A Retro Moment - Toshiba MK1403MAV Recovery

At R3 Data Recovery we deal with many types of storage devices, consumers need to backup more and more data now the access to music and photography is easier with electronic goods such as mobile phones.

With the trend towards faster, higher capacity and more compact hard drives, it's nice to change the pace a little and work with something from a little earlier.

Toshiba MK1403MAV circa 1997 with a capacity of 1.4GB was such a case, a small 2.5” laptop style hard drive with an IDE interface. Probably a proud moment for the Toshiba engineers to break the 1GB barrier and it was used in many computer based devices from that era.

Thankfully the hard drive was recovered with only a handful of bad sectors and the client was over the moon, but testament to Toshiba engineers also who did a good job 20 years ago.

Toshiba MK1403MAV In The Lab

A Customers Perspective: Extreme Anxiety to Elation in 48 Hours

I am a fashion photographer and I was on location shooting in Italy when one of my hard drives with my current work got damaged. It was showing the catalogue and list of names of the folders but not showing any of the images inside those files but still showed that I had used 500 GB of storage.​

I tried it in any computer and MacBook (It is a mac hard drive) I could get my hands on. I then started to panic because the computer would freeze when I tried to open it and on some computers it wouldnt read the hard drive at all.​

R3 Emergency Recovery Specialists in the UK

In a crying panic frenzy I googled data recovery UK and found an emergency number for a man called Andy Butler at R3 Data Recovery who soon became my favourite person in the world.

I was ever so slightly hysterical on the phone and he managed to calm me down and got me to explain what had happened and explained that it was likely to be an issue with the signalling between the catalogue and the data itself.​

I wasn't due back in the UK for another 4 days and was trying to think of what I could do or how I could get the HDD to him before then. I decided to book an emergency flight home the next morning because I couldnt sit and do nothing, especially not knowing how serious the situation could be.​

I flew to London and got a train straight to Sheffield where I was met by Andy and his charming driver who took me straight to their lab where I promised not to cry or touch anything and sat in the corner hoping they could work their magic. They sent me off for a few hours and said they would call me hourly with an update.​

I have to state that I initially called him on a Saturday night in a mess emotionally and this was Monday morning so I was like most creative people I know, quite last minute but he made time for me.

He told me there was a problem with the heads of a hard drive (I gained a lot of knowledge of the ins and outs of data and hardware that day) and they were replacing them with other heads and coding to try and talk to the data.​

Long story short after a couple of tantrums, lots of tears, travelling over 2500 km Andy and his team of geniuses managed to rescue all of my images in one day and they were all in order and in the correct files (I have been told sometimes when rescuing data it can get mixed up and in the wrong order/ folder).

I put all my work and faith in his hands and he didn't let me down and was completely charming and wonderful from start to finish of my mini meltdown data lost and found experience. What a brilliant man. I am so happy I found R3 data recovery but in the nicest way possible I hope I won't have to see them again too soon and that my technology will all be ok and my backups wont fail!

It did cost me £1000 (because I needed 2 new hard drives and I needed it all doing in 1 day and most people allow 7-10 days) but you can't put a price on your career and other clients work and it was worth every penny. I am so very grateful that he went above and beyond to help me and was at the end of the phone with every question I had.

Amelia - London

Get advice and assistance from Andy and the team at R3. R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

How Easy Are Mechanical Recoveries?

​Any job that arrives here at R3 Data Recovery that is diagnosed as having a mechanical fault, needs to be left untouched and not powered up again until a rebuild has been performed on the drive. In almost all cases, having a mechanically failed drive means that a head swap is needed, so we would need to source for a matching donor that has working heads and swap the heads from both drives.

R3 hard drive heads and platters

​There are two stages of mechanical recoveries:

Stage 1 - This stage is less severe of the two and should only require one donor. This stage is for if the drive has what the engineers at R3 refer to as stiction, this is basically where the read/write heads stick to the platters. Once the heads have stuck to the platters, the disk can be prevented from spinning up and can cause physical damage to the platter and ultimately the data stored on the disk.​

Another situation that falls under this stage are if the heads are slightly bent or damaged due to the drive being dropped. In most cases we can recover the data when the drive is at a stage 1 providing of course that we can obtain a matching donor drive, which we can almost all the time.

Stage 2 - This stage is the most severe and is only deemed a stage 2 if there is a significant amount of damage inside the drive. Normally it is if the drive has visible rings or scratches on the platters, or if there are heads missing then the drive would be classed as a stage 2.​

If a drive is at this stage then one donor won’t be enough, depending on how damaged the drive is we would have to use at least 2 donors, in some cases up to 5 or 6 but that’s only if the surface area is severely damaged. Normally if the rings aren’t visible on the platters then it would only be a stage 1 as it wouldn’t be anything too major only a few areas that can’t be read, but if there are visible rings then it suggests that the heads have dug into the platters so much that there is just nothing left. This is one of the most difficult circumstances for a mechanical recovery.

To conclude, mechanical recoveries are not easy to do which is why we have trained and highly experienced engineers who are quick at the job but are also extremely careful when handling the inside of your drive. There can be different levels of difficulty in performing mechanical rebuilds, but at R3 Data Recovery we adhere to give every mechanically failed drive the best possible chance of recovery.

Hard drive failures require immediate action. You need fast, secure results, and R3 offers the solutions you need to effectively maintain your data and system after any type of failure. Call us today at 0800 999 3282 to get started with your unique case.

Sector by Sector Data Recovery (RAW Recoveries)

​At R3 we get plenty of jobs that need data recovering in certain ways, whether it's a mechanical recovery (if a customer has most likely dropped the Hard drive), or if a drive has accumulated bad sectors due to its age/use of the drive. More often than not we get jobs that are sent to us which need data recovering that has either been deleted or overwritten, or if it has had an operating system installed over the top of it.

Normally if it's just deleted data then we would be able to search for the data easily after one simple scan from our recovery software (although the data may be damaged due to some sector changes with the files after they become deleted).

However, if it turns out the data has been overwritten or the drive has had a re-installed operating system, then we would have to delve deeper to find any trace of any of the customers data. So, to try and improve the accuracy of our findings we look for the file types that the customer requests using a sector by sector recovery (RAW recovery).​

What this means is that every individual sector is scanned for whichever file header(s) you have searched for​. One of the main problems with this type of recovery is that it will recover any file no matter how large as long as it has that file header it will recover it. So, it could be a file you deleted 5 years ago but if the file header is still there and it hasn't been overwritten it will recover it, but in most cases, these are corrupt as the rest of the files sectors have been overwritten by new data.​

Another downside with this recovery method is that it doesn't recover the names of the file but only the contents of the file which causes you to have numbered files e.g. 037654.jpg the number indicates the beginning sector of the file which is the sector where the file header will be located. In some cases, this is the only option that we have to have a chance of recovering the customers data.

RAW recovery of files - sector by sector

Is Imaging Hard Drives The Same As Cloning?

​Cloning a drive and imaging a drive are two processes that ultimately achieve the same outcome. Essentially they copy everything on the hard drive. Its possible to clone a disk by using a disk image, but the two are distinctly different in the process they use to copy hard drives. Disk cloning creates a functional drive-to-drive copy of the hard drive, while disk imaging creates an archive of a hard drive that can be used to make a drive-to-drive copy.

Cloning and Imaging Hard Drives

Both procedures are different than just copying and pasting everything from one hard drive to another. This is because when you copy and paste files from one drive to another you're copying only the actual files. This doesn’t include all the supplementary data the drive uses to locate and access those files. For instance it won’t obtain the master boot record. Basically a copy and paste backup drive wont boot.

​Disk Cloning

Disk cloning is the process of copying the entire contents of one hard drive to another including the additional data mentioned before that enables you to boot to the operating system from the drive.​

Cloning essentially allows you to make drive-to-drive copy of one of your computers hard drives on another hard drive. That second copy of the hard drive is completely functioning and can be instantly swapped with the computers existing hard drive and work as the intended. Basically a cloned drive is perfect to have and use in the event that something happens to your original such as a mechanical fault or a malicious virus finds its way on there.

​Disk ​Imaging

In comparison disk imaging is the procedure of creating a backup copy of the all the contents of a hard drive.​

Fundamentally the image is a storage file of sorts that contains all the data stored from the original hard drive and all the necessary data to boot to the operating system. The key difference however is the image needs to be installed to the hard drive in order to work. You can't reinstate a drive by just simply transferring image files on it.​

Here at R3 Data Recovery, in trying to explain this to customers, sometimes can cause confusion from customer’s perspective, when they receive their data back after the data has been recovered from an internal hard drive out of a PC or laptop. Basically because they think they can just hook up the external drive and continue the same as before the original drive failed. Without that supplementary data on there and an operating system this is not possible as mentioned previously.

Disk images are usually used for restoring a hard drives previous contents or transferring contents to a new hard drive. Or in our case at R3, it enables us to work freely and without worry on recovering certain data from a drives image. This is because if we didn’t image the customer​'s drive to a fresh drive and we were to work exclusively from the customers original drive even once repaired could easily fail again due it already being in a weakened state.

So ultimately there are differences between imaging and cloning hard drives. At R3 Data recovery we use both processes, and its useful to know that always imaging a drive as we do here at R3 is the best and most cautious approach to handling and hopefully recovering a customer’s precious data.

Hard drive failures require immediate action. You need fast, secure results, and R3 offers the solutions you need to effectively maintain your data and system after any type of failure. Call us today at 0800 999 3282 to get started with your unique case.

WannaCry Ransomware Attack - How To Recover Your Encrypted Files

During the recent publicity over the WannaCry ransomware attack I was in communication with a number of NHS clients who were asking how many enquiries were we getting.

The reality is the WannaCry ransomware attack was relatively insignificant other than the publicity it attracted and its interference with some services, not to downplay their impact but to put into perspective this attack was smaller in ransom value, ransoms paid and bigger in publicity possibly due to the state of the nation with regard to politics / manifestos / budgets and propaganda.

In terms of monetary value the ransoms were low. In terms of disruption to services it was not the Windows XP systems that were compromised it was the Win 7 and Server 2003 systems.

WannaCry ransomware attack

As a news item I was shocked at the publicity and panic mongering which seemed more politically motivated but I could be wrong, my observation is based on similar outbreaks in 2016 which knocked out entire cities and local authorities but were not publicised to the same extent.

We help the recovery process with ransomware decryption by first imaging drives sector by sector so that there is a second chance of recovery if anything goes wrong.

Don't forget encryption / decryption and malware / antivirus scanning can add extra risk to a storage device failing.

Get advice and assistance from Andy and the team at R3. R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

R3 are ICO registered and have been vetted by Hiscox Insurance for Cyberbreach and data disaster recovery claims assistance.

R3 is one of the few real data recovery labs in the UK and recognised by National Trading Standards forensics and NHS Trust Infrastructure managers as their data recovery rescue supplier.

R3 Data Recovery Ltd has imaging capacity onsite or in lab.

The lab can process imaging of upto 300TB per 24hrs in emergency situations.

We also can image factory / production computer system drives during shutdown periods to help with extending the life of SCADA / bespoke computer operating systems that are not networked or backed up.

R3 processed more successful recoveries of flood damaged ( submerged in effluent / flood water) drives in 2016 than any other british based data recovery lab.

R3 Data Recovery Ltd process Large scale IBM, HP, Dell, EMC, QNAP, Synology, RAID / SAN, VmWare HyperV and Drobo beyond RAID recoveries in Sheffield that our nearest competitors cannot undertake in the UK.

Dell RAID server recovery

The Danger of Head Crashes

During the normal operation of a hard drive the delicate read/write heads float over the rotating media. The arm that holds these heads is shaped almost like an aircraft wing to provide this lift. This novel approach reduces the overall mass of the delicate assembly allowing higher transfer speeds but also because there isn’t contact between the two components then the life span of the hard drive is greatly improved.

Rings on a hard drive after head crash

The media used in modern hard drives is a Cobalt Alloy which is very soft so is protected by a thin layer only microns in depth of a lubricant that acts as a buffer if the heads ever were forced onto the media due to misuse of the hard drive.

This condition is referred to as a head crash, and the media will survive a number of these during its normal working life. However if this crash is severe enough that a scratch is created then the debris will be picked up by the heads and dragged around causing more damage and so the condition can quickly escalate into a huge problem.

It is important that when a hard drive has been abused and the data contained is very important that the hard drive isn’t powered.

The constant power cycling in desperate attempts to access this data can reduce the chances of a successful recovery and in extreme case render the hard drive beyond repair.

R3 Data Recovery is real lab that deals with real disasters each an every day. If you have any sort of problem with a hard drive or any data storage device, we are the people to contact. Call us today on 0800 999 3282 for immediate help and assistance.

What's A Monolith?

This is a term used to describe a method of construction that encapsulates the electronic components in resin during manufacture; this resin then solidifies to form a solid in-assessable plastic block with just the gold connections visible.

This provides a barrier from dust and moisture and protects the delicate electronics but also provide a more robust device to make the casing thinner and therefore cheaper to manufacture.

The usual techniques used for recovery become severely reduced with very few cheap recovery options available.

R3 Monolith

What are Your Chances for a Successful Data Recovery?

Western Digital 2TB no heads

Here at R3 Data Recovery we recover from all types of storage devices from USBs and hard drives to massive servers containing 10's to 100's of hard drives. But when our customers call us many of them ask the same question: "What are the chances of my data being recoverable?".

Now with this question there isn't a definite answer over the phone. The answer will only be found out once the device has arrived at our lab. The only thing we can do is to get you, the customer to give the best description as possible to one of our sales members so that can give you some sort of idea of the failure.

Also, we strongly recommend that once the drive has failed you do not do anything with it. Constantly powering it on and off can cause serious damage inside making the situation much worse and making the data harder to get back. The less you do to try and get the drive working the better situation the drive will be in when it arrives with us.

Even with logical recoveries, even though the drive hasn't failed the less you do the better. Because the more you research and the more software you download creates a higher chance that the data you deleted has now been overwritten and is gone.

So, before you lose everything get in contact with us by giving us a ring on 0800 999 3282 or filling out the online diagnostics form. Our technicians will be able to give you a free over the phone quote and assessment.

Broken Memory Stick - USB Data Recovery Services

USB memory sticks are a very convenient way of keeping your data close to you as you move from one place to another. Teachers/lecturers and students especially but anyone who moves from computer to computer need a way to keep their data with them. USB drives, memory sticks, pen drives (call them what you will), are a very convenient and easy way to keep your data with you while you move around.

Cloud storage is all good and well but USB sticks are just so easy to use. No installing of cloud storage apps, no waiting until the data syncs on a new PC you haven't used before, no logging into a web site... Plug and play - its just so convenient.

Simple though comes with its own dangers. USB devices are very much prone to failure that users are not advised of when they purchase them.

Snapped USB stick

The various components on the devices are very robust but they have weak points:

  • Physical damge - Where do we start?
  • The dog chewed my memory stick.
  • It snapped while it was plugged into my laptop.
  • I ran over it with my car.
  • We have seen them all.

Non-physical Damage

Sometimes these devices will just stop working, this is normally caused by an electronic component failure.

In most cases the controller chip fails, of course the device will not be useable and may behave in the following way:

  • It may show/register on your computer but not be accessible.
  • Not be detected on your computer at all.
  • Get very hot when you plug the device in.

Physical Damage

Physical damage is just that, it has been damaged by someone or something accidentally. It is also equally impossible to predict when the controller might fail but what isn't impossible is getting the data back, not for our engineers at R3.

If your device doesn't behave as it should contact our team of experts at 0800 999 3282. Our skilled professionals will be able to reliably recover data on your USB stick and provide industry-leading turnaround times which give you the confidence that's necessary to develop a solid, effective recovery plan.