data recovery further options

[Jet-Fighter7700]

best way to destroy a HDD with sensitive info is to melt it. So same way metal is recycled. 2 birds with one stone.

That also works well I suppose,

But those shredding companies, what do they normally do? Feed it to their

"muffin monster"

But can it actually be done, send commands to a drive to self destruct,
I mean its possible with cars, to immobilize their engines.....

 

[Johnatan56]

That also works well I suppose,

But those shredding companies, what do they normally do? Feed it to their

"muffin monster"

But can it actually be done, send commands to a drive to self destruct,
I mean its possible with cars, to immobilize their engines.....

[video=youtube;yd_O7-rqcHc]https://www.youtube.com/watch?v=yd_O7-rqcHc[/video]

 

[Arthur]

So its true then?

Even the nsa can't help me?
The drive is well and truly fuk*ed?

One other question, when companies destroy your data purposefully that is,

Do they do something similar, or just put the drive through a giant paper shredder that shreds everything, platters, heads, casing, board. Everything....

Is there a way to actually program a drive to "break" itself like mine did?
I mean if they want to independitly audit a drive is destroyed, they scratch the platters so its impossible to recover?

As an aside, in the past few weeks I've disposed of around 50 HDDs as part of a major cleanup. I smashed every single one of them with a hammer. Those with sensitive data I opened and wacked the platters plat.

 

[LazyLion]

 

[SouthBit]

As both we and Tecleo have confirmed, there is no way to recover this drive due to media damage. Media damage is platter damage. The one main reason platter damage is such a problem is because it destroys heads. Hard drive heads fly a few nanometers over surface of the platters, that's a few billionths of a meter. If there is any contamination at all, the head will 'crash' into the platter surface and destroy the head. Without a working head, you can't read data. Imagine a tiny head making contact at anywhere between 5,400 and 7,200 RPM. If there is damage to the platter it will destroy the head - no functioning head, no data is readable.

The area of damage also matters. If there's damage to the service area that holds the firmware, big problems. If there is damage to a 'data area' then maybe this can be worked around, depending on many factors.

With regard to sending the drive to the people do recovery for SAPS etc, we did a job for SAPS just the other day. All proper recovery labs will have the same tools, same processes, and hopefully the same knowledge. You could send this drive overseas to the biggest DR lab in the world, but unfortunately the result will be the same. I remember a customer who brought in a 3TB WD drive which had been dropped, we managed to get at least half of his data back. He wanted the drive back after the job and sent it to Kroll Ontrack in the USA. They couldn't get any data from it at all. There are reasons for this, but it supports my point.

With regards to destroying drives, if you can just damage the platters in the right way/place then no data can be recovered. Easiest way is to just take a hammer and a punch and punch a hole straight through the top cover down into the platters. The platters will either shatter (depending on the material) or they will now have a whole in them and become unbalanced at several thousand RPM and be unreadable.

I just took a faulty Samsung 1TB 2.5" drive out of stock now and smashed the top platter for you, this is what happens.

This platter was made out of glass, it shattered. Other manufactures make platters out of alloy and they wont shatter, they will just dent.

 

[MickZA]

View attachment 227428

... where's Snowden when you need him.

 

[DTBA]

snip

I hope that was a non working HDD?

 

[Jet-Fighter7700]

I hope that was a non working HDD?

That was gonna be my next question,

Hope I didn't cause another drive to be toasted,

Thanks for all the advice guys, I'm expecting this "broken" drive in Jhb tomarrow,

I explained to my client its impossible to recover, doesn't seem to understand me,

Ill give him the drive back, and he can go figure it out himself, dead is dead, ain't no coming back from there.....


As a side note, I want to update my working drives firmware
(Seagate barracude grenade update),
is this a worthwhile idea or shouldn't I play around with such things?

 

[Jet-Fighter7700]

That was gonna be my next question,

Hope I didn't cause another drive to be toasted,

Thanks for all the advice guys, I'm expecting this "broken" drive in Jhb tomarrow,

I explained to my client its impossible to recover, doesn't seem to understand me,

Ill give him the drive back, and he can go figure it out himself, dead is dead, ain't no coming back from there.....


As a side note, I want to update my working drives firmware
(Seagate barracude grenade update),
is this a worthwhile idea or shouldn't I play around with such things?

Just saw he said faulty,

Platters made of glass? I thought glass is too brittle to be used, its always metal,

One question I have though is can't you take the platters out and read them outside a drive? I mean bit by bit?
I mean surely if a drive is just dented it can still be read?

 

[ponder]

One question I have though is can't you take the platters out and read them outside a drive? I mean bit by bit?
I mean surely if a drive is just dented it can still be read?

No you have multiple platters that are aligned, the moment you move a single platter by less than a hair in relation to the others you are fscked, practically impossible.

 

[Arthur]

One question I have though is can't you take the platters out and read them outside a drive? I mean bit by bit?
I mean surely if a drive is just dented it can still be read?

Yes, it's theoretically possible to physically inspect the disk and then recreate the data offline. This is done by using an electron microscope in combination with an MFM to produce a micrograph showing the physical orientation of each cell. This in essence is the process I mentioned above. Bit and spatial densities on modern disks make this an extremely laborious and time-consuming job. But don't let this raise your hopes for your customer's disk. This process is strictly non-commercial. Just saying that it is possible. Somewhere you might find some journal articles on how it's done. I'm on a phone now - search for spin stand microscopy.

 

[thehuman]

Yes, it's theoretically possible to physically inspect the disk and then recreate the data offline. This is done by using an electron microscope in combination with an MFM to produce a micrograph showing the physical orientation of each cell. This in essence is the process I mentioned above. Bit and spatial densities on modern disks make this an extremely laborious and time-consuming job. But don't let this raise your hopes for your customer's disk. This process is strictly non-commercial. Just saying that it is possible. Somewhere you might find some journal articles on how it's done. I'm on a phone now - search for spin stand microscopy.

Will cost alot maybe few 100k

 

[sajunky]

Yes, it's theoretically possible to physically inspect the disk and then recreate the data offline. This is done by using an electron microscope ....

If you lose start index, it is practically impossible. Besides, getting lose pieces of data doesn't help if you are not able to recreate logical structure. I would say, it is theoretically impossible.

 

[Jet-Fighter7700]

Anyway got my disk today,

One question I have, am I correct in saying if data is completely unrecoverable due to a head crash or platter damage, most data recovery companies don't ship you back the disk, they just toss it to the bin
Not much one can do with a broken drive right?

Got my drive today, spoke to southbit,tecleo and a few others as well as you fine people on mybb,
I know its a fools errand to try recover data from this drive, just having difficulty explaining it to my client,
Seems to think labs in the usa can recover his data......

Wasting their time and his, but you know what they say;
Can lead a horse to water but can't make it drink......

 

[ponder]

Seems to think labs in the usa can recover his data......

Wasting their time and his, but you know what they say;
Can lead a horse to water but can't make it drink......

Well in that case send it off to kroll ontrack in the usa which is considered the top data recovery company in the world and insist on getting the drive back. Sadly they won't be able to do anything for you either.

 

[Swa]

Just saw he said faulty,

Platters made of glass? I thought glass is too brittle to be used, its always metal,

One question I have though is can't you take the platters out and read them outside a drive? I mean bit by bit?
I mean surely if a drive is just dented it can still be read?

Sorry bud but as said if the initialisation data is gone the rest of the data is pretty much gone as well. Sure you can potentially read the rest of the data that isn't physically damaged, match sectors with their checksums, then reconstruct the logical disk layout. Would probably cost more and take longer than just gathering the data again.

 

[Arthur]

If you lose start index, it is practically impossible. Besides, getting lose pieces of data doesn't help if you are not able to recreate logical structure. I would say, it is theoretically impossible.

You're underestimating the ingenuity of the people and techniques involved. Once you have either 49 or 97 contiguous bits, it's a matter of a quick heuristic crunch applying the known firmware routines for the drive. Not only is it theoretically possible, it happens in practice. Of course if the magnetic film is physically destroyed then no recovery and reassembly of data is possible.

However, you'd be astonished what is actually possible. For example, it's in many cases possible to determine the prior state of a bit cell. Techniques have been developed using a scanning tunnelling microscope, and academic papers have been written showing how it is possible to recover over-written data. The real challenge is a practical one.

 

[SouthBit]

Got my drive today, spoke to southbit,tecleo and a few others as well as you fine people on mybb,
I know its a fools errand to try recover data from this drive, just having difficulty explaining it to my client,
Seems to think labs in the usa can recover his data......

If your client wants to send the drive to the States after all of the information they've been provided, let them do it and let's see the outcome.

 

[Jet-Fighter7700]

If your client wants to send the drive to the States after all of the information they've been provided, let them do it and let's see the outcome.

That's exactly what I said, its pointless to continue,

At this stage its not a practical option, its just too expensive and unreliable be be of any use,

In this case, head crash so I really doubt high tech methods will even work properly.

Small question for you guys, does recovering data from dead SD cards possible?
I mean can it also end up as no recovery possible,

Thinking to send my crappy "patriot" SD 8gb card through to southbit.

 

[SouthBit]

Small question for you guys, does recovering data from dead SD cards possible?
I mean can it also end up as no recovery possible,

Thinking to send my crappy "patriot" SD 8gb card through to southbit.

Yes, we do recovery on all formats of storage media so SD, Micro SD, CF, SSD, regular flash, etc. The smaller stuff like SD and Micro SD gets expensive though, if you look at how small the device is you can imagine the work that goes into reverse engineering something like that. But yes, flash storage usually has good success rates, but can be expensive. Often the problem is a faulty controller, so data is intact. Because you don't have moving parts they can't self destruct in the same way a 7,200RPM drive can.