shop that has one,
13:26
you should expect to pay about 300 bucks
13:29
for a recovery that it can handle.
13:31
So, I mean, maybe that's still not worth it
13:33
for photos of that night of binge drinking or whatever,
13:36
but if your tax records and your will
13:38
are on your hard drive, it's worth considering.
13:42
In scenario number four,
13:43
we're gonna see another solution
13:45
that you can actually try at home,
13:47
and this time without any specialized tools.
13:50
All we need is a USB drive dock, our drive, and a computer.
13:55
So this is an example of logical corruption.
13:58
We're gonna go ahead and plug in our drive and power it on,
14:01
and you're gonna see something
14:02
that you might've seen before.
14:03
So this can be caused by accidental formatting,
14:06
viruses, or Windows errors.
14:09
See this?
14:09
You need to format the disk in drive D,
14:11
but hold on a second, I had data on this.
14:13
Okay, step number one, don't click format, cancel.
14:17
Then we're gonna use a software called RStudio,
14:20
but there are actually free options out there
14:22
that are somewhat similar.
14:23
We're gonna go ahead and we're gonna click on our drive here.
14:26
We're gonna double-click empty space,
14:28
and if it's not actually a hardware issue,
14:34
so no bad sectors, and look at this.
14:37
Here's all our files.
14:38
They are ready for recovery.
14:41
Fantastic.
14:42
This type of software can also help us
14:44
diagnose scenario number five.
14:47
So the thing is is that unless you drop it or something,
14:51
a hard drive doesn't generally go from working perfectly
14:54
to completely dead in an instant.
14:57
Read instability almost always comes first,
15:01
and these types of drives, these mostly dead drives
15:05
that haven't fully failed yet make up the majority
15:08
of the cases that get sent in for data recovery.
15:11
The symptoms of these drives can include
15:13
not being detected in the BIOS,
15:15
preventing the computer from booting,
15:17
spitting out random errors,
15:19
or just getting so slow
15:21
that you can't do anything with them anymore.
15:23
You shouldn't have any noticeable knocking or clicking yet,
15:27
and that's exactly the situation.
15:29
So we're gonna fire up RStudio here,
15:32
and oh, that's interesting.
15:34
Our computer is completely frozen up.
15:38
One of these partitions has shown up,
15:39
but this one's just not populated.
15:42
Here's a little Windows hack that you might be able to use
15:45
to get access to a drive like this.
15:48
All you need to do is start up the command prompt
15:51
as an administrator,
15:52
start up Windows' built-in partition tool.
15:55
Oh, I gotta, right, the computer's completely locked up.
15:58
I gotta power down this drive first.
15:59
There we go.
16:00
Now everything, see, now everything comes back.
16:02
Then we just need to run a command prompt.
16:04
Oh, there we go.
16:05
We've run a couple of commands,
16:06
auto-mount disable and auto-mount scrub.
16:09
With our tweak, what's gonna happen here
16:11
is that Windows isn't gonna try to load a drive letter,
16:15
and that's actually a good thing
16:16
because it can hang the entire operating system
16:20
while Windows tries to mount the file system,
16:22
and it'll try and then time out,
16:24
and then it'll restart and do it forever,
16:26
doing more damage to what is already a damaged drive
16:29
in the first place.
16:30
So now that we've done this,
16:32
we can open up Disk Management, and boom!
16:35
There it is.
16:36
There's our 300-gig drive,
16:38
and we can actually launch our RStudio software now
16:41
because the system isn't completely locked up.
16:43
In cases where the drive doesn't have a ton of bad sectors,
16:48
we actually can attempt a recovery.
16:51
That's looking pretty...
16:53
Oh, this is taking longer than it should.
16:58
So this is the point where, as a data recovery technician,
17:01
your gut feeling should be to stop what you're doing,
17:05
because we're only 17% of the way through,
17:07
and this drive has many bad sectors,
17:10
which are taking anywhere from one to three minutes
17:15
to detect each time.
17:17
Now, the problem here is that
17:19
this is a typical software behavior
17:21
where the drive encounters a read error,
17:23
and it just keeps trying and keeps trying and keeps trying.
17:26
This puts a lot of strain on the drive
17:29
and can cause it to fail right in the middle
17:32
of this type of recovery attempt.
17:35
We are gonna switch over to the RAPIDS bar
17:37
and talk about that method.
17:40
So all we're gonna do is plug our drive in here,
17:43
go ahead and power it up,
17:44
and then there are a couple of things
17:46
that might make us think that this, the RAPIDS bar,
17:50
is gonna work better than a standard computer.
17:52
For one thing, if it encounters a bad sector,
17:56
instead of reattempting and reattempting,
17:58
wearing out the drive,
17:59
it will actually cut off its reattempts
18:02
after a couple of hundred milliseconds.
18:04
This dramatically reduces the rate of error.
18:05
This dramatically reduces the stress on the drive.
18:07
For another, it actually borrows a lot of DNA
18:11
from their higher end products.
18:13
So this is the disk imager.
18:15
So when we set our source drive parameters here,
18:18
we select the brand and the interface,
18:21
and what it's doing is it's actually taking information
18:25
about the behavior of our drive as it scans it,
18:28
and it's uploading it to DeepSpar servers
18:31
where it compares it against a database.
18:33
Their server then sends our RAPIDS bar
18:35
some recommendations for how to deal with it
18:38
to help accelerate the recovery.
18:40
Pretty cool, right?
18:41
So we can double click partition one here,
18:44
and boom, we're running a scan.
18:46
So you can see here,
18:47
we already hit one of those bad sectors,
18:49
but instead of trying for two minutes,
18:52
it's only gonna try for a couple of seconds
18:54
before it moves on.
18:55
Now, we're never gonna get back any data
18:57
that was on those sectors,
18:58
but at least we can get back whatever's on either side.
19:01
So check this out.
19:02
We didn't get everything.
19:04
You can see there's some corrupted stuff here,
19:06
but even though this drive had hundreds of bad sectors,
19:12
instead of taking two minutes
19:15
every time it hit a bad sector,
19:17
this whole scan only took us about seven minutes,
19:20
much less wear and tear.
19:22
And there's some other cool stuff too.
19:24
For this trick,
19:25
we need a drive that is in much worse condition.
19:28
Let's go ahead and power this on.
19:32
That's the hard drive.
19:33
That's less fine.
19:34
That's not fine at all.
19:36
Ah, ah, turn it off.
19:40
But the RapidSpar has another borrowed trick up its sleeve.
19:44
So all we gotta do is plug this in,
19:46
but we're not gonna power the drive on right away
19:48
because we don't want it to start thrashing.
19:50
Instead, we're gonna let the software interface
19:53
power on the drive
19:54
and then start issuing commands to it immediately
19:58
so that it doesn't get a chance
19:59
to try to click itself to death here.
20:04
So it's powering it on,
20:05
and then hopefully we're not gonna hear a ton of clicking
20:08
because that would mean the potential for our dead head
20:12
to cause our other head to fail.
20:14
That's something that's really common.
20:15
Once you've got one head gone,
20:17
the other ones tend to follow suit.
20:20
Smart failed.
20:21
Okay, that makes sense.
20:24
Now in a moment here,
20:25
it's gonna start checking the heads and media.
20:27
We're probably gonna hear a couple of clicks here
20:29
because you can't check if the head works
20:30
without trying to move it.
20:35
Diagnostics are done now.
20:36
So 19% of our tested sectors do contain data.
20:38
So 19% of our tested sectors do contain data.
20:39
There's something to recover here.
20:41
As we expected,
20:42
one of our three heads is at 46% health.
20:46
Now we're not getting back anything
20:48
that's on that platter with the bad head,
20:50
unless we do a head swap and put a new head in the drive.
20:53
So if this stuff isn't mission critical,
20:55
what we're gonna do is we're gonna build a head map here.
20:57
Then we're gonna disable that head
20:59
and see how much of the data we can pull off.
21:01
All we gotta do is click this,
21:03
skip anything on head one,
21:05
click apply,
21:07
and now we're getting a new sector map.
21:09
All right, heads.
21:10
Here comes our files and directories,
21:11
and boom, there it is.
21:13
File tree, baby.
21:14
Love it.
21:15
And through all this accessing,
21:17
you don't hear any clicks anymore
21:19
because that head has been parked
21:21
as long as we're using the RapidSpar.
21:24
So this thing is really cool,
21:26
but to be clear, the RapidSpar is also not magic.
21:29
So of the jobs that come into your shop,
21:33
some of them are gonna be solvable with software.
21:35
And then of the ones that remain,
21:37
about half of them can be dealt with with the RapidSpar.
21:40
And then the other half
21:41
are still gonna have to be outsourced to a professional
21:44
that's armed with more powerful tools
21:46
and probably a clean room.
21:48
So DiskImager 4,
21:49
along with the software that accompanies it,
21:51
allows very fine control
21:53
of things like the reattempt threshold.
21:55
It has a ton of configuration knobs
21:57
that a professional can tune
21:59
and can be used to work on drives
22:00
that the RapidSpar can't even interface with yet.
22:03
Like for example, a PCI Express NVMe SSD.
22:05
The RapidSpar is a very powerful tool.
22:06
It's a very powerful tool.
22:07
The RapidSpar can handle a regular SATA SSD,
22:09
which by the way, can have bad sectors as well.
22:13
So that's pretty much it.
22:14
So hopefully whether you're an IT manager
22:17
or you run your own shop,
22:18
or you're just an end user,
22:20
you've gained some knowledge
22:21
about the data recovery business
22:23
and how it works behind the scenes.
22:25
Now, of course, DeepSpar,
22:27
just wanna throw this in,
22:28
DeepSpar values your business,
22:30
but any video about data recovery
22:32
would be incomplete without a reminder
22:34
that in a perfect world, you wouldn't need it.
22:36
Please back up your data
22:38
because the DeepSpar guys would love nothing more
22:41
than to live in a world where no one loses their data
22:44
and they can just sit on a beach somewhere drinking cocktails
22:46
instead of hanging around with me all day.
22:49
So thanks for watching, guys.
22:50
If you disliked this video, you can hit that button.
22:52
But if you liked it, hit like, get subscribed,
22:55
and maybe consider checking out where to buy the stuff
22:57
that we featured in the video description.
23:00
This would be a great addition to any tech shop out there.
23:05
While you guys are at it,
23:06
we've got our merch store,
23:06
a list in the video description as well,
23:08
and a link to our community forum,
23:10
which you should totally join.
23:12
You look very satisfied right now.
23:15
It's like, yes, this drive is broken
23:16
exactly the way I wanted it to be for this demo.