Sector by Sector Data Recovery (RAW Recoveries)

​At R3 we get plenty of jobs that need data recovering in certain ways, whether it's a mechanical recovery (if a customer has most likely dropped the Hard drive), or if a drive has accumulated bad sectors due to its age/use of the drive. More often than not we get jobs that are sent to us which need data recovering that has either been deleted or overwritten, or if it has had an operating system installed over the top of it.

Normally if it's just deleted data then we would be able to search for the data easily after one simple scan from our recovery software (although the data may be damaged due to some sector changes with the files after they become deleted).

However, if it turns out the data has been overwritten or the drive has had a re-installed operating system, then we would have to delve deeper to find any trace of any of the customers data. So, to try and improve the accuracy of our findings we look for the file types that the customer requests using a sector by sector recovery (RAW recovery).​

What this means is that every individual sector is scanned for whichever file header(s) you have searched for​. One of the main problems with this type of recovery is that it will recover any file no matter how large as long as it has that file header it will recover it. So, it could be a file you deleted 5 years ago but if the file header is still there and it hasn't been overwritten it will recover it, but in most cases, these are corrupt as the rest of the files sectors have been overwritten by new data.​

Another downside with this recovery method is that it doesn't recover the names of the file but only the contents of the file which causes you to have numbered files e.g. 037654.jpg the number indicates the beginning sector of the file which is the sector where the file header will be located. In some cases, this is the only option that we have to have a chance of recovering the customers data.

RAW recovery of files - sector by sector

Is Imaging Hard Drives The Same As Cloning?

​Cloning a drive and imaging a drive are two processes that ultimately achieve the same outcome. Essentially they copy everything on the hard drive. Its possible to clone a disk by using a disk image, but the two are distinctly different in the process they use to copy hard drives. Disk cloning creates a functional drive-to-drive copy of the hard drive, while disk imaging creates an archive of a hard drive that can be used to make a drive-to-drive copy.

Cloning and Imaging Hard Drives

Both procedures are different than just copying and pasting everything from one hard drive to another. This is because when you copy and paste files from one drive to another you're copying only the actual files. This doesn’t include all the supplementary data the drive uses to locate and access those files. For instance it won’t obtain the master boot record. Basically a copy and paste backup drive wont boot.

​Disk Cloning

Disk cloning is the process of copying the entire contents of one hard drive to another including the additional data mentioned before that enables you to boot to the operating system from the drive.​

Cloning essentially allows you to make drive-to-drive copy of one of your computers hard drives on another hard drive. That second copy of the hard drive is completely functioning and can be instantly swapped with the computers existing hard drive and work as the intended. Basically a cloned drive is perfect to have and use in the event that something happens to your original such as a mechanical fault or a malicious virus finds its way on there.

​Disk ​Imaging

In comparison disk imaging is the procedure of creating a backup copy of the all the contents of a hard drive.​

Fundamentally the image is a storage file of sorts that contains all the data stored from the original hard drive and all the necessary data to boot to the operating system. The key difference however is the image needs to be installed to the hard drive in order to work. You can't reinstate a drive by just simply transferring image files on it.​

Here at R3 Data Recovery, in trying to explain this to customers, sometimes can cause confusion from customer’s perspective, when they receive their data back after the data has been recovered from an internal hard drive out of a PC or laptop. Basically because they think they can just hook up the external drive and continue the same as before the original drive failed. Without that supplementary data on there and an operating system this is not possible as mentioned previously.

Disk images are usually used for restoring a hard drives previous contents or transferring contents to a new hard drive. Or in our case at R3, it enables us to work freely and without worry on recovering certain data from a drives image. This is because if we didn’t image the customer​'s drive to a fresh drive and we were to work exclusively from the customers original drive even once repaired could easily fail again due it already being in a weakened state.

So ultimately there are differences between imaging and cloning hard drives. At R3 Data recovery we use both processes, and its useful to know that always imaging a drive as we do here at R3 is the best and most cautious approach to handling and hopefully recovering a customer’s precious data.

Hard drive failures require immediate action. You need fast, secure results, and R3 offers the solutions you need to effectively maintain your data and system after any type of failure. Call us today at 0800 999 3282 to get started with your unique case.

WannaCry Ransomware Attack - How To Recover Your Encrypted Files

During the recent publicity over the WannaCry ransomware attack I was in communication with a number of NHS clients who were asking how many enquiries were we getting.

The reality is the WannaCry ransomware attack was relatively insignificant other than the publicity it attracted and its interference with some services, not to downplay their impact but to put into perspective this attack was smaller in ransom value, ransoms paid and bigger in publicity possibly due to the state of the nation with regard to politics / manifestos / budgets and propaganda.

In terms of monetary value the ransoms were low. In terms of disruption to services it was not the Windows XP systems that were compromised it was the Win 7 and Server 2003 systems.

WannaCry ransomware attack

As a news item I was shocked at the publicity and panic mongering which seemed more politically motivated but I could be wrong, my observation is based on similar outbreaks in 2016 which knocked out entire cities and local authorities but were not publicised to the same extent.

We help the recovery process with ransomware decryption by first imaging drives sector by sector so that there is a second chance of recovery if anything goes wrong.

Don't forget encryption / decryption and malware / antivirus scanning can add extra risk to a storage device failing.

Get advice and assistance from Andy and the team at R3. R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

R3 are ICO registered and have been vetted by Hiscox Insurance for Cyberbreach and data disaster recovery claims assistance.

R3 is one of the few real data recovery labs in the UK and recognised by National Trading Standards forensics and NHS Trust Infrastructure managers as their data recovery rescue supplier.

R3 Data Recovery Ltd has imaging capacity onsite or in lab.

The lab can process imaging of upto 300TB per 24hrs in emergency situations.

We also can image factory / production computer system drives during shutdown periods to help with extending the life of SCADA / bespoke computer operating systems that are not networked or backed up.

R3 processed more successful recoveries of flood damaged ( submerged in effluent / flood water) drives in 2016 than any other british based data recovery lab.

R3 Data Recovery Ltd process Large scale IBM, HP, Dell, EMC, QNAP, Synology, RAID / SAN, VmWare HyperV and Drobo beyond RAID recoveries in Sheffield that our nearest competitors cannot undertake in the UK.

Dell RAID server recovery

The Danger of Head Crashes

During the normal operation of a hard drive the delicate read/write heads float over the rotating media. The arm that holds these heads is shaped almost like an aircraft wing to provide this lift. This novel approach reduces the overall mass of the delicate assembly allowing higher transfer speeds but also because there isn’t contact between the two components then the life span of the hard drive is greatly improved.

Rings on a hard drive after head crash

The media used in modern hard drives is a Cobalt Alloy which is very soft so is protected by a thin layer only microns in depth of a lubricant that acts as a buffer if the heads ever were forced onto the media due to misuse of the hard drive.

This condition is referred to as a head crash, and the media will survive a number of these during its normal working life. However if this crash is severe enough that a scratch is created then the debris will be picked up by the heads and dragged around causing more damage and so the condition can quickly escalate into a huge problem.

It is important that when a hard drive has been abused and the data contained is very important that the hard drive isn’t powered.

The constant power cycling in desperate attempts to access this data can reduce the chances of a successful recovery and in extreme case render the hard drive beyond repair.

R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

What's A Monolith?

This is a term used to describe a method of construction that encapsulates the electronic components in resin during manufacture; this resin then solidifies to form a solid in-assessable plastic block with just the gold connections visible.

This provides a barrier from dust and moisture and protects the delicate electronics but also provide a more robust device to make the casing thinner and therefore cheaper to manufacture.

The usual techniques used for recovery become severely reduced with very few cheap recovery options available.

R3 Monolith

What are Your Chances for a Successful Data Recovery?

Western Digital 2TB no heads

Here at R3 Data Recovery we recover from all types of storage devices from USBs and hard drives to massive servers containing 10's to 100's of hard drives. But when our customers call us many of them ask the same question: "What are the chances of my data being recoverable?".

Now with this question there isn't a definite answer over the phone. The answer will only be found out once the device has arrived at our lab. The only thing we can do is to get you, the customer to give the best description as possible to one of our sales members so that can give you some sort of idea of the failure.

Also, we strongly recommend that once the drive has failed you do not do anything with it. Constantly powering it on and off can cause serious damage inside making the situation much worse and making the data harder to get back. The less you do to try and get the drive working the better situation the drive will be in when it arrives with us.

Even with logical recoveries, even though the drive hasn't failed the less you do the better. Because the more you research and the more software you download creates a higher chance that the data you deleted has now been overwritten and is gone.

So, before you lose everything get in contact with us by giving us a ring on 0800 999 3282 or filling out the online diagnostics form. Our technicians will be able to give you a free over the phone quote and assessment.

Broken Memory Stick - USB Data Recovery Services

USB memory sticks are a very convenient way of keeping your data close to you as you move from one place to another. Teachers/lecturers and students especially but anyone who moves from computer to computer need a way to keep their data with them. USB drives, memory sticks, pen drives (call them what you will), are a very convenient and easy way to keep your data with you while you move around.

Cloud storage is all good and well but USB sticks are just so easy to use. No installing of cloud storage apps, no waiting until the data syncs on a new PC you haven't used before, no logging into a web site... Plug and play - its just so convenient.

Simple though comes with its own dangers. USB devices are very much prone to failure that users are not advised of when they purchase them.

Snapped USB stick

The various components on the devices are very robust but they have weak points:

  • Physical damge - Where do we start?
  • The dog chewed my memory stick.
  • It snapped while it was plugged into my laptop.
  • I ran over it with my car.
  • We have seen them all.

Non-physical Damage

Sometimes these devices will just stop working, this is normally caused by an electronic component failure.

In most cases the controller chip fails, of course the device will not be useable and may behave in the following way:

  • It may show/register on your computer but not be accessible.
  • Not be detected on your computer at all.
  • Get very hot when you plug the device in.

Physical Damage

Physical damage is just that, it has been damaged by someone or something accidentally. It is also equally impossible to predict when the controller might fail but what isn't impossible is getting the data back, not for our engineers at R3.

If your device doesn't behave as it should contact our team of experts at 0800 999 3282. Our skilled professionals will be able to reliably recover data on your USB stick and provide industry-leading turnaround times which give you the confidence that's necessary to develop a solid, effective recovery plan.

Its Absolutely Impossible To Recover Your Data

​At R3 Data Recovery Ltd we endeavour to always reach a positive outcome for each and every job that comes into the lab on a daily basis. But on occasion some jobs are just too severely damaged to be recovered.

For instance, a hard drive can suffer a head crash, platter damage, or a spindle motor problem. At R3 we commonly classify issues such as these as mechanical failures. Mechanical failures are some of the most complex problems associated with hard drives and quite often can be recovered, providing the client are willing and able to understand the drive needs multiple donors and extreme attention to rebuilding the drive and getting it to function as it once did before it was physically damaged.

However as mentioned before, from time to time the damage is so extreme it is beyond rescue no matter how much money the client is willing to donate to donors, or how skilled or dedicated the engineer tasked with recovering the hard drive is.

Smashed hard drive platters

A few examples of this we see regularly at R3 are that the customer has dropped their hard drive whilst using it from their desk, or similarly the customer has dropped their laptop whilst moving with it from a decent height. 

The primary reason for the data not being recoverable in these cases is that the hard drive inside the external enclosure or the laptop has platters made of glass that can shatter easily when the hard drive chassis suffers blunt trauma. Once the platter is shattered there is no way whatsoever to get the data back.

Another example of major damage is when the platters of the hard disk have been scratched by the read/write arm of the drive. This usually happens when anxious users try to start the computer/laptop again and again after the hard drive has failed (commonly caused by dropping it). Contrary to what most people may think when the drive crashes,
its read/write arm still rests on the platters and damages it when the drive starts to spin, causing deep scoring on the surface and visible rings.

An additional example could be due to the overheating. This is not that common in all honesty, especially with jobs that come into the R3 lab, but it is still a valid issue. Basically, the platters, after being used for a sustained period of time become expanded, not too hard to imagine when The faster hard drives come with rates of speed of 10,000 RPM, and ultimately the magnetic surface area on the platters will get damaged, which results in a loss of data files. If the physical area of the platters are damaged, it will result in unreadable sectors.

Other parts of hard drives that can be overwhelmed due to overheating, are the heads. It is important to remember that hard drives are extremely sophisticated collections of components, and just can’t tolerate overheating.

As outlined at the start of this article, the talented and dedicated engineers here at R3 always strive to garner a positive result when attempting to recover a hard drive. Even in some cases where the damage was so severe it was declared unrecoverable by other data recovery companies, we have managed to recover the data.

However, there will always be the unwanted possibility that a certain hard drive is beyond repair and it is absolutely impossible to recover the data. And this is something important to understand and hopefully accept from a client’s perspective, as everyone at R3 always wants to recover every job successfully, not just for professional gratification, but for the most important reason of all, for the customers happiness.

After all that personal data could be something small or sentimental or it could be someone’s entire life or livelihood. R3 Data recovery ultimately never loses sight of that.

UK data recovery companies

If you understand that technically anyone can attempt the recovery of data with software for situations such as:

Then the search online for data recovery software and services can yield hundreds of potential websites.

But software recoveries performed on failing drives; whilst very profitable if successful is all too often catastrophic to the drives heads and more importantly damaging to the platters where data is stored.

Always use a real British data recovery lab. Beware of misrepresentation. R3 Data Recovery Ltd is a British owned, British built and British funded world class data recovery lab.

When picking a real data recovery lab to help you - pick R3 - we offer a genuine, high success rate, affordable service and can actually save you money because we are better equipped and better experienced.

To visit a real live data recovery lab for a free assessment and clear pricing contact the team at R3.

What is Cheap data recovery

This is one of those posts that tells of the successes achieved but really should be a statement of how the R3 team keep their lab capacity efficient and productive.

R3 data recovery engineers maximise the success rates at a cost lower than some organisations charge for their “forensic” software data recovery. Today any computer software user can download and retrieve data if the storage device is not damaged or faulty.

15 years ago before I built the UKs most technically proficient and efficient high capacity lab and located it in Sheffield the average cost of a recovery of a failed drive was £2500+vat and the average drive was below 5GB capacity with only a handful of real DR companies in the UK but lots of resellers and partners.

Today the average drive capacity is over 1TB and the average cost is below £500 for a failed drive.

R3 software recovery / data transfer and memory stick repairs started at £79+vat but now with data protection legislation and growing capacity of drives and of memory sticks and SSD it’s more often £129+vat

Some worse case complex cases requiring multiple rebuilds can cost thousands of pounds but they are rare and often caused by running software when it’s impossible to solve without an engineer and a dr lab full of equipment.

The problem for consumers is one of seeing through Internet misinformation. This came with the rise of the internet marketing gurus backed years ago by government, European and Welsh assembly grants to create jobs in an unemployment black spot.  A good idea at the time but damaging to thousands of consumers and businesses.

They quote £97 or £99 for a recovery, but it’s not a real price for a recovery of a failed drive or memory stick. It is for the equivalent of a software recovery you can do yourself on deleted files or accidently formatted drives for the cost of the software at less than £40.

It’s a risky situation picking the wrong data recovery specialists. Physical data recovery requires expensive equipment, time served electo mechanical DR engineers and determination. But don’t get the wrong idea cheap data recovery does exist, but to recognise it you need to know the real costs.

To be competitive and innovative requires a scale and a balance and a grip on reality - the realisation that cheap data recovery could be nothing more than a scam to take money for doing nothing. Often declaring a drive unrecoverable if it’s complex or attempt to extract the most money possible from easy to do work.

As a one man operation 15 years ago my efficiency and productivity on a difficult head crashed, platter damaged drive declared unrecoverable by a global operation if applied today would mean I would be out of business in an hour. It took 18 hours a day for the best part of a month to manually track the heads, manage the heads in bad areas and recover the intact areas of the platters just to get a few GB.

The cost per GB was high and if applied today I would not be worrying about the ever increasing amount of data, processing time and electricity cost - I would be making millions from very little investment rather than spending a £million to offer a sub £700 data recovery service and doing well to make a living and break even.

This is why many competitors who quote sub £150 services have failed to bring any real changes to the technology or unique solutions needed to progress a recovery of a truly failed drive. There is no investment and no incentive.

They are software jockeys charging R&D prices for simple software recoveries….  And it’s very lucrative to work that way.

Worse some have misled consumers and businesses and competitors alike into believing their claims of being number 1, or industry leading but in reality they operate in a way that is fraudulent. And it has destroyed true competition and innovation——well up to a point.

R3 Data Recovery Ltd was founded on the same premis as my first DR operation abc Data Recovery Ltd which first Developed Security House and delivered the UKs first independent high capacity data recovery lab in 2007 after 7 years of planning.

At that point the Internet marketeers and Pay Per Click meant that those who could advertise best online received more enquiries. £97 data recovery was a marketing success but thousands were told their damaged drives data were unrecoverable at any cost and unfortunately as a result of helping consumers, charities and businesses scammed by a competitor my operations were compromised and I nearly died from injuries sustained during being served a HCI served on me and others which later was proven to be secured under false pretences and a perjured affidavit.

The profit made from scams is in the £800-£1500 range basically inflated / extortionate charges for software recoveries. A  real data recovery lab  does not really want software recoveries because it’s an IT support type task and does not require the investment or present the challenges real data recovery engineers need to keep them motivated.

A real Data Recovery lab as is the case with R3 has to had to invest at least £100,000 per lead engineer in terms of equipment and each engineer has at least a decade of experience - to be efficient today each engineer has a few assistants to help find and test donors,  help with data transfers and file listing reports, wiping images and keeping equipment serviceable to maximise production.

Very few data recovery labs have true R&D specialists like those found in R3. With industry leading UK based engineers recruited from well known data recovery operations accross the UK and Europe the Security House lab delivers a realcost effective data recovery option used in disasters such as floods, power outages or drops and knocks.

Although it is important to maintain the labs commitment to R&D to keep up with the development of techniques used today. It is done by bringing solutions quickly to hundreds of clients developed initially from just the first to have the misfortune.

The current Seagate 8TB drives coming in would have been only a decade ago difficult to imagine finding a solution for when 500GB drives were the largest and most difficult to recover at the time. But for every problem there is a solution.

The big issue is the quantities of data and therefor the processing time needed. The average weekly terabytes recovered in the first 2 months of 2015 was 30 TB. But represented almost 50TB of imaging. A year later and it’s doubled.

In 2007 I built a server room that at the time had 60TB of temporary storage and if the same methods were used today I would need 1200 TB. I needed better methods to manage the recovery processing and secure wiping of drives and ways to keep costs down.

Today the server room has just one of the original racks and still has over 60 TB of temporary storage but that’s just for memory sticks and relatively small amounts of temporary storage.

The big growth in DR is from memory sticks, SSD and servers, in particular cloud based solutions such as virtual servers.

The largest RAID array recovered during 2015 was 55 TB it was one storage unit with several RAID 5 volumes, numerous VM’s and interlinked databases between virtual servers. In 2016 we will see arrays with ten times that storage capacity fail despite backups and redundancy and it affects dozens or even hundreds of virtual servers and 10,000 of users.

Pricing of data recovery many years ago was per GB because of the physical processing time cost. Today some DR operations advertise “no per GB charges”  but the reality is much of the average cost calculations are based on Terabytes..  When finding a “real cost of data recovery” you need to be aware that any company advertising a sub £150 data recovery service is really quoting the data transfer portion of the cost for an amount of data that can transfer in say a day. Not the true recovery cost and associated donor(s) cleanroom and other tasks needed.

R3 give an accurate cost of the full recovery at the time of quoting wherever possible.

The true cost of data recovery has come down in real terms in the last 15 years but the margins are tighter and the disparity of success rates greater.

Look for genuine reviews and when comparing like for like be aware R3 do not advertise who their clients are. We are under NDA and confidentiality agreements with government bodies, financial institutions, mod contractors, trading standards investigators, solicitors, barristers, data controllers, hospital trusts, manufacturers, musicians, writers, developers and individuals. Recovering data is our remit and any praise from a client helps with the working day but we remain dedicated to confidentiality and dedication to the highest possible success rates in the world.