MacFormat Investigates: Data Recovery
Words: Christopher Phin
Photography: Rob Scott
MacFormat magazine: Issue 196, Summer 2008
The answer to the question above, disappointingly enough, isn't 'Ghostbusters'. It's Kroll Ontrack, Europe's only Apple-verified data recovery firm. If your Mac is failing to boot or your hard disk is making ominous clicking noises, just send them your hard disk and they'll do everything they can to recover your files from it in their facilities in Epsom, Surrey. MacFormat went to visit the hard disk doctors to find out how they do it, to discover just what can go wrong with these chunks of hardware that we trust our businesses and precious family memories to, and to help us understand what we can all do to guard ourselves against future data loss.
Disk disasters
How the disk doctors at Kroll Ontrack have saved data from broken drives
The most common physical trauma that a hard disk can suffer from is what the technicians at Kroll Ontrack call a "head slap", where the read/write heads are knocked onto the surface of the disk platters. It can cause huge problems; since it's only the surface of the disk that records the data, scraping this coating off means that the information in that section of the disk is probably lost, and if data vital to the operation of your drive or operating system is - or rather was - stored there, you're in trouble. What's more, the dust from the scraped-off surface can further interfere with the hard disk's operation, and in disks that have multiple platters to increase their capacities, this can be a serious problem.
And there's another horror to contend with. While most of the platters in desktop (3.5-inch) drives are metal, laptop drives (2.5-inch) usually have 
platters made from glass. Though it's incredibly tough, it can shatter; both this and the "head slap" are normally caused by rough handling.
But though disks are finely-engineered things, they can withstand quite dramatic encounters. Though it makes their job that bit harder, data recovery specialist such as Kroll Ontrack can resurrect data from hard disks that have suffered from fire or flood.
Even if the hard disk itself is in good condition, however, there could be problems with the data it holds. One of the most common reasons people send their disks to Kroll Ontrack is because they have reformatted a drive without realising that there's essential information on there. While it doesn't have the facilities to resurrect data from a drive that has been zeroed out - had information rewritten over every sector - most people don't do this when erasing hard disks, so Kroll Ontrack can simply ignore the missing directory that gets trashed during a standard format and examine the contents of the disk sector by sector.
It's Murphy's Law: anything that can go wrong will. And when we're talking about your precious data - whether it's mission-critical work or photos of your kids' birthdays - this is not an encouraging maxim.
Hard disks are phenomenal things, and the advances that have been made since their late-50s debut are astonishing: IBM's 3380 series, launched in June 1980, was capable of storing 2.5GB of data, but it was the size of a fridge and could cost up to $142,200. Leased, it could cost $3,713 a month; in cost-per-gigabyte terms, that's the equivalent of paying $237,632 every month to borrow a 160GB iPod classic. And that would fit in your pocket.
Yet despite these huge strides in areal density and value, much of the technology remains retro. The basic bits that IBM introduced in its 1973 Winchester
hard disk are still in place. Inside the case of a hard disk, platters - made of metal or glass - are coated in a thin layer of magnetic material. A read-write head floats tens of nanometers above the surface of the platter, flicking back and forth to read from the data tracks recorded on the platters as a series of ones and zeros. These tracks are tightly packed - Seagate has drives that cram over 52GB into a square inch, though most commercially available disks store less.
And if all this sounds precarious to you, you'd be right.
Finding a solution
Up till now, there wasn't an official solution. While there are many data recovery firms, those that speak Mac are rare, and though Kroll Ontrack has been working with Apple for years, the lack of a verified provider meant that people working for Apple or on its behalf couldn't recommend Kroll Ontrack. Now that the company is verified - confirming that Kroll Ontrack's methods meet Apple's standards - having your hard disk repaired, which involves taking it out of your Mac, doesn't invalidate your warranty. (The physical drive would be covered for replacement under your warranty, but as MacFormat's Art Editor will attest, it doesn't cover your data. If you want it back, you have to pay for it. At least, however, the process of extracting your hard disk with Kroll Ontrack doesn't invalidate your hardware warranty.)
The process of fixing a hard disk will be strangely familiar to anyone who's watched medical dramas. The first step is like triage - getting a story from the customer to try to build up a picture of what has gone wrong, then working out what to do. Later, technicians can try to match up this story with what they find with the drive itself. This description also helps the technicians figure out whether the problem lies with the physical disk mechanism itself or with the data. Robert Winter, Kroll Ontrack's chief engineer tells us that of the drives the company sees, 70% suffer from physical problems and 30% are socalled logical problems, everything from corrupt directories to accidentally reformatted drives.
The clean room
The first priority is to get an image of the drive, by cloning its contents onto the company's 100TB RAID systems. If the drive is physically damaged - worn components, physical trauma - it goes into the clean room. This stage isn't about 'fixing' the drive - it's not worth risking your data to a patched-up drive that has already failed. "We just want to get it running long enough to make that image,"Winter tells us.
Once the problem has been diagnosed, Kroll Ontrack will consult with the customer to see what can be done and how much it will cost. "The average data recovery cost we see here is about £800,"says Phil Bridge, Kroll Ontrack UK's MD, "but that's not to say we don't have cheaper options; our photo recovery service, for example, costs £299."
Before visiting the clean room, we had visions of Spielbergian white rooms with decontamination chambers, but if fact all that is not really necessary. Each bench has a huge air filter above it, sure, but MacFormat could wander in without first donning an Outbreak-style suit. Despite the incredible tolerances involved, hard disks, it turns out, could run for a couple of hours in a normal room even when the top casing is removed. In the sort of rarefied air of Kroll Ontrack's clean room, that figure jumps to days, weeks and even months, allowing the technicians to piece together the data on the platters.
Once the data has been cloned, technicians can start recovering files. Even if the directory - the part that tells the computer where all the files are - has been damaged, it's possible to do a signature search, looking for distinctive header information that tells the technicians where particular file types are.
After a successfully recovery - which typically happens in two or three days - the data is loaded onto a new portable disk and sent back to its owner.
It's all in a day's work for Kroll Ontrack, but for businesses trying to retrieve vital documents, or just a regular Joe whose son has accidentally trashed a cherished iPhoto collection, it's salvation.
How to take care of your data
Be gentle with your computers; physical trauma can damage them in ways that can be difficult or impossible to correct. Allow a laptop to shut down or sleep fully before stuffing it in your bag, for example.
Back up! But remember that your backup device could fail too. There's nothing inherently safer about a backup drive compared to the drive inside your Mac; you're just trying to reduce your chances of a physical drive crash. Ideally, back up multiple times to multiple different media, and remember that offsite backup - such as Apple's iDisk system - helps guard against local catastrophes such as fire or flood.
Protect your disks from strong sources of magnetism. While most domestic sources are unlikely to interfere with the data recorded magnetically on a hard disk's platters, there's no reason to be cavalier.
If you suspect there's a problem, act quickly. Don't be afraid to ditch a poorly hard disk - untypical ticking noises can be a good indicator of a failing drive - and restore from a backup; it could be expensive, sure, but it'll be cheaper than trying to recover your data. Unless you're confident that you know what you're doing, you could make things worse, resulting in an even more expensive repair.
If you do take your drive to a data recovery firm, give them the whole computer or external drive; let them worry about getting at the hard disk. And don't follow the example of some of Kroll Ontrack's customers by hacking out the individual platters and mailing them in a Jiffy bag!
Kroll Ontrack's top five outlandish recovery challenges from 2007:
Taking the bait
A fisherman thought that he would take his laptop along to play a few games whilst waiting for a bite in his rowing boat. As he stood up, both he and the laptop went overboard, taking all his data to the bottom of the lake.
Panicked photographer
A wedding photographer faced the potential wrath of a new bride when he discovered he had overwritten her photos with ones from another event. Two days before the couple returned from their honeymoon, he called Kroll Ontrack. The bride was none the wiser.
Indiscriminate inferno
A fire destroyed the majority of the contents of an office, only leaving a few CDs. The sticking point was they had melted to the inside of their cases - a unique job for the engineers.
Quest for a quiet life
A British scientist was fed up with his hard drive squeaking, so he drilled a hole through the casing and poured oil into the mechanics. The squeaking stopped, and so did the hard drive.
Ant invasion
Discovering ants had taken up residence in his external hard drive, a photographer in Thailand took the cover off and sprayed the interior with insect repellent. The ants didn't make it and until Kroll Ontrack's engineers got their hands on it, it looked like the data wasn't going to make it either.
See the Flash version of this article: http://krollontrack.macformat.co.uk/
Download this article as PDF (33MB)
