What was this drive doing?

When a drive is dead, the first question is "How dead is it?"

To a user, "dead" usually means "My system doesn't boot" or "Keeps crashing", but to us more technical folks we think of "dead" on many different levels. A small sampling of questions:

Does it spin when you apply power? If not, does it try to spin?

Is it making any noises?

If plugged into a system, can the system see the drive?

When you try to read a few blocks of data (sectors), are they readable?

Can I see a partition table? Valid partition(s)? Any file system(s) on the drive?

Are files corrupted or have bad spots?

The answers to these questions lead one to a diagnostic tree of things to try. It is much like a doctor talking to a patient, establishing a history of that person's path that lead you to the doctor's office that day.

For example, if a drive will not spin up but you can feel the motor trying to spin with these little tick-tick-tick and can feel the torque of the motor, then you are about to spend a whole lot of money because recovering that data involves a clean room environment that is way beyond all but the top professional recovery labs. More on that in a bit.

Did spin (Yay!)

Was recognized by the system .... sometimes.

As soon as you tried to access it, the drive sounded like it powered itself off and started to spin down, then about 1/2 second later spun itself back up. The system wouldn't see it for about 20 seconds, then it could see the drive. This cycle would repeat forever.

Unfortunately, I could not read any data without the drive getting itself confused, slowing, and spinning back up. It sounded like the drive was rebooting itself whenever you tried to access it. I tried a few tricks of the trade, but there was no improvement in the drive's condition.

The report back to the client wasn't great news - in fact, to minimize any data loss, at this point I recommended sending the drive to a company I partner with that specializes in data recovery. They have the proper clean room environment, replacement parts, and skills / knowledge to actually remove the data platters from a dead drive and put them into another where they can be read. If the problem were due to head damage, this is the only way to recover that data.

I established an RMA with the company and received the paperwork.

It is impossible to know what it is going to take to recover the data or even if it is recoverable without them receiving the drive and doing their own analysis. They charge $65 for this initial step, and on average data recovery costs a minimum of $700 and can be $2000 or more, not including shipping, priority handling (if required), or my labor to remove / replace / reinstall the system and get the data back onto the fresh computer.

So your out the door is going to start at $1000 but likely be higher, possibly as much as $3000.

If your data can be recovered ... Some of it might not be if there was damage to a platter or data was overwritten by other attempts to repair the system. And if not recoverable, kiss it all good bye forever.

Do you see why I preach "back-up your data"?

Upon hearing that, the client was not happy. His question was, could it be recovered any other way. As in "Cheaper?" I'd done my cursory analysis and determined there is a hardware problem but did not isolate it. As a doctor, the first rule is "Do no harm" so I limited what I did to things that were likely not destructive to the data.

I offered to spend some more time poking at it. I knew from my attempts to get data from the drive that it was running quite hot. In fact, so hot as I'd put another fan blowing on it while working just to keep things cool. Heat is enemy #3 for electronic components. The #1 and #2 slots go to "Liquid" and "Dropping on the floor". While dropping won't hurt a chip, it will do quite a lot of damage to internal parts that aren't designed to handle 100Gs of force. Hard drives don't like being dropped either, but that is another story.

But from this point forward, if I did mess around with the hardware, there is a chance I might render things completely unrecoverable. The client was willing to take that risk, deciding that at $1000-3000 he would rather lose the data than pay for its recovery.

I believed there was a good chance the data on the drive wasn't totally cooked, but just the controller board. As luck would have it, I happened to have one of those same drives in a server here. I put the two side by side, the good drive on the left and my client's dead drive on the right - you can click on the image below for a full-sized view:

If you look at the circuit pads and compare the ones on the left I pointed to with the red arrows with the similar pads on the right, the ones on the right are discolored which is an indication of a lot of heat. Even though these were both Western Digital WD5000AAJS drives manufactured within 2 days of each other (02 Dec 2007 on the left, 04 Dec 2007 on the right) in the same factory, you can see there are differences in the drive controller boards.

My hope was the controller was cooked but the data on the drive was still good and readable.

My other hope was that the known good controller board would talk to the dead drive's motor and platters the same as the dead board did. No guarantees there - they are clearly different designs and could implement completely different and not compatible methods of talking to the heads / platters. If swapping boards works or not is a gamble and all in Western Digital's hands.

After moving the good controller board to the dead drive, hooked everything up - applied power (no smoke!), and connecting it up to the recovery system with an empty drive ready to catch anything that might be important and readable ...

The drive came up, was recognized, was readable, and had a good file system on it!

From there it is a race - can you get all your data off the drive before it decides to crap out again. If the board was damaged because of poor airflow and cooling in the system, I could likely read everything for a long time at a leisurely pace. If the drive internals have a problem where it drew so much current through the circuits of the controller and that is why fried the old controller then this will likely happen to the replacement controller - so I'm on a tight clock, rescue data off from most important to least important before the whole thing smokes the replacement controller.

If you are under the clock like that, you don't know it until things have failed. So you operate like you are on an unknown clock and get as much as you can as quickly as possible and hope you got enough so you aren't sending the drive for a $3,000 recovery.

This story has a very happy ending. With some strategic cooling, I was able to get all the important data off this drive. Client was happy. He did spend around $600, which included a new & bigger hard drive with all his data back on it. Way less than shipping it off to the recovery specialists.

Just for fun

I was curious if I could bring the drive back to life - looking at the back side where the controller makes contact with the electronics inside the drive itself, here are two shots of a connector before and after cleaning it with a pencil eraser:



Left is before, right is after - see the discolored by heat contacts? Tried cleaning them and re-assembling the dead drive (after getting all the juicy data off it, of course!) and ... unfortunately, the drive still wasn't working. Not that I would trust it if it did work, but I'm showing this to give a small hint at some of the many failed paths one often takes before they find the path that works.

This controller card is fried. And even if I had a new one, I won't trust this drive at all, especially when a double size new drive can be had for $70.

It is good for puling out the very powerful magnets - maybe another article? If you want super powerful magnets, take one of these apart - you will be amazed!

Not a typical data recovery

This was an unusually complicated recovery. Most of the time, the drive itself is still working but has data errors on it, or has had critical sections trashed by some program and I can use software tools to scan and find most of the important files, sometimes rebuilding those critical areas by hand.

In fact, this is the first time I've written about a data recovery operation as this was not typical. I've recovered data from camera flash drives, USB sticks, and many many hard drives over the years. I even took a video of one broken drive that became readable when I moved it in a particular pattern. There is a link to the video near the bottom of the Cool Stuff page, if you are curious.

So the moral of this story? Back up your important data!

Every hard drive is an electro mechanical piece of equipment which will eventually fail and try take all your data with it to the grave.

Data loss is totally preventable and for a minimal cost. I do not subscribe to the "backup data into the cloud" - you will pay more, get less, and depending on your upload bandwidth and how much data you have might never be able to transfer it all. Plus, getting it back might take weeks. But that is another article.

2 TB external hard drives are now around $100. This should be more than enough storage for 95% of the people out there. Cheaper if you can go with 1 TB. Both these are clipped from Micro Center, 1/17/2013:

 

Get two, one on your desk and one you keep at someone else's house and rotate them every month or two so you'll have an off-site backup. Why off site? What happens if your house burns down. Or if thieves come in and steal your computer along with the nice backup hard disk sitting on top of it?

Backup is cheap insurance against having to pay for data recovery, which is very is expensive. Or data loss, which might be impossible to replace.

Happy backing up!

David Soussan