Most priceless hard drive data is now recoverable - at a price

The offer to trash a hard drive to see whether its data could be retrieved by Kroll Ontrack’s recovery service proved irresistible. Soon a car was being revved up and the experiment was under way . . .

IT’S THAT unmistakeable sound anyone who works with technology dreads hearing. The whirring, clicking sound you know your PC shouldn’t be making, which suggests your hard drive – containing your precious data – has either passed on or is a digital breath away from giving up the ghost.

In an ideal world you would have a recent data backup that would allow you to restore all those files. But as anyone who has been in the situation where a hard drive has failed will know, we don’t live in an ideal world. Disaster invariably strikes when your hard drive or other storage is brim full of precious memories and you only have one copy (see panel).

In these instances both consumers and businesses are increasingly turning to data recovery specialists. Coming to the fore in the early 1990s, these firms were experts in the dark arts of data storage and were able to recover files which non-specialists would tell you were gone forever. The issue was that such specialised services came at a huge cost – sums of €10,000 were not unheard of to recover the contents of a drive. As a result, it was largely law enforcement agencies and businesses who stood to make big losses without the data who were willing to stump up for the service.

Since those days, improvements in technology have driven prices down, however. Kroll Ontrack, a division of US consulting firm Marsh McLennan, now offers home users a fixed price data recovery service for €585 (with a turnaround time of two weeks), while corporate pricing starts at that level but rises sharply depending on how quickly you want your data back.

The likes of €585 might buy a new notebook, but when the drive in question contains your wedding or baby photos, a contract with an important customer or all your business contacts, it seems like a small price to pay.

Kroll approached The Irish Times last month and asked whether we would like to test their service. Much and all as I like playing with technology, it can also frustrate me, as it does most people. Needless to say, the offer to destroy a hard drive was quickly accepted.

An external USB-powered Hitachi Neso hard drive was duly shipped to the office. After loading it up with files there was a choice of three ways – which would emulate a real-life situation – of attempting to destroy it.

Although environmental contamination, ie drowning it in sugary or alcoholic liquids (or possibly a combination of both) seemed as if it would be satisfying, it lacked a certain drama. While destroying the drive with a power surge certainly scored in the drama stakes, it seemed a tad clinical. That left sudden impact – dropping the hard drive from a height, dragging it or even running over it with your car, all common occurrences when carrying a laptop, as Kroll advised.

Informing colleagues of the impending experiment, I soon found that everyone is an armchair expert on the destruction of electronic devices. The consensus seemed to be that your average family saloon would inflict little if any damage on the Hitachi drive with its smooth metallic case. With that in mind, the drive was placed on top of a manhole cover with ridges on its surface (to get some leverage) and driven over repeatedly with a car. Sure enough, the first couple of passes seemed to inflict minimal damage, but by the fifth time the case was buckling – and soon the drive was being dragged across the manhole with the internal circuitry exposed.

A close inspection suggested the internal circuitry was damaged, and the buckling of the case suggested we may have made some impact on the platters or discs that the data is physically stored on.

Damage done, we picked up the pieces and popped them in a jiffy bag for shipping back to Kroll.

As a normal customer would do, we provided a description of how the drive had been damaged and what steps if any we had taken to access the data afterwards.

Ten days later an e-mail arrives from Kroll – it seems our efforts were not enough. Using a secure log-in to Kroll’s site, we were able to see that all 417MBytes of files – everything from MP3s to standard Word documents – were recovered. A few days later, another USB drive arrives with the actual files.

Ciaran Farrell, business development manager for Kroll Ontrack Ireland, explains that when a drive or other device arrives at its labs, engineers assess it with a visual examination and a review of the information provided by the customer. Based on this, they decide what steps will be taken to recover the data.

We could see there was damage to the outside of the drive and also the circuit board, says Farrell. When there’s physical damage like that, they don’t power up the drive, as that may cause further damage.

Instead, the drive is taken to Kroll’s Class 100 cleanroom, an ultra clean facility where there are less than 100 particles of dust and other contaminants per cubic foot.

Farrell says the engineers were able to repair the printed circuit board, while the data platters were fairly intact. If they were damaged, their engineers would have put new parts in to get it spinning again.

Kroll has built up relationships with all the major drive manufacturers to ensure it has a ready supply of spare parts. Rather than repairing the drive and copying the data off it, the engineers get the drive spinning just enough so that they can get an image of what’s stored on the disc.

This image is then used to see what data can be recovered, and a report is sent to the customer.

In our experiment, all the data could be recovered but, in the case of more serious damage, the report would have a range of colour indicators beside each file showing the likelihood that it can be recovered.

Once the customer decides to proceed, the engineers rebuild the file system structures according to the operating system on the device. Effectively this moves it from being a disk image to something that the customer can work with on their PC.

Farrell says the proportion of Kroll’s business coming from consumers as opposed to businesses has grown recently. Consumers are storing more and more of their data on laptops and, because they are portable, they are more prone to be in accidents. Drives simply failing during the course of normal use is not as unusual as people might think.

Drives are getting much bigger in capacity but the footprint is not getting bigger, says Farrell. That means the components are smaller and moving faster, so they are more likely to fail.

The experiment proved that providing you are willing to pay the price, most data is recoverable.

But in an age where digital cameras, MP3 players and smart phones mean we are all creating, sharing and copying gigabytes of data, the question you have to ask is just how much your data is worth to you.

Five data disasters

Five of the more challenging data disasters that Kroll Ontrack customers encountered this year but from which the firm was able to recover files:

5. While riding on his motorbike, a photographer's bike basket containing his camera came loose. The camera flew out and broke, leaving the memory card drowning in a puddle.

4. After a house pet ate a piece of defrosting meat on a kitchen counter-top, it became sick on the family's computer. The dinner remnants seeped into the laptop's hard drive, ruining the familys computer as well as their evening meal.

3. A horse-riding tour ended abruptly with a fall. The rider was wearing a camera at the time of the accident and, while the rider got a clean bill of health, the memory card did not. The files were corrupted and could not be uploaded to the owners computer.

2. A hard drive plummeted 200 feet to the ocean's floor. It was discovered six months later and was sent to Kroll Ontrack's cleanroom, where 99 per cent of the data was imaged and recovered.

1. As the police entered a home, the suspect they were after threw a laptop containing potentially useful evidence out the window of a 12-storey building. As a result, the laptop smashed into many pieces on the pavement. Investigators turned to Kroll Ontrack to recover the photos, videos and e-mails.