From: dr d b karron (karron@casi.net)
Date: Wed Jul 17 2002 - 01:44:09 MDT
Dear Mr. Perry;
I would reply to you directly except you did not provide your direct e-mail;
I hope the list members are not upset with my off-topic discussion on this
list.
Here is one hope for you :
Freeze the disks and hope that data recovery technology improves;
or that data archeology technology in the next century improves ?
Actually, there are a number of labs that can take your disk apart and
remount them on
new spindles in a clean room and map the magnetic fields at the surface.
If you are into physical data recovery (the disk is cracked open and has to
be put on
clean room spindles to read them) you are at the last stage in data
recovery.
You can get a map of the platters, and generally, a good disk (SCSI) has a
parity bit
somewhere; you should get a dump of each platter's data and you can tinker
with
reassembling the data with parity; I have recovered broken raids that way
(where data is
distributed across many disks with parity to enable recovery from a single
disk failure, i.e., RAID 5). If the data on any one platter is bad, and the
disk uses parity error checking,
you should be able to recover something from it.
If the file system is NTFS or CIFS, these files systems have extensive
redundancy
to enable file system recovery; there are probably many erased sectors you
can recover if your
main file tree sectors are bad.
I can point you to some data recovery people I have worked with when we had
our raid crash;
we have since spent a very large amount of money on tape backups running
automatically,
file replication protection, mirrored disks and other data protection
schemes.
Please contact me off line for firms I can point you to. Once your recovery
firm has
a map of the disk platters, and they should have a few copies to check with,
you can ship the platters to some other firms that do forensic data
recovery. Once you have a
bitmap of the drive you can give it out for people to try their software
tools at file recovery.
I hope you have plenty of cash; these services can run between 30-50K;
Alternatively you can hire someone directly to try to map and restore the
file system remnants
and recover as much of the underused and erased files as are intact on the
platters.
What brand disk is this ? How did you loose it ? Tell me what firms you are
working with
and I can discuss with them why they can't reconstruct the data even with a
missing platter;
If it is cheap disk without any parity they may be correct; if you are using
a FAT file system,
these file systems are almost impossible to rebuild because there is not
enough redundant information to enable a reconstruction. If the magnetic
media is scratched off of the aluminum rotor, you are also hosed; you can't
read any magnetic field from the rotor substrate! Your hope
there is to find alternative sectors with erased file blocks from your main
file tree.
Cheers!
Dr. K
-----Original Message-----
From: owner-extropians@extropy.org
[mailto:owner-extropians@extropy.org]On Behalf Of Mike Perry
Sent: Wednesday, July 17, 2002 2:41 AM
To: extropians@tick.javien.com; extropians-digest@extropy.org
Subject: Data Recovery
Perhaps some computer-oriented extropian(s) can help with advice. I have a
knotty data recovery problem I've encountered due to a recent hard disk
crash. The data in question included some notes I made on various subjects
over more than a year as well as in-progress writing for Alcor's
newsletter. If nothing else I'd like to get back the notes, even if it took
years to do so. I've taken the disk to a data recovery place nearby and
*they could do nothing* (except for "one last chance" which I am now
awaiting results for, but the odds don't look good). The problem seems to
be physical damage to the platters in the drive. But apparently all the
platters must be in working order for any data to be read from any of them,
due to the way data is written on the drive, one bit on one platter, the
next bit on the next platter in the stack and so on. Apparently technology
does not exist to read the entire bit image of one platter by itself (or
whatever part is readable), which could then be compared to the bit images
of other platters to try to achieve the necessary synchronization and
reconstruct the data. (This greatly surprises me, but that's what the data
recovery "expert" told me, if I understood correctly.) Any advice would be
greatly appreciated, privately if you wish.
Mike Perry
This archive was generated by hypermail 2.1.5 : Sat Nov 02 2002 - 09:15:30 MST