From: Harvey Newstrom (mail@HarveyNewstrom.com)
Date: Wed Jul 17 2002 - 09:39:32 MDT
On Wednesday, July 17, 2002, at 02:41 am, Mike Perry wrote:
> Perhaps some computer-oriented extropian(s) can help with advice. I
> have a knotty data recovery problem I've encountered due to a recent
> hard disk crash. The data in question included some notes I made on
> various subjects over more than a year as well as in-progress writing
> for Alcor's newsletter. If nothing else I'd like to get back the notes,
> even if it took years to do so. I've taken the disk to a data recovery
> place nearby and *they could do nothing* (except for "one last chance"
> which I am now awaiting results for, but the odds don't look good). The
> problem seems to be physical damage to the platters in the drive. But
> apparently all the platters must be in working order for any data to be
> read from any of them, due to the way data is written on the drive, one
> bit on one platter, the next bit on the next platter in the stack and
> so on. Apparently technology does not exist to read the entire bit
> image of one platter by itself (or whatever part is readable), which
> could then be compared to the bit images of other platters to try to
> achieve the necessary synchronization and reconstruct the data. (This
> greatly surprises me, but that's what the data recovery "expert" told
> me, if I understood correctly.) Any advice would be greatly
> appreciated, privately if you wish.
First, do not let anyone try to recover the drive with Norton Utilities,
a disk defragmenter or anything that actually might modify the disk
trying to get it back into working order. Do not allow any utility to
"fix" the disk if it thinks it can. This will make it worse and ruin
further recovery efforts.
Second, if they can't recover it, try shopping around to other data
recovery services. Some are better than others. Although disks degrade
over long period of time, the broken disk shouldn't be getting worse
within a year's time, so you should have plenty of time to try to find
someone who can do it.
Third, unless you a RAID disk which carefully spreads disks apart and
deliberately contains organization to aid in data recovery, your data
should be randomly distributed into different sectors. It is hard to
imagine that every single sector of every single platter is
unrecoverable. There should be snippets here and there of information
that could be recovered.
Fourth, I have a disk recovery program that tries to read low-level
surface of disks and will recover what it can. You can tell if it will
work for free. The free version does not let you save what it
recovers. If it works, you will need to buy the $169 product. (I do
not own or have access to the full version.) Let me know if you want me
to mail it to you. You would have to have a bootable disk to run the
computer with the broken disk also attached to it and accessible.
Fifth, even if nothing works now, do not throw this disk away. It might
be recoverable later. (I.E, don't all it dead, call it deanimated for
now....)
Feel free to e-mail me for that program or for any further assistance I
can provide. I have consulted a forensics expert for the information I
provided above. I will also consult an IBM disk firmware designer to
see if there are any testing or debugging tools that might be able to
access individual platters for analysis.
-- Harvey Newstrom, CISSP <www.HarveyNewstrom.com> Principal Security Consultant <www.Newstaff.com>
This archive was generated by hypermail 2.1.5 : Sat Nov 02 2002 - 09:15:30 MST