A Retro Moment - Toshiba MK1403MAV Recovery

At R3 Data Recovery we deal with many types of storage devices, consumers need to backup more and more data now the access to music and photography is easier with electronic goods such as mobile phones.

With the trend towards faster, higher capacity and more compact hard drives, it's nice to change the pace a little and work with something from a little earlier.

Toshiba MK1403MAV circa 1997 with a capacity of 1.4GB was such a case, a small 2.5” laptop style hard drive with an IDE interface. Probably a proud moment for the Toshiba engineers to break the 1GB barrier and it was used in many computer based devices from that era.

Thankfully the hard drive was recovered with only a handful of bad sectors and the client was over the moon, but testament to Toshiba engineers also who did a good job 20 years ago.

Toshiba MK1403MAV In The Lab

Bootable Clone?

Here at R3 Data Recovery we see lots of storage devices each day ranging from hard drives to USB sticks to 30 disk servers, it definitely varies from day to day.​

With each device comes a reason for failure. A lot of the hard drives we see are sent into us because the customer said​

"I can see the drive but can't access it"

"It's taking ages to copy data to it"

The usual cause of this is what we refer to as a build-up of bad sectors/bad blocks rendering the media on the drive degraded. This will cause the drive to become slow and eventually it will stop working and fail.​

So, if this is happening to your drive, we suggest you stop using the drive and contact a data recovery professional.

In our data recovery lab we have the ability to fix and read the bad sectors with our specialist equipment. This could mean that a full clone of the drive could be made meaning no missed/unread sectors. Obviously, this will also depend on the drive and if there are any other problems with it.

It is not always possible to get a fully cloned drive, however in the event that we do get a fully cloned drive, it is possible that we are able to create a bootable clone so you are able to plug your device straight back into your machine. This will only obviously work for a drive that contains an operating system on it and is used to boot a machine up.

Like previously said it isn't always possible to get a full clone in order to be able to create a bootable clone, it is down to how badly degraded the drive is and if we can read the bad sectors or not.

Do you think your device is failing due to media degradation? Call us today at 0800 999 3282 to get immediate help and advice from our data recovery specialists.

The Knowledge of Matching Donor Drives

Here at R3 Data Recovery, matching donors is a very important part of some recovery processes. As in some circumstances drives that come into our lab require multiple re-builds and donor parts. So having the experience and knowledge of finding these donor parts gives us a huge advantage. 

Wiped Seagate donor drive

Matching donors however isn’t always as straight forward as you may think.​

Obviously to look at two same model drives and their parameters laid out on the lid sticker it appears simple to match them. And sometimes it is, however some drives aren’t always what they say on the lid.​

Some drive for example may begin life as a 3TB, however when going through the testing stages at the factory, the drive is found to have too many bad sectors than normal and the drive therefore has to be changed to a smaller capacity so the drive doesn’t use the surface all the bad sectors are located on.

This means that a drive may look like a 2TB for example but it could have once been a 3TB or even a 4TB in its life time.

This becomes a problem when looking for donor parts as generally bigger the capacity of the drive the more read/write heads and more platter surfaces are used/needed. So, when coming to look for a part, it is possible that the drive we are sourcing a donor part for may not have the number of heads we would normally presume it has.​

This means that we would have to look for a drive that had the same number of heads, and had been downgraded from factory like the original device. This can be tricky as there is no way of determining this from looking at the device specifications like we would normally, we would have to use specialist software to be able to check how many heads a drive has, but then it may not be the right head geometry. 

However, with all the experience that our engineers and assistants have gained over the years, searching for parts in our huge parts stock is getting easier day by day, as we learn more and more about the drives that are coming in for recovery.

And with this knowledge the outcomes of each new job that we receive at R3 are becoming increasingly positive.

If you believe that you have a mechanically failed hard disk then get into contact with our sales team and get a free quotation over the phone. Call us today at 0800 999 3282 to get started with your unique case.

A Customers Perspective: Extreme Anxiety to Elation in 48 Hours

I am a fashion photographer and I was on location shooting in Italy when one of my hard drives with my current work got damaged. It was showing the catalogue and list of names of the folders but not showing any of the images inside those files but still showed that I had used 500 GB of storage.​

I tried it in any computer and MacBook (It is a mac hard drive) I could get my hands on. I then started to panic because the computer would freeze when I tried to open it and on some computers it wouldnt read the hard drive at all.​

R3 Emergency Recovery Specialists in the UK

In a crying panic frenzy I googled data recovery UK and found an emergency number for a man called Andy Butler at R3 Data Recovery who soon became my favourite person in the world.

I was ever so slightly hysterical on the phone and he managed to calm me down and got me to explain what had happened and explained that it was likely to be an issue with the signalling between the catalogue and the data itself.​

I wasn't due back in the UK for another 4 days and was trying to think of what I could do or how I could get the HDD to him before then. I decided to book an emergency flight home the next morning because I couldnt sit and do nothing, especially not knowing how serious the situation could be.​

I flew to London and got a train straight to Sheffield where I was met by Andy and his charming driver who took me straight to their lab where I promised not to cry or touch anything and sat in the corner hoping they could work their magic. They sent me off for a few hours and said they would call me hourly with an update.​

I have to state that I initially called him on a Saturday night in a mess emotionally and this was Monday morning so I was like most creative people I know, quite last minute but he made time for me.

He told me there was a problem with the heads of a hard drive (I gained a lot of knowledge of the ins and outs of data and hardware that day) and they were replacing them with other heads and coding to try and talk to the data.​

Long story short after a couple of tantrums, lots of tears, travelling over 2500 km Andy and his team of geniuses managed to rescue all of my images in one day and they were all in order and in the correct files (I have been told sometimes when rescuing data it can get mixed up and in the wrong order/ folder).

I put all my work and faith in his hands and he didn't let me down and was completely charming and wonderful from start to finish of my mini meltdown data lost and found experience. What a brilliant man. I am so happy I found R3 data recovery but in the nicest way possible I hope I won't have to see them again too soon and that my technology will all be ok and my backups wont fail!

It did cost me £1000 (because I needed 2 new hard drives and I needed it all doing in 1 day and most people allow 7-10 days) but you can't put a price on your career and other clients work and it was worth every penny. I am so very grateful that he went above and beyond to help me and was at the end of the phone with every question I had.

Amelia - London

Get advice and assistance from Andy and the team at R3. R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

How Easy Are Mechanical Recoveries?

​Any job that arrives here at R3 Data Recovery that is diagnosed as having a mechanical fault, needs to be left untouched and not powered up again until a rebuild has been performed on the drive. In almost all cases, having a mechanically failed drive means that a head swap is needed, so we would need to source for a matching donor that has working heads and swap the heads from both drives.

R3 hard drive heads and platters

​There are two stages of mechanical recoveries:

Stage 1 - This stage is less severe of the two and should only require one donor. This stage is for if the drive has what the engineers at R3 refer to as stiction, this is basically where the read/write heads stick to the platters. Once the heads have stuck to the platters, the disk can be prevented from spinning up and can cause physical damage to the platter and ultimately the data stored on the disk.​

Another situation that falls under this stage are if the heads are slightly bent or damaged due to the drive being dropped. In most cases we can recover the data when the drive is at a stage 1 providing of course that we can obtain a matching donor drive, which we can almost all the time.

Stage 2 - This stage is the most severe and is only deemed a stage 2 if there is a significant amount of damage inside the drive. Normally it is if the drive has visible rings or scratches on the platters, or if there are heads missing then the drive would be classed as a stage 2.​

If a drive is at this stage then one donor won’t be enough, depending on how damaged the drive is we would have to use at least 2 donors, in some cases up to 5 or 6 but that’s only if the surface area is severely damaged. Normally if the rings aren’t visible on the platters then it would only be a stage 1 as it wouldn’t be anything too major only a few areas that can’t be read, but if there are visible rings then it suggests that the heads have dug into the platters so much that there is just nothing left. This is one of the most difficult circumstances for a mechanical recovery.

To conclude, mechanical recoveries are not easy to do which is why we have trained and highly experienced engineers who are quick at the job but are also extremely careful when handling the inside of your drive. There can be different levels of difficulty in performing mechanical rebuilds, but at R3 Data Recovery we adhere to give every mechanically failed drive the best possible chance of recovery.

Hard drive failures require immediate action. You need fast, secure results, and R3 offers the solutions you need to effectively maintain your data and system after any type of failure. Call us today at 0800 999 3282 to get started with your unique case.

Sector by Sector Data Recovery (RAW Recoveries)

​At R3 we get plenty of jobs that need data recovering in certain ways, whether it's a mechanical recovery (if a customer has most likely dropped the Hard drive), or if a drive has accumulated bad sectors due to its age/use of the drive. More often than not we get jobs that are sent to us which need data recovering that has either been deleted or overwritten, or if it has had an operating system installed over the top of it.

Normally if it's just deleted data then we would be able to search for the data easily after one simple scan from our recovery software (although the data may be damaged due to some sector changes with the files after they become deleted).

However, if it turns out the data has been overwritten or the drive has had a re-installed operating system, then we would have to delve deeper to find any trace of any of the customers data. So, to try and improve the accuracy of our findings we look for the file types that the customer requests using a sector by sector recovery (RAW recovery).​

What this means is that every individual sector is scanned for whichever file header(s) you have searched for​. One of the main problems with this type of recovery is that it will recover any file no matter how large as long as it has that file header it will recover it. So, it could be a file you deleted 5 years ago but if the file header is still there and it hasn't been overwritten it will recover it, but in most cases, these are corrupt as the rest of the files sectors have been overwritten by new data.​

Another downside with this recovery method is that it doesn't recover the names of the file but only the contents of the file which causes you to have numbered files e.g. 037654.jpg the number indicates the beginning sector of the file which is the sector where the file header will be located. In some cases, this is the only option that we have to have a chance of recovering the customers data.

RAW recovery of files - sector by sector

Is Imaging Hard Drives The Same As Cloning?

​Cloning a drive and imaging a drive are two processes that ultimately achieve the same outcome. Essentially they copy everything on the hard drive. Its possible to clone a disk by using a disk image, but the two are distinctly different in the process they use to copy hard drives. Disk cloning creates a functional drive-to-drive copy of the hard drive, while disk imaging creates an archive of a hard drive that can be used to make a drive-to-drive copy.

Cloning and Imaging Hard Drives

Both procedures are different than just copying and pasting everything from one hard drive to another. This is because when you copy and paste files from one drive to another you're copying only the actual files. This doesn’t include all the supplementary data the drive uses to locate and access those files. For instance it won’t obtain the master boot record. Basically a copy and paste backup drive wont boot.

​Disk Cloning

Disk cloning is the process of copying the entire contents of one hard drive to another including the additional data mentioned before that enables you to boot to the operating system from the drive.​

Cloning essentially allows you to make drive-to-drive copy of one of your computers hard drives on another hard drive. That second copy of the hard drive is completely functioning and can be instantly swapped with the computers existing hard drive and work as the intended. Basically a cloned drive is perfect to have and use in the event that something happens to your original such as a mechanical fault or a malicious virus finds its way on there.

​Disk ​Imaging

In comparison disk imaging is the procedure of creating a backup copy of the all the contents of a hard drive.​

Fundamentally the image is a storage file of sorts that contains all the data stored from the original hard drive and all the necessary data to boot to the operating system. The key difference however is the image needs to be installed to the hard drive in order to work. You can't reinstate a drive by just simply transferring image files on it.​

Here at R3 Data Recovery, in trying to explain this to customers, sometimes can cause confusion from customer’s perspective, when they receive their data back after the data has been recovered from an internal hard drive out of a PC or laptop. Basically because they think they can just hook up the external drive and continue the same as before the original drive failed. Without that supplementary data on there and an operating system this is not possible as mentioned previously.

Disk images are usually used for restoring a hard drives previous contents or transferring contents to a new hard drive. Or in our case at R3, it enables us to work freely and without worry on recovering certain data from a drives image. This is because if we didn’t image the customer​'s drive to a fresh drive and we were to work exclusively from the customers original drive even once repaired could easily fail again due it already being in a weakened state.

So ultimately there are differences between imaging and cloning hard drives. At R3 Data recovery we use both processes, and its useful to know that always imaging a drive as we do here at R3 is the best and most cautious approach to handling and hopefully recovering a customer’s precious data.

Hard drive failures require immediate action. You need fast, secure results, and R3 offers the solutions you need to effectively maintain your data and system after any type of failure. Call us today at 0800 999 3282 to get started with your unique case.

WannaCry Ransomware Attack - How To Recover Your Encrypted Files

During the recent publicity over the WannaCry ransomware attack I was in communication with a number of NHS clients who were asking how many enquiries were we getting.

The reality is the WannaCry ransomware attack was relatively insignificant other than the publicity it attracted and its interference with some services, not to downplay their impact but to put into perspective this attack was smaller in ransom value, ransoms paid and bigger in publicity possibly due to the state of the nation with regard to politics / manifestos / budgets and propaganda.

In terms of monetary value the ransoms were low. In terms of disruption to services it was not the Windows XP systems that were compromised it was the Win 7 and Server 2003 systems.

WannaCry ransomware attack

As a news item I was shocked at the publicity and panic mongering which seemed more politically motivated but I could be wrong, my observation is based on similar outbreaks in 2016 which knocked out entire cities and local authorities but were not publicised to the same extent.

We help the recovery process with ransomware decryption by first imaging drives sector by sector so that there is a second chance of recovery if anything goes wrong.

Don't forget encryption / decryption and malware / antivirus scanning can add extra risk to a storage device failing.

Get advice and assistance from Andy and the team at R3. R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

R3 are ICO registered and have been vetted by Hiscox Insurance for Cyberbreach and data disaster recovery claims assistance.

R3 is one of the few real data recovery labs in the UK and recognised by National Trading Standards forensics and NHS Trust Infrastructure managers as their data recovery rescue supplier.

R3 Data Recovery Ltd has imaging capacity onsite or in lab.

The lab can process imaging of upto 300TB per 24hrs in emergency situations.

We also can image factory / production computer system drives during shutdown periods to help with extending the life of SCADA / bespoke computer operating systems that are not networked or backed up.

R3 processed more successful recoveries of flood damaged ( submerged in effluent / flood water) drives in 2016 than any other british based data recovery lab.

R3 Data Recovery Ltd process Large scale IBM, HP, Dell, EMC, QNAP, Synology, RAID / SAN, VmWare HyperV and Drobo beyond RAID recoveries in Sheffield that our nearest competitors cannot undertake in the UK.

Dell RAID server recovery

The Danger of Head Crashes

During the normal operation of a hard drive the delicate read/write heads float over the rotating media. The arm that holds these heads is shaped almost like an aircraft wing to provide this lift. This novel approach reduces the overall mass of the delicate assembly allowing higher transfer speeds but also because there isn’t contact between the two components then the life span of the hard drive is greatly improved.

Rings on a hard drive after head crash

The media used in modern hard drives is a Cobalt Alloy which is very soft so is protected by a thin layer only microns in depth of a lubricant that acts as a buffer if the heads ever were forced onto the media due to misuse of the hard drive.

This condition is referred to as a head crash, and the media will survive a number of these during its normal working life. However if this crash is severe enough that a scratch is created then the debris will be picked up by the heads and dragged around causing more damage and so the condition can quickly escalate into a huge problem.

It is important that when a hard drive has been abused and the data contained is very important that the hard drive isn’t powered.

The constant power cycling in desperate attempts to access this data can reduce the chances of a successful recovery and in extreme case render the hard drive beyond repair.

R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

What's A Monolith?

This is a term used to describe a method of construction that encapsulates the electronic components in resin during manufacture; this resin then solidifies to form a solid in-assessable plastic block with just the gold connections visible.

This provides a barrier from dust and moisture and protects the delicate electronics but also provide a more robust device to make the casing thinner and therefore cheaper to manufacture.

The usual techniques used for recovery become severely reduced with very few cheap recovery options available.

R3 Monolith