“We were not allowed to touch a client’s server on our network despite warnings that it required maintenance and the data properly backed up. They told us they couldn’t afford any downtime, as the server was critical and refused to allow us to do any even though we felt a failure was imminent, which finally happened a month after this final warning when the data volume became inaccessible. Many thanks to DiskEng for all the hard work in recovering the data.”
L Smith, Company confidential, London
A 1TB Western Digital Red hard disk drive arrived at our laboratory in Oxford from London. The hard drive was inspected by our data recovery hardware specialists finding no faults with the controller board. When the hard disk was powered it spun up was slow to come enter the drive ready state.
Our data recovery engineers then set about securing a sector-by-sector image copy of the drive. During the initial scan across the drive a large number of bad sectors were encountered, with approximately a million sectors skipped, in order to secure as much data as possible without putting the health of the drive at risk. Once this first scan of the hard disk was completed our engineers set about securing the remaining unread sectors. This proved to be a time consuming process which required careful monitoring of the drive as a disk in this condition can sometimes freeze or even have the read/write heads crash into the platters. In this case the drive remained operational with the engineers able to secure all but 43 unreadable bad sectors.
When a hard disk is formatted in the factory it will most likely have a number of media flaws which are mapped out. An area of the drive is also reserved as a swap space which is used to relocated bad sectors as they are encountered, which occurs during the operational life of any hard disk drive. Eventually the swap space will be filled, at which point any new bad sector encountered will be presented to the host operating system. Often these will go unnoticed for a considerable length of time, until a critical data structure file system required by the operating system is damaged as a result. The operating system can in some cases make attempts to repair this damage, or as in this particular case the file system was unmounted.
The secured disk image was examined by our data recovery specialists, who found it to contain a 1TB NTFS data volume. During the analysis of the file system it was determined that first entry of the Master File Table and cluster usage bitmap contained the bad sectors which the engineers had been unable to recover. The damage to this would have caused the operating system to unmount the file system, but are not critical for recovering the data files on the volume, which consisted mainly of SQL database files of approximately 600GB, which were returned to the client.