Failed disk drives need not be consigned to the trash bin, along with a curse if the backup arrangements have failed. Your data can probably be recovered by a data recovery specialist and not for too much money either. With a damaged drive the data is still there. It just can't be read because of some error condition: the on-disk pointer:block system has been corrupted; the data has been deleted; there is a controller board electrical problem; there is a head and/or platter mechanical problem; or some combination.

Damage limitations

Kroll Ontrack has a data recovery lab at Epsom in Surrey. Failed drives are delivered to the lab and a first pass look reveals whether the drive is still capable of spinning or not. If it is mechanically sound and still capable of being spun up then data can be recovered digitally. If not then there is mechanical damage and the drive casing will probably have to be opened up. That is done in a clean room.

In most cases data can still be recovered but the drive cannot be guaranteed to work afterwards once the sealed clamshell has been broken.

There are two instances where data cannot be recovered. One is where a digital blanking patter has been repeatedly written onto the data areas of the drive. The other is where the platter is irretrievably damaged; for example its surface is corroded and the media recording layer destroyed.

However, if the drive basically works then a digital image is taken of its entire contents. Next Kroll Ontrack software is used to verify the on-disk digital data structures and repairs made to obvious failed pointer links, etc., then a report is prepared of the recovered contents.

These recovered contents are matched against a list of the drive's contents that the customer has provided. That way Kroll can check whether it needs to look deeper into the drive's contents or not.

Clean room

If drives are mechanically damaged they are taken into the clean room. This is a basic lab environment with fans extracting air from hoods above workbench cubicles. It is not a clean room in a disk assembly plant sense. Kroll's chief engineer, Robert Winter, said that Kroll had looked into investing into a rigorously clean environment but the cost would have been very high and the amount of additional data recovered not much greater. There simply wasn't a profitable business in it.

A drive's clamshell is opened and the damage assessed. In some cases it might not be visible and component removal might be necessary to trace it. Spare parts can be used to replace some failed components and the drive's digital data imaged.

The recoverability of drives is surprisingly good. In a recent challenge people were asked to do their worst to drives and submit them to Kroll:-

1. Drive dropped three floors. Kroll engineers found that the drive wouldn't spin up. They opened the casing, circumvented the mechanical damage they found and achieved 100 percent data recovery.
2. Drive put in pitcher of beer for ten minutes. Kroll engineers again found the drive wouldn't operate normally. They discovered both internal and external electrical damage, which was fixed through using spare parts. Again, one hundred percent data recovery was achieved.
3. A notebook drive was thrown around an office and then put in a mug of sweet tea for five minutes. It was not operating normally, not surprisingly. Kroll engineers opened it up and cleaned what they could see. That wasn't sufficient and they progressively took it apart, removing the read/write head, then each platter in turn. Underneath the bottom platter they found a glue-like mass which was congealed sweet tea. This was cleaned and the drive re-assembled. Again, one hundred percent data recovery was achieved.

Glass platters are brittle

Some notebook drives are made with glass and not aluminium platters. These are inherently more brittle than metal platters.

In a fourth challenge to the expertise of Kroll's engineers a notebook drive was dropped from a 3-storey window twice, submerged in a pond, run over by a car a couple of times and then hit several times with a hammer.

It was not operational when received by Kroll - ! - and the engineers opened it up in the clean room. The platters were found to have shattered into many, many pieces and no data at all could be recovered.

Liquid damage

Although drives are supposed to be air-tight and operate inside sealed clamshell cases they are not actually air-tight or, indeed, waterproof. The problem is that there is a pressure equalising vent in the casing to ensure that air pressure inside the clamshell equals the outside air pressure. A membrane inside the vent protects against particle entry into the drive but it does not prevent liquid entry if the drive is submerged.

If a drive does get wet then Kroll advises emphatically against trying to dry it. Fluids can oxidise or otherwise corrode a media recording surface. Instead, put the drive inside an air-tight bag and get it to a data recovery specialist quickly.

Operating system support

Kroll engineers can successfully work on Windows and Unix drives, also Apple ones. That is to say that Kroll's drive software understands the on-disk data structures of drives formatted for use by users of these operating systems. Older operating systems such as Compaq (and Digital equipment's) VMS can also be dealt with. However AS/400 users are out of luck as are, probably, mainframe users. If in doubt, contact Kroll.

Kroll is finding that flash memory devices are coming their way. The pattern of damage is different as flash drives are susceptible to electric current surges. Winter says that it has also dealt successfully with damaged optical media, even where there may be a crack in the recording surface. It all depends upon the amount of damage.

Costs

The price for Kroll Ontrack work is surprisingly reasonable. A standard drive recovery will take two days and cost £700. The work can be done more quickly but the cost goes up. Where more days are needed, estimate the cost through a £350/day rate.