If a disk drive fails, would you know how to get your data back? For many consumers and small to midsize businesses, the first step is purchasing or downloading free data recovery software. This might work if the only problem is an accidentally deleted file since the data isn’t really gone from the disk, but homebrew remedies can be problematic and perhaps permanently destroy the data if proper precautions are not taken.
There are numerous consumer products for simple data recovery, such as a getting back a deleted file, a deleted disk partition, or data from a damaged disk sector. Microsoft Windows’ built-in CHKDSK command, which has been around since the DOS days, can identify and remap damaged sectors. Commercial products such as R-Studio, Ontrack EasyRecovery, Stellar Phoenix, and several others can recover deleted or reformatted disk partitions on a variety of storage devices, including internal and external drives, USB thumb drives, and SD Cards.
Backup and disk imaging products, such as Acronis True Image, StorageCraft ShadowProtect, Marcium Reflect, Symantec’s Norton Ghost and many others are able to create full disk images that are exact duplicates of the original disk. Differential and incremental images can be added after the original image is created, reflecting all changes from the time the image was made until the most recent update. If anything happens to the original drive, the image can be used to restore anything from a single file to the entire disk back to a known, working condition. An image backup includes everything on the disk, including hidden and system files that a file-based backup would not include. Many of the popular commercial products also have free trial versions or freeware versions that have limited capabilities.
While these approaches can work for some lost data, they are ineffective when a drive has a physical problem. What's more, while these approaches are often effective, they involve overwriting the source hard disk and could have unintended consequences, such as potentially overwriting a good file with a corrupt one.
Finding a professional qualified to recover data is difficult because there is a dearth of proper training and certifications. Anybody today can hang out a shingle that says they do data recovery. Whether or not they can, at least without putting the rest of the data on the drive at risk, however, is questionable.
Very few states have license requirements for computer forensics experts, let alone computer repair depots, says Steven Burgess, founder of Burgess Consulting & Forensics in Santa Maria, CA, and a 20-year veteran of the data recovery industry. In Texas, for example, a private investigator’s license is required for any disk data recovery, he says. This differs from other states where the PI license is only required when the data from the hard drive will be used in court and must be handled as evidence.
Burgess says that roughly 60 percent of the disk recovery projects he sees can be repaired with software only. Sometimes consumer-grade software can do the job but sometimes that same consumer-grade software might overwrite important data. The remaining 40 percent are equally divided between physical disk failures, such as a head crash, or failures in a RAID environment. While the disk failures in RAID sometimes can be repaired just using software, failures with RAID configurations can require different repair protocols.
Consumers should not try any do-it-yourself attempts to recover data if the hard disk is making noises, such as clicks or chirps, Burgess says. Sounds and smoke indicate a physical failure that rarely can be fixed with software.
Jeff Pederson, manager of data recovery operations for Kroll Ontrack, says consumers and small to midsize businesses often call the reseller where they purchased their computer or look in local directories first for a repair depot. Rather than spending the time calling around town, he says, their first call should be to the drive manufacturer. Often the manufacturer will have agreements with qualified repair depots and be able to advise the user on whom to call.
The first rule of data recovery is to do no harm, Pederson says. If the repair depot for your drive is unable to ensure that it won't harm the drive during the restore procedure, that should be a red flag. The second question one should ask is whom do I trust with my data? The depot should be able to ensure that it never actually opens files on the disk and that its employees have had background security checks. Personal data on a damaged hard disk can be restored, he says, without needing to open any files to confirm the restoration.
Pederson suggests that all data recovery be done on an image of the hard disk rather than on the disk itself. This protects the drive in case more aggressive actions need to be taken later to restore the data. Because of the importance of making sure the original data is safe, clients of a data recovery depot should ask if the depot will work on the original or an image.
There is no aftermarket in disk drive components so repair depots must be able to obtain exact duplicates if parts need to be swapped out from a donor drive. A part from a similar drive or perhaps an older or newer version of the same drive might not have compatible electronics and firmware.
David Zimmerman, CEO of LC Technology International Inc., says the processes a repair technician uses to fix a damaged drive could vary from depot to depot. "Sometimes you have to use unorthodox methods" to fix a drive, he says. These methods could represent the difference between someone who has expertise in data recovery and disk repair and someone who simply follows directions from a book.
Typically, Zimmerman says, his company is able to do nearly all data recovery tasks. However, for those drives that have physical defects, he generally will work with a partner that has a clean room and the technicians capable of doing drive tear-downs and repairs. Repairing physical disk problems in the clean room, such as replacing read/write heads, ensures that no contaminants such as dust, dirt or oil from the technician’s hands, fall on the platters and corrupt the data.
Opening and repairing a hard disk without the benefit of a clean room might work in some cases — it is one of the unorthodox approaches that might be used in an emergency — but he does not recommend it.
However, some of the traditional tricks of the trade are no longer valid, he says. For example, years ago the advice for drives that got too hot to operate was to place them in a freezer. While that recommendation did chill the drives, it also created condensation on the drive platters. While drives from 1990s might have survived this approach, today’s drives cannot, he says, because of changes in disk drive technology, such as high-density disk platters.
Unfortunately, he says, most users do not have current backups of their drives. A backup is easy to create and can end up saving hundreds of dollars or more.
Considering that most of today’s consumer or small business systems run Windows and most repair depots are familiar with the NTFS file system, it is relatively easy to find a shop that can fix those drives using software. The challenge is finding a local depot that is able to fix drives that use different file systems, such as Linux. Unlike the ubiquitous Windows, Linux file structures differ from one vendor’s version to another. On top of that, some repair depots must mount the Linux image into a working Linux environment to work on the data, which is not required in Windows.
Many of the consumer-class desktop NAS devices use a Linux-based operating system that is transparent to the user. While the user might see the drives as Window devices, the underlying operating system in the NAS itself might be Linux. In those cases, the client should ask the prospective repair depot if it has the expertise to recover data from drives that are not from a native Windows system.
Another difference in repairing newer drives is the amount of data at risk for a given problem. In 2000, if a technician was able to recover 99 percent of a hard disk with a capacity of 10 GB, 100 MB of data would be lost. With today’s consumer disk drives in the 4 TB range, that same 1 percent of lost data is 40 GB, or four times the size of the entire drive from just 14 years ago.
If you are looking to find a company that can recover lost data from a hard disk, be ready to open your wallet. Prices vary widely, but generally expect to pay from several hundred dollars to more than $1,000, depending on the complexity of recovery. Also, a higher price might not necessarily indicate that the technician is more accomplished than a lower-priced technician. If you have a faulty drive from a NAS system, the price could increase if the disk is part of an array. If the NAS is configured as JBOD (just a bunch of disks) and not part of an array, you should be able to remove the one bad disk without impacting the rest of the NAS.
The turnaround time for data recovery or disk repair will vary based on the complexity of the repair and if the disk repair needs to be outsourced to a second repair depot with specialized training and tools. It is best to ask up front what the depot’s policy is about fixing a physical drive problem if the company you are contracting cannot perform such tasks. Also, some depots offer turnaround guarantees (often from three days to one week, depending on the repair). Ask in advance what turnaround options are available and if a faster turnaround will add to the repair cost.
Experts agree that the vast numbers of data recovery projects are due to logical errors on the drive, such as a corrupt file system or a problem with the drive’s master boot record. Most of these issues are solved through software without requiring any physical repairs to the drive mechanism. However, if the drive itself has been damaged, that generally means the drive will be sent to a repair depot that maintains a clean room and has technicians capable of opening the drive. If you heard noises coming from your drive when it failed or saw smoke, you should ask your repair depot if has the facilities to repair the drive or if not, to whom it outsources the repair.
Many repair depots that are unable to fix a damaged disk will return it to the customer without charge; some might charge a nominal testing fee. As with any potential repair, the customer should ask in advance what the depot’s fee policy is on drives it cannot repair.
Do your due diligence. Ask questions about the depots references, the technicians’ experience, and the security protocols in place to protect your data.
Editor's Note: In the following chart, we present some essential and basic information about some of the industry leaders in data recovery and disk repair. Several companies did not respond to our request for information. It is also worth noting that in gathering the data for the matrix that begins on the next page, almost every single provider was reluctant to take part, claiming that the data recovery and disk repair industry was full of specious companies, most of whom make false promises. We removed from the charts claims about being the best, or being first. Because data recovery typically involves vital data worth paying for, we suggest that you do your homework and check references.
| Products |
DataMechanix
|
DriveSavers
|
DTI Data Recovery
|
Flashback Data
|
Gillware Data Recovery
|
Secure Data Recovery
|
The Data Rescue Center
|
WeRecoverData
|
KrollOntrack
|
| Pricing |
Go
|
Go
|
Go
|
Go
|
Go
|
Go
|
Go
|
Go
|
Go
|
| Years in Business | 22 | 28 | 16 | 10 | 10 | 17 | 5 | 11 | 29 |
| Number of Technicians | 9 | 26 | 10 | 3 | 20 | 22 | No details provided | Confidential | 125 |
| Repair Staff Avg. Experience | 12 | 6 | 20 | 15 | 5 | 10 | 10 | 17.5 | 10 |
| Receiving Locations | 2 (Irvine, CA, Sidney, Austrailia) | 14,000 referral partners worldwide | 3 (hundreds of partner locations in U.S.) | 1 HQ with 11 authorized drop off centers | 1, with 1200 active partners | 57: N. America, Mexico, Australia, UK | 1 (HQ). Free expedited shipping for 5000 partners | 40 in U.S., 10 in Canada, 1 in Mexico. | 19 |
| Technician Certifications | Every Engineer has a minimum A+ certification, Every Engineer passes the certification outlined by NIST and the DOD ASCLD/ ISO 17025 2005 | Windows, Apple and Novell certified. PGP, Ultimaco Software, SafeGuard Enterprise, Access Data, Pointsec Check Point, EnCase Guidance, Cellebrite, Blackbag, Paraben and many others. | Ace Lab avdanced training, MCSE, Cisco, Apple | ASCLD/LAB International accredited crime lab (ISO 17025); examiners with many digital forensics certifications, including CFCE and EnCE. | No specifics provided | Apple Mac Certification, MCPD, A+. SSAE 16 SOC 1 Type II, Class ISO 4 Cleanroom, BBB Accredited with A+ Rating | Apple and Windows Certifications | MAC certified, Microsoft Certified Professionals. Forensic and e-discovery engineers hold CCE (Certified Computer Examiner), EnCE (Encase Certified Examiner), CHFI (Certified Hacking Forensic Investigator) | Certified Mac Technician. VMware Certified |
| Average Turnaround Time | 4 days | 1-2 business days | 5 business days | Standard Service, 3-4 business days. Expedited services as fast as same-day turnaround. | 6 business days standard. Advantage service takes 3-4r business days (additional $350). Priority service averages one business day (additional $700) | 1 - 3 days depending on the size and condition of the disk | 3- 5 days, but overnight expedited recovery service for an extra fee | Standard service at 5-7 business day; Priority service 2-3 business days. Weekend service is 2-3 days. For emergency service most cases are recovered within 24 hours. | 3-5 business days |
| Turnaround Time Guarantees | Yes (24 hours for priority and 3-5 days for standard service) | Round the clock priority service, 1-2 business days and 5-7 business days. 97% turn-around time result. | Only Expedited Service | No, due to the nature of damaged drives. | Difficult to guarantee recovery turnaround time due to the uncertainty involved in many of the recovery procedures | Emergency service options with option for same day service. | Hard drive recovery is variable based on the unique circumstances. | Turnaround times are guaranteed. Our time frames are based on similar cases | No |
| Vendors Who List Company as Authorized Repair Depot | Western Digital (Hitachi) and Toshiba. | 5 SSD manufacturers; 4 Notebook/desktop/server manufacturers; 8 storage system manufacturers; 3 hard disk manufacturers | 2 publicly on their sites. All accept our work without voiding warranties. | Western Digital. Also listed with several external HDD makers such as Verbatim, Rocstor, etc. | Dell, Western Digital, Intel for SSDs | 20+ | Listed by G-Technology and Hitachi. | N/A | Authorized by all major hard drive manufacturers |
| Ability to do Forensic Repairs and Recoveries | Yes | Yes | Yes | Yes. Accredited crime lab (ASCLD/LAB International (ISO 17025), same as FBI labs) | Yes | We have capabilities to handle any recovery but we do not forensically document them as part of our service | No | Yes | Yes |
| Technicians with Forensic Recovery Certification | All 9 | 6 | 5 | 1 | No details provided | 1 tech and 2 engineers | No details provided | No details provided | 30 |
| Technicians with Expert Witness Experience | 3 | 3 | 1 | 2 | No details provided | No details provided | N/A | About 50% of our data forensic engineers have served as expert witnesses in court. | 15 |
| Advanced Technology Used | ACE Laboratory's PC-3000, DeepSpar Data Recovery Software, Atola Insight Recovery Tool, Proprietary disk tools for both hardware and software | ACE Laboaratory's PC-3000, DeepSpar Data Recovery Software, Atola Insight data recovery tool, Proprietary software and hardware tools | ACE Laboaratory's PC-3000, DeepSpar Data Recovery Software, Custom Atola Insight data recovery tool, Our own. Sells tools to other DR companies | ACE Laboaratory's PC-3000, DeepSpar Data Recovery Software, Many Others | Proprietary | Other Proprietary | ACE Laboaratory's PC-3000, DeepSpar Data Recovery Software, Atola Insight data recovery tool, Other Proprietary Tools | Proprietary, developed by an in-house R&D lab | Patented Remote Data Recovery technology; hundreds of proprietary tools across all operating system platforms |
| Repairs Onsite or Outsourced | Onsite | Onsite | Onsite | Onsite | Onsite | Onsite | Onsite | Onsite | Onsite |
| Average Price for Repair | $795 | $1600 | $199+ | $700 | $700 | Depends | $400-$1200 | $500-$2500 | $695+ |
| If You Cannot Do Repair, Is There a Fee? | No attempt fee or fee for parts, etc. if data is not recovered | No. We do not charge a fee if the data is not recoverable. | No (diagnostic fees if drive has been opened, or has been to another data recover company) | No, unless the drive seals have been broken by the customer or another data recovery company | No | No fees until data is recovered, unless disk opened by user | No | No-data-no-fee guarantee and 100% data guarantee policy | It depends on the system type and service level selected; eg., if priority or emergency services are selected, there is a fee for $65 |



