Actu
More than 10 percent of drives sent to Kroll Ontrack for data recovery have been previously opened, hindering outcomes
November 2013 by Marc Jacob
Kroll Ontrack announced that for the third year running, more than 10 percent of the media sent to Kroll Ontrack has been previously opened, diminishing the chances of a successful recovery by more than 45 percent. This represents a large volume of unnecessary data loss when you consider that Kroll Ontrack processes more than 50,000 recoveries a year.
“When a drive is opened, the ability to recover data from the media can be diminished,” said Paul Le Messurier, Head of Programmes and Operations at Kroll Ontrack. “Recovering data from a physically damaged hard drive is considerably more difficult than a logical failure, so opening a failed drive should only happen in a professional and certified cleanroom environment with a laminar air flow system.”
A hard drive is a sealed unit, specifically designed to keep any debris from entering while it is in use. The read-write heads inside that drive are designed to float over the platter surface while it’s spinning, usually at speeds anywhere between 5,400 and 15,000 rpm. When dust particles enter the unit while it is spinning at full speed, the smallest of particles can make their way between the heads and the platter surface, causing the heads to crash.
Ontrack Data Recovery engineers diagnose all received drives to determine the condition of the media and data in a data recovery lab. Common discovered issues include: multiple bad sectors, damaged surfaces and malfunctioning head assembly due to instability or severe head crashes. If the media is diagnosed with a logical failure (non-physical), engineers use specialised tools to rebuild and repair damaged data structures, and then access and extract the data. In instances of physical damage, Ontrack Data Recovery engineers open the device within a cleanroom environment and assess the physical condition of the circuit boards and moving parts through a comprehensive and rigorous diagnostic process.
Clean Workbenches
A clean data recovery environment is a devised system for routing the air flow on rows of workbenches in an arrangement based on high-quality submicron particulate air filters that trap the smallest particles. These systems use special HEPA filters (high efficiency particulate air filters) that filter out suspended particles only 0.5 micrometres in diameter. Workbenches and data recovery work stations are arranged in specialised areas based on the type of media: 2.5”, 3.5” IDE, SATA drives, USB drives, SAS, SCSI, SSD, flash, phones, tablets and server media. All Kroll Ontrack workbenches follow ISO 14644-1 class 5 standards.
Parts Inventory
Seventy-five percent of drives sent to Kroll Ontrack have physical failures versus logical damage. As a result, a large inventory of spare parts to address the wide inventory of drive capacities and components is also critical to any cleanroom.
“With more than 150,000 spare parts globally, Kroll Ontrack has one of the largest spare parts inventories in the world,” added Le Messurier. “Our intelligent inventory system provides all 24 offices with the ability to locate the correct part from the closest location. Kroll Ontrack customers benefit from global support for all storage devices as well as a fast recovery time.”
Working on an Image
Getting a physically damaged drive to work is key to the recovery, but so is working from an image of the data. This best practice ensures the data isn’t further damaged in the process.
Kroll Ontrack cleanroom engineers create a disk image when working on a malfunctioning drive by connecting the drive to a sophisticated system made up of proprietary tools. Kroll Ontrack’s unique server setup creates a disk image without causing further damage to the media. All recovery work is performed on this image, safeguarding the customer’s data in a highly secured in-house data centre. Recovery results can be displayed in an Ontrack® Verifile™ report, a web-based based application used to inform customers of what files can be recovered before they commit to a recovery purchase.
In order to assess the quality and security credentials of a data recovery provider with cleanroom capabilities, Kroll Ontrack recommends asking the following questions:
Does your cleanroom environment adhere to any industry standards? If so, what kind?
What is the total work area of all your clean benches, and how many workstations do you have?
Do you have both hardware and software research and development engineers on staff developing your own proprietary solutions?
How is data imaged from a damaged drive?
How is data security, privacy and integrity of data addressed?
How are your data recovery engineers trained to perform this kind of work?
Are you authorised by any hardware vendor? Does your work void warranties?
