
This case is usually lost.
What if your hard drive decides to enter the Elysian Fields in this very moment? Sure, you could simply get a new hard drive to substitute for the defective one with a quick run to your favorite hardware store. And with last night's backup you might even reconstruct your installation quickly. But what if you don't have a backup? We have experienced the truth to be more like this: many users don't even have a backup, or it simply is too old and thus useless for recovering any useful files at all. In case of real hard drive damage, only a professional data recovery specialist can help you - say bye-bye to your vacation savings!
Hard drive failure is especially disastrous for smaller companies working with a single server and a single disk, if they do not have a complete and working data backup at hand. The whole situation is even more complicated if the broken hard drive is a member of a RAID array. Neither hard drive failure in RAID 1 nor RAID 5 will result in data loss, since this scenario has been taken care of by the choice of these RAID levels in advance. But the risk of human error increases: self-made data loss occurs if you accidentally substitute the wrong drive in a degraded RAID 5 array (one with a failed hard drive).
But not all hard drives that show failure symptoms are defective. Sometimes, so called "soft errors" can be fixed using data recovery software. But even in this case, you should weigh the risks to see if it makes sense to take care of the problem yourself or get help from professionals. You might not be able to detect a controller failure right away, for example; usually, users assume a problem with the hard drive. Here is our rule of thumb: if you hear clacking sounds in the potentially defective hard drive, or if the computer's S.M.A.R.T. function indicates an error during the boot process, something is wrong for sure.
What can you do once you know that an important hard drive is definitely broken? Or what happens if you pulled the wrong drive out of the slot while you were desperately trying to save your data? First of all: don't panic! You need to act systematically and thoughtfully to be successful, as well as to ensure that you spend as little as possible on recovery - costs can hits four digits easily.
To this end, we met with data recovery specialist Kroll Ontrack to take a look at possible data recovery methods, including RAID recovery.
This first rule is to remain calm - acting rashly might be the greatest danger to your data. The fact that you are unable to access data via Windows Explorer as usual does not necessarily mean that your data is lost for good. Only overwriting bits, physical damage to the drive surface or destruction of the magnetization will cause irreversible loss of data. In most cases, we are dealing with a malfunctioning circuit board or failure of a mechanical component, two cases that still offer a variety of rescue methods.
You can avoid a lot of headache if you setup your system properly, schedule backups and monitor them on a regular basis. The best backup is useless if the user does not notice the error message giving the reason for a failure. Also remember that sometimes disaster recovery simply will not work, so please test run your backups. If necessary, restore them to another hard drive and see if it works as expected.
Here are a few precautions you should take with regard to hardware. If you use multiple drives, you should number the drives as well as the cables and removable frames. Do not rely on the existing numbering of removable fames and their front panels: they might start at 1, while your controller most likely starts at 0. Since assembly of such hardware as well as drive LEDs is always manual work, the whole process is yet another potential source of trouble. A little piece of tape bearing a drive number will help you avoid accidentally removing the wrong drive.
We assume that all hard drives will be handled with care, so they should be installed in suitable drive bays. If you use multiple drives, we recommend removable drive frame solutions, which help reduce vibration transfer onto the computer chassis and even back to individual hard drives. Make sure that your system has sufficient ventilation, so high speed hard drives won't overheat. Also avoid any kind of shock: you should make sure to position your system, so it won't get bumped by your knee, your dog, or your cleaning personnel. Servers belong in separate rooms, far away from any kind of everyday interference.
Make sure to defragment your data on a regular basis as well. Defragmentation will take file fragments that are distributed all over the hard drive and write them sequentially in one piece. This offers two advantages: better performance and easier file recovery in the case of an emergency. If data fragments are scattered all across a defect medium, recovery companies will have a hard time putting them back together. The same applies for RAID setups.
In case of error, verify if the malfunction might be caused by the hard drive controller. Ideally, you can connect all drives to another controller in the same order. If the error keeps showing up, it might not be the controller. Be careful with using more options: if you start a RAID initialization instead of a rebuild, parity data will be created, which most likely leads to overwriting healthy data!
Also be careful with software such as Partition Magic or Drive Magic. These are powerful utilities - powerful enough, in fact, to move data out of your reach. If you rampaged partitioning partition you might be able to help yourself through the use of data recovery software. Data is usually unharmed and can be found and recovered from your drive. Kroll Ontrack offers EasyRecovery, and Norton SystemWorks (System Utilities) provides another possibility. But be careful with those tools if a hardware malfunction seems to be the most likely case: In a worst case scenario they do more harm than good.
Overview Of Data Recovery Software

Data loss might also occur in small drives such as the Hitachi MicroDrive. Ontrack was unable to recover any data in the above right example.
Damage to a drive's circuit board or defects of the drive heads occur fairly often. In both cases, to access hard drive data, a data recovery specialist will substitute the defective component with a working one. In the best case scenario you regain 100% of your data.
A so called head crash - where a write/read head physically hits the magnetic platter - is much more severe. Simply hitting your drive might cause contact, since the distance between the head and surface of drives is minimal nowadays. It is almost always safe to say that a damaged magnetized surface causes the loss of saved bits. The head might even repeatedly get caught at the area of defect, carrying off more material with each additional contact. This material will be distributed inside the drive, causing scratches or other damage. There is nothing a customer can do in case of an intense head crash, because the head is simply unable to move across the defective area any more.
Overvoltage on write/read heads causing the permanent destruction of data areas or magnetization will also result in irreversible data loss. This means the physical destruction of memory sectors, not the simple deletion of saved bits. Depending on the drive, the data recovery specialist might be able to recover some data. Recovering data from defect Hitachi drives is usually impossible, since the manufacturer does not provide any kind of firmware information. Various other products allow at least reading data from other platters.
Strange but true: even internal imbalances can cause trouble. Irregular data platter rotation due to broken bearings will result in unwanted track changes of which the drive is not aware; the result is sometimes total data hodgepodge. Bearing failure is usually the result of improper handling during transportation of the drive. The data recovery specialist will often be able to recover saved data by balancing the drive (slightly shifting and centrally rearranging the platters).
Logical mistakes make up 40% of Kroll Ontrack's assignments; luckily, they do not require processing in the clean room. Usually, those mistakes are accidental misuse or deletion of files, where the drive itself has no malfunctions. Even if the problem lies within the drive, it might be a simple defective sector and nothing more severe. Every drive has defective sectors: a primary list will carry a list of bad sectors from the factory; the secondary, so called growing list, will be updated in the course of operation if more sectors become useless. This occurs rather often and is normal, but if your hard drive S.M.A.R.T. feature tells you that you better save some data fast, you're in trouble. This often means that the growing list is full and an above-average number of sectors are dying.
Now let's talk about an irreversible defect. Your hard drive will die if fire or another heat source heats it up beyond the Curie temperature of the magnetic material of your drive; this cases the magnetization to be neutralized completely. The Curie temperature depends on the material used in a hard drive; magneto-optical devices use with Curie point principle on purpose (heating via laser), but hard drives do not.
A user who tries to solve issues by himself can make things worse - according to Kroll Ontrack, this is the biggest problem with data recovery. According to statistics, Europeans are worse than Americans in trying to solve problems on their own. Situations also turn bad if, for example, administrators are afraid of their bosses' reactions. Once, someone even sent a floppy drive instead of the defective hard drive - this is a clear indication of pressure placed on the person involved.

Water damage: unfortunately, a customer turned on the drive after a liquid had intruded. There is no way to fix this, since even the installation of new heads won't help (they will not be able to run over the damaged area).
First, the drive has to be extracted from the computer to let the technician find the problem. There is, of course, no need to do so if you send your drive to Ontrack directly, but it is necessary if you send your computer or laptop to the data recovery specialist. Usually, you will call Ontrack to initiate contact. Ontrack has numerous branch offices worldwide and provides multilingual hotline personnel. Make sure, however, to give detailed information about what exactly happened so they know what they will be dealing with.
A remote recovery might be the most convenient option for customers. In this case, you don't even have to remove the defective drive; Ontrack provides the necessary software for you to install. Then you initiate a connection with Ontrack, enabling them to access your system. Since an "intrusion" of your computer by the data recovery people is unwanted, Kroll Ontrack chose this connection method deliberately. After connection build-up, the data recovery specialist will be able to run a remote diagnostic analysis of your drive and recover data via the Internet, if possible. Since a simple undelete might already work for you, it is worth the shot. On-site data recovery is also an option for Ontrack customers; removing a drive from large memory arrays in SANs or other memory structures is sometimes not an option.
If this doesn't work or your drive can be analyzed as defective acoustically - an experienced data recovery specialist knows what's wrong simply by listening to the sound it makes - you need to send in the drive or the complete RAID array by mail, or personally deliver it to an Ontrack branch office. In a first attempt to recover software, Ontrack connects the patient to a host computer and runs its software "Easy Recovery". This most likely helps with user-made mistakes such as accidentally deleted partitions or formatting. The primary goal is always to read existing data and copy it off the drive completely. Thereafter, the specialist works with data copied to a server.
If this doesn't work either, the circuit board can be exchanged as well. To do so, you need a compatible combination of hardware revision of your electronic board and the installed firmware. Oftentimes, you simply have to proceed by a systematic "trial-and-error" of all possible combinations. It is obvious that the data specialist needs a huge range of parts at hand. Kroll Ontrack tries to store common hard drives of all capacities and interfaces in-house, but essential hardware can also be sent between offices on short notice, since the data recovery specialist also has a list of each and every component needed for a swap.

At the reception desk, the customer can choose between the following service options. Standard (delivered between 8 am and 11 am) costs approximately $120. Express may be delivered between 8 am and 6:30 pm, but will be charged around $250. Emergency allows you to drop off your drive 24 hours a day, but you will have to pay about $500.
These prices are for diagnostic analysis only, whereupon the customer can decide whether to accept or decline the suggested data recovery. In contrast to the smaller data recovery specialist CBL, Kroll Ontrack generally charges for its analysis. In an after-hours matter of life and death, Ontrack will refer the issue for further processing to another office (e.g. from London to Los Angeles). Ontrack has 29 offices worldwide.
In 2005, Kroll Ontrack processed 50,000 recovery cases. Ontrack was able to complete 40% of incoming orders successfully right away. The remaining 60% had to be taken to the clean room, where 75% of data recoveries were successful.
Initial Step: The Imaging Station
The first thing the specialists try is to save an image of the affected drive onto the local server at the Ontrack office. At the site we visited, Ontrack provides 60 TB of storage capacity. Ideally, specialists will work with the image only, and not with the drive itself. Kroll Ontrack extends its own storage capacities to correspond to increasing capacity drives on the hard drive market. In case of urgency, a hard drive's content will simply be copied to another hard drive instead of the server, which is a bit faster.
Second Step: Emergency Surgery

A single data recovery workstation at Ontrack consists of four systems, since data recovery can take a long time. Below on the right, you see the KVM switch (keyboard/video/monitor switch).
A hard drive that refuses to cooperate will be sent to the clean room right away. These are Kroll Ontrack workstations set up according to clean room class 100, where a maximum of 100 dust particles are allowed per cubic meter of air. Components will be swapped here: drive electronics or internal components, read/write arms including writing/reading heads; or the spindle motor. In most cases, the specialist is able to access the drive's data again.

The data recovery specialist has frequently-used write/read heads always at hand (hanging in the top right corner).
Third Step: Data Recovery
Ontrack sends a list of saved data to the customer if it was able to access hard drive data successfully. The customer then can decide which files are important and which are not - the cost for data recovery is estimated according to your selection. Be prepared to invest at least $1,000. RAID systems can reach the five-digit zone rather quickly, since the effort is measured according to the amount of data and grade of destruction. Working on numerous hard drives simply takes a long time.
The Ontrack program Verifile offers an overview of data that can be restored (Use Ontrack VeriFile Online Data Reports). Since this program works with an Active X control element, you have to use Microsoft's Internet Explorer. The tool issues an ODR-file (Online Data Report), color-coding data as follows: green - good, yellow - restorable, red - only partly recoverable or not recoverable at all.
Today, the customer usually receives the desired data on a memory stick or DVDs.

More and more enthusiast users approach Kroll Ontrack with destroyed RAID arrays. Generally, data recovery from such a RAID array is possible, but keep in mind that the effort increases disproportionately. First of all, data has to be copied from a RAID drive onto a server, and the data set has to be put back together. The distribution of data into smaller blocks across one or more drives makes RAID 0 the worst possible type to recover. Increasing performance doesn't necessarily do your data any good here! If a drive is completely defective, only small files, which ended up on only one of the RAID drives (despite the RAID stripe set), can be recovered (at 64 kB stripe size or smaller). RAID 5 offers parity data, which can be used for recovery as well.
RAID data configuration is almost always proprietary, since all RAID manufacturers set up the internals of their arrays in different ways. However, they do not disclose this information, so recovering from a RAID array failure requires years of experience. Where does one find parity bits of a RAID 5, before or after the payload? Will the arrangement of data and parity stay the same or will it cycle? This knowledge is what you are paying for.
Instead of accessing drives on a controller level, the file system level (most likely NTFS) is used, as logical drives will provide the basis for working on a RAID image. This allows the recovery specialist to put together bits and bytes after a successful recovery using special software. Kroll Ontrack can illustrate data structure visually (see above). The recovery of known data formats is an important approach in order to reach towards a complete data recovery. Take a JPEG file for example - will you be able to recognize a picture after recovery? Or will you be able to open Word.exe, which is found on almost every office system? The selected file should be as large as possible, so it was distributed across all drives and you can know for sure that its recovery was successful.
If two drives of a RAID 5 are flawed, but enough data can be saved from the malfunctioning data mediums, Kroll Ontrack is usually able to recover this data. Two dead hard drives in a RAID 5 are more likely to be restored than two single platters, since RAID still provides parity data.

After data recovery, there is no reason to use the defective drive anymore, right? So most of the time it makes sense to perform an analysis to determine the cause of the faulty drive. Kroll Ontrack conducts its analysis under the microscope. The drive will be opened in the clean room, where a technician can apply a contrast liquid drop by drop onto the platter so magnetism can be seen under the microscope.

The black line illustrates one or more completely deleted data tracks, in this case due to overvoltage at the read/write heads resulting in immediate destruction of the magnetic areas. Indicated blue is the servo track, laid out concentric to the center of the platter. Modern hard drives have a multi-partitioned servo track due to its longer exterior track size.
Conclusion: Save Time And Money - Back Up Your Files
If you want to save a lot of time, money and trouble, perform regular backups. Data and malfunction analysis starts at $120 and can go up to $500; the actual data recovery will easily eat up $ 1,000 or more. Knocking on Kroll Ontrack's door with a broken RAID array might cost you as much as several thousand dollars. If you are willing to pay enough, data recovery is even possible on a RAID 5 array with two defective drives.
Even if you take good care of your hardware and do have a master strategy on how to secure it, there is always the chance that something goes wrong. If this happens, remember to remain calm! Overreacting might do more harm to your data than the malfunction itself. Keep your composure and don't start looking for a solution on your own, just because your boss might have a fit. Staying calm and discussing further action with competent people will give you the best results.
If you rely on data that might be lost and are not sure what to do, simply contact a data recovery specialist. Trying to saving a few bucks with a do-it-yourself rescue that goes wrong might cost you more nerves in the long run.