***** 100% Data Recovery *****
If you classify yourself as a hardcore computer user, then at some point you certainly must have faced the problem of data loss. It could have happened either due to accidental deletion, file corruption, system crash, virus attacks, hard drive malfunctions or just because you dropped your laptop. Data loss occurs in a number of ways, so data recovery is done using various techniques, depending on the extent of the damage. Data loss can be broadly defined as an occurrence either due to data corruption or physical damage.
Companies like Stellar Information Systems Ltd. develop applications and offer services to help clients recover lost data. By the time you finish reading this story, you will have a good idea of how data can be recovered in a number of precarious scenarios, using a range of applications. In this story we also do a case study of how data is recovered from physically damaged storage media.
Since there are two main levels of recovery—software and hardware—we shall begin by solving less critical issues and then graduate to hardcore solutions. For simplification, we have organized this story into three stages. In stage one, we introduce a few data recovery tools for various application areas and describe how they function. In stage two, we elaborately discuss these tools and introduce data recovery at a hardware level. Finally in stage three, we describe the laboratory process where data recovery actually happens after opening up the hard drive.
CHIP visited Stellar Information Systems Ltd. in Gurgaon, to get details on data recovery for different storage media. We got glimpses of their clean room too. And then we met CEO, Sunil Chandna, Software Development Head, Kuljit Singh, and Director - Services, Manoj Dhingra. Interacting with them gave us deep insight on various aspects of data recovery. Let’s begin by taking a look at the various tools available on the Internet and in retail stores, and these include software solutions from Stellar.
What Stellar offers
Besides data recovery services, Stellar develops software solutions. We spoke to Amit Shukla, Sr. Software Manager, who told us about the different software solutions from Stellar. A detailed list of Stellar software is available at http://www.stellarinfo.com/. They offer software solutions for miscellaneous tasks. Their range of software includes data recovery software for FAT and NTFS file systems, file and e-mail recovery, deleted data recovery, retrieval of archives such as .ZIP file, pre-crash warning systems. Besides, it has solutions that repair damaged documents created in Microsoft Word, Excel and other applications. Well, there’s a lot more, and it’s all discussed in this story.
Stage 1
Restore deleted data: http://undelete-plus.com.
When data is deleted—and that includes emptying the Recycle Bin—it doesn’t get erased completely. It’s just that you cannot see it anymore, but it’s still present, unless other data is overwritten on the disk sector it occupies. Undelete Plus software launches itself from an external drive, such as a USB flash drive, to prevent overwriting. You can then recover the data using this application.
Simply select the drive letter and click on ‘Search’. The process takes some time, as much as 30 minutes to search a 250 GB hard drive. The search results are displayed in the main window and each result displays the status of the file. If it says, ‘very good’, it means the file is intact and fully recoverable. But if the result is otherwise, it means parts of the file are corrupted or have been overwritten, making the file irrecoverable.
“Do not use a canon to kill a mosquito” — Confucius: http://www.pcinspector.de.
Let’s say you need to recover certain pictures and videos. To do this, you don’t need to use high profile data recovery techniques. All you need are simple tools available on the Internet. For instance, the free version of PC-Inspector recovery tool lets you recover most image formats such as JPG and GIF, including proprietary formats such as DCR (Sony), NRF (Nokia) and ORF (Olympus). If that doesn’t work, then you can purchase an advanced version of the software online. So if the pictures were stored in a memory card or a USB flash drive, they can be recovered using this tool.
When recovering pictures, the program detects all the storage media attached to the computer and lists them for you to choose from the drop-down menu. All you have to do is specify the file format and the program will show you a thumbnail preview of the file to be recovered. Finally you need to specify the path where you need the recovered file to be stored.
Reconstructing lost partitions: http://www.diydatarecovery.nl/download.htm. At times your hard drive might not show up in Windows Explorer. This doesn’t mean that data is lost. In most cases, it is the partition table or the Master Boot Record (MBR) that cannot be read properly. This can easily be rectified with the help of a software called MBRtool 2.3.1. It recognizes the location of the partitions and reconstructs them based on the existing data structure.
----- 
A safer way to recover partitions and prevent data loss is to clone your hard drive on another drive of the same or higher capacity. You may use software called HD Clone 3.2 (http://www.miray.de/products/sat.hdclone.html), which will let you copy the hard drive, sector by sector—including the ones with errors.
E-mail recovery: Phoenix Outlook PST
If you’ve accidentally deleted e-mails from Microsoft Outlook, you can recover them using the application called Stellar Phoenix Outlook PST. It is also capable of repairing, recovering and restoring data from a corrupt PST file—the file that stores e-mails in Outlook. The application scans the hard drive for the PST file, repairs the corrupt file and finally saves it as a separate PST file. This enables retrieval of deleted/lost e-mails.
Stage 2
Here we would like to give you an idea of how data is recovered from different types of storage media, and which tools do the job. Companies like Stellar do have data recovery solutions for most types of media such as hard drives, USB flash drives, and optical media etc.
The tools we saw earlier are application-based and there is no tampering with hardware involved. We will discuss various storage media individually.
Hard drives: When there’s a problem with the file system, MBR (Master Boot Record), corrupt/missing partitions and data, deleted data or any other logical issue, the problem can be solved using various tools that a number of software companies offer. Some of them are available on the Internet for free. But the efficiency of the freeware depends on the severity of the problem. If there is a physical error, then no applications will be able to rectify it, and the drive will need to be professionally handled. In this case, experts need to examine the drive and attempt data recovery.
USB flash drives and floppy diskettes: Floppy disks are rarely used now. However, data can be recovered from floppies too using the same tools that are used for hard drives and flash drives. There are tools for repairing data on Zip disks, USB flash drives and media cards such as Memory Stick, SD card, MMC card, Compact Flash and so on. Stellar Phoenix Digital media recovery software works with all these types of digital media. It recovers photos from digital cameras and stored images, audio and video.
Amit Shukla, Sr. Software Manager at Stellar confirmed that data is also recoverable from physically damaged flash media. The chip is removed from the casing, repaired by professionals and then reconnected to a working circuit. From that point on, the software takes over and recovers the data.
Optical media: Recovering data from CDs and DVDs can be done with the help of software. When a disc gets scratched on the data side, the chances of data recovery are higher, as opposed to, when the scratch is on the label side. This is because data is actually written underneath the label side of the disc. The laser passes through the plastic coating on the data side and writes data on the opposite surface. The light scratches that appear on the surface can be done away with by buffing the surface.
Manoj Dhingra, Director Services at Stellar, explained how they use a proprietary chemical, which is first applied to the surface, stored for awhile, and then wiped off, resulting in a smooth surface. No more information was disclosed on how the buffing is done. After the media surface is buffed, data recovery is carried out with the help of software.
Stage 3
Software is of great help when your system detects the drive and if it is initialized. But if initialization fails, then there is something gravely wrong with the hardware. In this case the drive needs to be diagnosed for hardware errors.
During our visit to Stellar Infosystems, Manoj Dhingra gave us a tour of his laboratory. He explained how the whole recovery process happens through various stages. In the following paragraphs, you will hear about head transplants, platter alignment, spindle motors, fixing PCBs and many other technicalities. The diagnosis of a hard drive is done in two primary ways: external and internal. In either case, the drive needs to be taken into a ‘clean room’.
----- 
***** Our natural environment is classified as class 1,50,000 and the clean room is classified as class 100. There are three other classes (or air locks), which graduate from the former to the latter—class 20,000, class 10,000 and class 1,000. Lower the value of class, cleaner the environment. So before entering class 100, one has to go through three air locks.
Class 20,000: There are chances that you may carry accumulated static charge because you are wearing woolen or silk clothes. Hence on entering air lock unit two (class 20,000), one needs to wear an anti-static coat that contains a mesh of carbon woven inside the fabric which neutralizes static charge remaining on the body or on the clothes.
Class 100 and 1000: When the amount of dust particles in one cubic foot of environment (air) in the room is equal to or less than 1000, the environment (room) is called class 1000. Class 1000 must not have dust particles thicker than 1 micron.
Class 100 is measured in the same manner, but here, the thickness of the particles filters down to 0.5 microns—these particles can be sustained by exposed platters of a hard drive. Hence, this is the right environment for dismantling a hard drive.
Class 10,000-1000 (Initial diagnosis):
This is a room which toggles between class 10,000 and class 1000. Before opening up the hard drive, it is diagnosed for external errors.
Externally, the logic board (PCB) and the power connector are checked first. The PCB is analyzed at different stages in the circuit to check whether it is receiving power and functioning fine. Simultaneously, the power connector is checked for any internal faults. If one of them or both are faulty, then they are replaced and thereafter data recovery, from the faulty hard drive begins.
However, if the hard drive fails to initialize even if all the external parameters are passed, then its time to open up the drive and inspect what’s wrong with the internal mechanism.
The internal diagnosis is done by checking a number of parts, such as:
Spindle motor: The spindle motor is checked to see whether it’s receiving power and if the hard drive tries a spin up or not.
Media head assembly: The armature and head make up the media head assembly. This part is responsible for reading and writing of data. Analysis is done to check the movement of armature and if the head is able to locate a track on the platter. If unsuccessful, then something is wrong with the media head assembly.
The chassis: The chassis or the body of the drive is very important as it is specially designed to maintain controlled heat and air pressure. It is also responsible to prevent dust particles from entering the drive. So the chassis is examined to see if it is damaged or not.
The platters: This is the most important part in a hard drive because this is where data is stored. If this is physically damaged, there is no chance that the data can be recovered.
Replacement of Hardware: If the spindle motor is faulty, then the platters are carefully removed from the chassis. Special tools are used for this task to maintain alignment of the platters. The spindle motor is replaced, the platters are remounted and the drive is then sent to the class 1000 room for recovery.
If the media head assembly is faulty, then another one is taken from a working hard drive and transplanted into the faulty one. Of course, this is done after removing the platters (the transplanted part needs to be an exact match). After the transplantation, the alignment of the platters with the media head assembly needs to be checked properly. After this, the hard drive is powered up for initialization. If initialization is successful, then the drive is sent for data recovery.
If initialization is unsuccessful, the platters are closely examined for light/deep scratches. If there is a deep scratch on the platter, then data recovery is not possible with the currently available technology. However, if the scratch is light, then almost 100 percent of the data can be recovered, provided that the drive hasn’t been defraged or overwritten.
What is an air lock?
An air lock is a room with an environment where humidity, air pressure and dust particles are absolutely controlled by special filters, ducts, air jets, and air-conditioning.
Recovery: After all the hardware analysis and troubleshooting is over, the working hard drive is brought back to the class 1000 room from class 100. Here, the engineers use completely blank and virus-free machines to recover data from the repaired and now working drive. They use proprietary software—as shown above—to create an image of the drive onto another drive of the same or higher capacity. After creating an image, the data is then recovered from the second hard drive which is completely stable.
Finally the data is returned to the client on a DVD or any other media provided by the client. While speaking to Sunil Chandna at Stellar, we also learnt that their company has come a long way in extending services to forensics, government, law enforcement agencies and many such organizations which resort to such data recovery techniques. Even the entertainment industry has been tapped by Stellar. Data that comes into the lab for recovery, always remains highly classified and confidential.
| 
