Slyck.com
 
Slyck Chatbox - And More

hard drive recovery safety

This is the forum to discuss tech-hardware related issues.
Forum rules
PLEASE READ BEFORE POSTING: Slyck Forum Rules

hard drive recovery safety

Postby ejonesss » Tue Oct 28, 2014 10:33 am

i have a drive that failed and i am thinking of sending it to a drive recovery house and i was wondering about how safe it is to do that.

do they attempt to open the files and read the data or do they simply clone the drive to a new drive and send you the data on a new drive?

i suspect it may be a problem with the logic board on the drive.

my concern is i have some stuff i have downloaded from various sites including newsgroups and i was wondering if anyone else had experience with drive saver/recovery services especially in today's day in age?
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby zbeast » Tue Oct 28, 2014 12:14 pm

If the drive just has "wares" on it... they don't care..
If it's something else.. I would not do it. The fed's have been sending request letters to pc repair shops,
cloud stores sites, cloud backup sites. a list of hashes to compare files to.
So if they encounter one of these hash matches they are to report it.

Note, I have never used a data recover services.
Knowledge is power. Power corrupts. Study hard. Be evil.
zbeast
 
Posts: 6783
Joined: Thu Apr 01, 2004 5:20 pm
Location: Behind that itch. yes, that one right there.

Re: hard drive recovery safety

Postby ejonesss » Tue Oct 28, 2014 2:16 pm

do the recovery shops even look at the contents or just clone and ship?
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby zbeast » Tue Oct 28, 2014 6:24 pm

Just by the nature of the job... they have to look at the data..
you have to see if you have a valid partition table, you have to see
if you have a valid directory, you have to see if data is coming off the old drive to the new drive.
They can't just stream the data off the disk..

More than likely it's not just a bad logic board. Every drive I've ever had go bad has always been do to head crash.


What's the model number of the drive? I only ask, as I go though a lot of drives.
Knowledge is power. Power corrupts. Study hard. Be evil.
zbeast
 
Posts: 6783
Joined: Thu Apr 01, 2004 5:20 pm
Location: Behind that itch. yes, that one right there.

Re: hard drive recovery safety

Postby ejonesss » Wed Oct 29, 2014 4:19 pm

but do they then open the files to see the images and videos

i thought they do a blind clone
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby ejonesss » Wed Oct 29, 2014 4:22 pm

blind clone sort of like when you clone a tivo drive to upgrade or replace the drive
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby IneptVagrant » Thu Oct 30, 2014 8:46 am

Why would you assume anything about how they get the job done. No one knows what a particular companies process will be. Here are some possibilities. 1) manual toolkit... so the operator could get bored, and just opens random files looking around just cause they fell like it. 2) manual toolkit... with purposeful manual inspection 2) manual toolkit which includes an automated inspection.. 3) automated toolkit with or without filter screening. 4) the drive is sent to china and processed there, cause the company is really just a middle man 5) ??? they have a mini black hole they drop the drive into and it comes out on the other side of the building repaired and ready to go
IneptVagrant
 
Posts: 1245
Joined: Tue Nov 15, 2005 5:07 am
Location: close the world . . . . . . . . . . . . . . txEn eht nepO

Re: hard drive recovery safety

Postby sunnyd » Thu Oct 30, 2014 9:47 am

I can't help but wonder why the thought of just calling the specific tech repair service (or more than one) to ask them what process they use to recover data from drives hasn't been done yet. :shrug:

There is such a thing as just calling to inquire without revealing what data is on your drive, lol. And, for real paranoid people who don't want their phone number revealed, be sure to use *67 prior to dialing. :roll:

Drives go bad for several reasons, and often the process of repair is not even worth the cost, that's where adequate backups come in real handy. :idea:
Follow Slyck on Twitter @SlyckDotCom
Join Slyck's Facebook Fan Page
User avatar
sunnyd
 
Posts: 30027
Joined: Mon Jan 21, 2008 2:34 pm

Re: hard drive recovery safety

Postby ejonesss » Thu Oct 30, 2014 12:35 pm

sunnyd wrote:I can't help but wonder why the thought of just calling the specific tech repair service (or more than one) to ask them what process they use to recover data from drives hasn't been done yet. :shrug:


that can set up a suspicion (remember the alabama person that killed their child in the hot car and internet records show they researched how hot the car has to get and how long a given temperature requires to kill a baby?)

the first thing i did is sent the board from the drive in because that model of seagate (ebay item to exact board from same model 291259960759 (unfortuantely the controller's bios is unique so the ebay board will not work)

the canadian company will extract the bios and burn it to a new board (that usually solves problems well enough for recovery of data).

There is such a thing as just calling to inquire without revealing what data is on your drive, lol. And,
for real paranoid people who don't want their phone number revealed, be sure to use *67 prior to dialing. :roll:


that does not work with international calls and even if it did the police can still trace it if needed.


Drives go bad for several reasons, and often the process of repair is not even worth the cost, that's where adequate backups come in real handy. :idea:


the drive did not do the click of death so the platters and heads and motor still work it is just not being recognized so i suspect it probably was caused by a bad power supply for the enclosure that weakened the drive (probably the chip that interfaces with the heads to get the data).

often the process of repair is not even worth the cost


yes it is true if they have to take the drive into clean room and take it apart and replace the heads or something but if it is a matter of replacing the firmware that lives on the platters they can just connect the drive and flash the firmware.

i mention tivo because they use a proprietary format so all a data recovery house or police can do to a tivo drive is clone it and put the new drive in the tivo box.

i upgraded my tivo from 320 gig oem to 2 tb drive and i cloned it and never looked at the files.


that is why i was asking because if anyone on the board here works at a recovery house and knows if they can just do a blind clone.
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby sunnyd » Thu Oct 30, 2014 1:22 pm

:doh:

ejonesss, did you ever think of calling somewhere local? All you want to know is the process used, in no way does that tell them what files exist on your drive, unless YOU tell them.
Follow Slyck on Twitter @SlyckDotCom
Join Slyck's Facebook Fan Page
User avatar
sunnyd
 
Posts: 30027
Joined: Mon Jan 21, 2008 2:34 pm

Re: hard drive recovery safety

Postby HouseCrowd » Fri Oct 31, 2014 7:53 am

ejonesss wrote:
sunnyd wrote:I can't help but wonder why the thought of just calling the specific tech repair service (or more than one) to ask them what process they use to recover data from drives hasn't been done yet. :shrug:


that can set up a suspicion (remember the alabama person that killed their child in the hot car and internet records show they researched how hot the car has to get and how long a given temperature requires to kill a baby?)


I remember the story, but I don't recall that they phoned anybody for technical advice. They did, as you point out, do a little internet research, which is what you're doing, is it not?

You've already given us specifics, like the model number (291259960759) for a part that is clearly very rare, since Google has but two results for it as a search term ... your thread on Slyck and (presumably) an ebay listing from the Canadian company you mentioned :P

How bad is the stuff on this drive anyway? I doubt very much the feds will care to launch a criminal investigation for a few warez or moviez (that, for all they know, you may legally own anyway). And, if the contents are much worse than that then, well, with the amount of info you've given away so far, the feds are probably already on their way. :wink:
There are 10 types of people in the World; those who understand binary, and those who do not.
User avatar
HouseCrowd
 
Posts: 33862
Joined: Mon Oct 13, 2003 4:18 am
Location: UK

Re: hard drive recovery safety

Postby ejonesss » Fri Oct 31, 2014 8:15 am

i doubt the feds are on their way and the only thing i sent is the drive controller board i still have the drive and the drive is useless to the feds at this point since they need a controller board and and i doubt since the board's bios is unique seagate would not keep a copy on their site.


i am trying them since they have the means to reflash the board.


HouseCrowd wrote:
ejonesss wrote:
sunnyd wrote:I can't help but wonder why the thought of just calling the specific tech repair service (or more than one) to ask them what process they use to recover data from drives hasn't been done yet. :shrug:


that can set up a suspicion (remember the alabama person that killed their child in the hot car and internet records show they researched how hot the car has to get and how long a given temperature requires to kill a baby?)


I remember the story, but I don't recall that they phoned anybody for technical advice. They did, as you point out, do a little internet research, which is what you're doing, is it not?

You've already given us specifics, like the model number (291259960759) for a part that is clearly very rare, since Google has but two results for it as a search term ... your thread on Slyck and (presumably) an ebay listing from the Canadian company you mentioned :P

How bad is the stuff on this drive anyway? I doubt very much the feds will care to launch a criminal investigation for a few warez or moviez (that, for all they know, you may legally own anyway). And, if the contents are much worse than that then, well, with the amount of info you've given away so far, the feds are probably already on their way. :wink:
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby HouseCrowd » Fri Oct 31, 2014 8:52 am

ejonesss wrote:i am trying them since they have the means to reflash the board.


For many drives, it's actually pretty easy to reflash the board yourself. You essentially just need a cheap USB/RS232 adapter:
http://www.youtube.com/watch?v=6dAwM5mB5e4
There are 10 types of people in the World; those who understand binary, and those who do not.
User avatar
HouseCrowd
 
Posts: 33862
Joined: Mon Oct 13, 2003 4:18 am
Location: UK

Re: hard drive recovery safety

Postby ejonesss » Fri Oct 31, 2014 9:15 am

the drive is the 2tb green and i am not sure that is the problem

why doesnt hard drive makers not make the firmware and bios redundant?

dedicate 1 gb and just repeat many copies all over the platter so if the firmware gets corrupt you could reflash by connecting a jumper and power the drive and listen for beep emitted by the read write motor or spindle motor to indicate finish
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby HouseCrowd » Sat Nov 01, 2014 6:15 am

Catch-22. I would imagine the firmware is required to read/write data to the drive in the first place.
There are 10 types of people in the World; those who understand binary, and those who do not.
User avatar
HouseCrowd
 
Posts: 33862
Joined: Mon Oct 13, 2003 4:18 am
Location: UK

Re: hard drive recovery safety

Postby ejonesss » Sat Nov 01, 2014 9:40 am

HouseCrowd you are right it is a catch 22.

it all started with the failure of the power supply for the enclosure last year.

i switched power supplies and the drive continued to work for another year.

now the drive acted the same so i figured ok the power supply failed again

i put on another power supply this time the drive would not show up on my mac.

after repeated power cycling i got it to only show in disk utility once and cause prosoft engineering's data rescue 3 to try to see the drive.

after that it no longer shows so it is probably a bad board bios or one of the intermediate chips that translates the data from the drive to the sata chip may have been weakened by the failure of the power supply last year and slowly gotten worse until now when the chip failed.

i am hopping the folks of hdd-parts.com is able to transplant the bios to a new board and the drive will work long enough for me to salvage the data onto a new drive.
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby ejonesss » Sun Nov 30, 2014 12:24 pm

update and question:

the problem according to the folks of hdd parts turns out to be the motor i dont know if that is the spindle motor or the read/write arm magnet (if that is called a motor too).

the did manage to get donor parts to fix it enough to recover the data for me.

on monday they will be assembling the old drive to send it back to me and while i got some of the data recovered i should be able to try to recover some data from the broken drive if they keep the donor parts installed.


the question(s): i was wondering (as far fetched as this would sound) is it possible for malware to get low level access to a hard drive and actually destroy the drive mechanically by for example by corrupting the controller chip such to say apply the full 12 volts to the read/write arm coil and burn that up or weaken it or over drive the spindle motor by putting too much current to the motor and burning it up?

witch brings me to another question

if someone had a grudge or as a sick prank write malware to plant a piece of cp or some other really illegal file to a hard drive then destroy the motors forcing the user to send the drive off to a recovery house in hopes they will find the illegal content and bust the person in an attempt to ruin their life?

fortunately no seriously illegal content here but it does raise a serious concern with all the malware out there .

fortunately hdd-parts.com has a very good privacy policy that they DO NOT look at the files or retain a copy of the recovered data and they will reassemble the broken drive and return it for a fee.
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm

Re: hard drive recovery safety

Postby zbeast » Sun Nov 30, 2014 3:16 pm

When they said motor, more than likely it was the spindle motor. the head 'motor" never fails.

Could malware attack the drive... Sounds good for a plot device for a movie but in the real world it would be highly unlikely. It would would be very hard and require the attack to know the exact model and type of drive you have in your computer. that's not to say it would not be possible. I did an attack on a security cameras but it was a simple attack. I made a tool that let you set the frame rate of ip cameras remotely. So if you wanted to cross one without being seen..
You simply set the frame rate to zero... The camera still looked as if it was working.. but it was just displaying the last frame in it's buffer. but I knew the camera type and have internal documents for the cameras api..

Hard drives just fail.. it's the number one reason why I run all my critical data on nas hardware. Single drive failures are painful when you loose 4tb's of data.. All my single drives are mirrored to my nas and I run "Crystal Disk Info" on those drives to keep an eye out drive failure.

Why a program like this is not part of windows I have no Idea. Anyway drive always warn before they are about to blow.
lot's of sector read errors, Over heating, retry counts... things you'll never see without some type of monitoring software.

My personal recommendation by a Qnap or a Synology Nas, not a Drobo...
I'm betting it will cost a lot less than what you're paying for your drive recovery.
That will save you in the future.
Knowledge is power. Power corrupts. Study hard. Be evil.
zbeast
 
Posts: 6783
Joined: Thu Apr 01, 2004 5:20 pm
Location: Behind that itch. yes, that one right there.

Re: hard drive recovery safety

Postby ejonesss » Sun Nov 30, 2014 3:43 pm

nas boxes are hard drives too they are an internal hard drive in an enclosure with an ethernet port and maybe even usb port.

the apple time capsule is a nas drive because it connects by ethernet port.


usually hard drives fail with bad sectors so you get advance warning because you will get a "file could not be written or read" error when you copy to or from the hard drive.

mine just acted as if it was unplugged from the usb port without being unmounted first and i got the error "the drive was disconnected improperly" the next morning.


the reason i was asking about malware is because i know that you can flash the firmware via a live cd boot disk (in fact seagate has a patcher).

so in theory if the firmware could be accessed via the ide or sata or maybe even usb then what else could be accessed.

although doesnt manufacturers not have lockouts so low level access is not possible via the drives user ports and can only be accessed by removing the board and putting in a special proprietary flashing jig or via the service pins marked unused if it ide and a 3 or 4 pin header next to the power or sata connector?
…-..-..-..-..-.-----.-…-..-…-..-…-...
ejonesss
 
Posts: 2953
Joined: Thu Feb 06, 2003 5:43 pm


Return to Tech/Hardware Discussion

Who is online

Users browsing this forum: No registered users and 1 guest

© 2001-2008 Slyck.com