Data Recovery Resources Freeware Software SNAP RAID How To Guides

Now Offering Local Computer Networking and It Solutions

bizopps@dtidata.com (Michael Stankard) — Fri, 20 Aug 2010 16:25:19 +0000

DTIData is proud to announce the launch of our Networking Division DTI Networks in the Tampa Bay area. We offer both Microsoft and Cisco certified technicians in order to meet all of your IT needs.

Contact us today at 727-612-6482 to set up an appointment for one of our qualified engineers to come and do a network evaluation. We offer both hourly and contract prices to fit any budget.

Tampa Bay Networking Services Offered:

Server Virtualization

Exchange Migration Services

Active Directory Migration

Network Architecture

Network & Desktop Management

Infrastructure Management

Security Audit, IDS, Vulnerabilities

Remote Maintenance

Online/Offsite Backups

Disaster Recovery Solutions

Document Management

Citrix / Terminal Service Administration

Application Hosting

Storage Area Network configuration and troubleshooting

Clustering Servers and Services

Website Design

Voice over IP

Remote and Phone Support

PBX Phone Systems

Computer Repair

Computer Forensics and Expert Witness Testimony

Hard Drive Failure – What NOT to Do

bizopps@dtidata.com (Michael Stankard) — Mon, 09 Aug 2010 17:19:34 +0000

By now everybody has had a bad experience with a hard drive. When most people run into problems with their computer, the last thing they think of is the hard drive! If you are a gambler like me, you play the probabilities. The most likely problem you will face if you are running a Windows operating system is bad files, but what causes those hall.dll errors or blue screens of death? In most cases they are OS related, but there are surely enough evidence to suggest that the hard drive can be at fault.

Check out the video below to see “what not to do when your hard drive is acting up” for a humorous look at hard drive failures.

When you save a file to your desktop or to “My Documents”, it is stored on your hard drive, just like every other piece of your digital life! Unless you are a total paranoid and back up everything twice, you are more likely like me, a person that doesn’t have the time or inclanation to spend valuable minutes of a busy day to copy important files to various devices insuring digital security.

What To Do When Your Computer Acts Funky

The first thing to check is the hard drive. So you ask “how much is that gonna cost me ?” Hard drive data recovery is an expensive proposition for most people, but the fact is that we work with users every day, and will do the best we can to fit hard drive recovery into their budgets to the best of our abilities that makes business sense. So what do you do? The first step is to isolate the problem as quickly and easily as humanly possible. Download and try our Freeware Windows Surface Scanner. It will tell you how bad your drive is. Get Windows Surface Scanner here.

OK, so what are the things that you don’t want to do when you know for sure that the hard drive is the issue? Let’s start with the basics:

Don’t put it in the freezer – if you are capable enough to remove the hard drive from your computer or laptop then you are knowledgeable enough to know you can’t mess around with the drive and expect good results. In the past you could swap PCB boards when the hard drive had electronic problems (read below) or deal with heat by cooling the drive down. The problem with the freezer effect is it is a one time shot. I always preffered poker to roulette, and adding a temperature variable to the mix is asking for trouble. The only time cooling a hard drive down is when the drive has frozen (forgive the pun : ) due to excessive heat. Other than that, the freezer won’t help.
Don’t open the drive yourself! There is nothing in there that can be fixed without proper tools and experience.
Call us: 727-345-9665 – we can help and we don’t charge anything unless we recover your data!

Using Recover It All Data Recovery Software On USB Firewire External Hard Drive

bizopps@dtidata.com (Michael Stankard) — Mon, 02 Aug 2010 19:29:53 +0000

This video from Jacqui Best our tech guru explains how to use Recover It All. It not only gives a concise explanation on the inner workings of the program, but goes into detail on the best way to use it when recovering external hard drives!

Download now! Recover It All Demo will show you your data before you buy! No registration required, download a demo NOW!

Purchase Recover it All now. Instant delivery of software. RECOVER YOUR DATA NOW!

Not Formatted Would You Like to Format Now?

bizopps@dtidata.com (Michael Stankard) — Wed, 28 Jul 2010 17:46:38 +0000

This is a common problem with external hard drives like the Western Digital My Book. The reason is that we as a USB using public do not “Safely Remove” the hardware before we turn off or unplug the devices from our computers. A lot of the time this is due to the fact that Windows will not allow us to safely remove the drive. We get an error that says the device is still in use by some ghost application. This seems to be less and less of problem with the release of Windows 7. When we remove the device improperly there is always a chance that the cached data will be dumped somewhere inconvenient and a lot of times that area is going to be the “system area” or what is also referred to as the MBR or the OS Boot Sector. Why does the data dump choose to go there? I have to come to believe over the years that it is because some coder somewhere thought it would be funny.

How do I fix it you ask? There are couple of different ways. The first way would be to download a piece of recovery software, something like Recover It All, let it scan and then move the data off to another hard drive. After you move all the data it would then be safe to format your external hard drive and move the data back. This method is the tried and true method of data recovery, but it is time intensive and requires that you have another drive with enough storage to hold the data. The other problem I foresee is that you may also miss an important file.

There is another option though, and that is the Recover It Now service we offer. With this service I use LogMeIn to come into the machine remotely. I load my tools on to your machine and then fix the drive on the fly. When all is said and done you will be back up and running like crash never happened. I can also offer diagnostic analysis of the hard drive for free as well as point you in the right direction of what recovery software will be the best option.

If you want to discuss the options please give me a call at 727.345.9665 ext 236 and I will be happy to help!

Computer Acting Up? Check Your Hard Drive For Free With Windows Surface Scanner New Version

bizopps@dtidata.com (Michael Stankard) — Wed, 14 Jul 2010 16:37:06 +0000

DTI Data is happy to announce the release of an updated version of our most popular freeware: Windows Surface Scanner!

The new version now allows for reports to be printed as to where the bad sectors are, but more impressive is the relationship section, which can tell you what file system components have been damaged. This is a full version data recovery Freeware tool that required no registration.

Often times when a computer is running slow, or having problems accessing files, the hard drive has bad sectors. Windows Surface Scanner is a free tool that will scan the hard drive, report on bad sectors and tell you what’s on the bad sectors and might have problems.

The following file system components are scanned:

Master Boot Record – If there are any problems within the master boot records, this is where they will be.
OS Boot Record – This will tell you if there are problems with the Operating System boot-up files.
Master File Table – The Master File Table is the area of the drive that holds all information about the file system. It has a record for every file stored on the partition. A Master File Table Record stores file information, such as, creation, modification, and last access dates, on disk size and real size, security permissions etc. The most important information the Master File Table stores is the cluster map in the form of runlists. The cluster map stores all the information as to where the file data is actually stored and if corrupted or unreadable as in the case of a bad sector, the file becomes inaccessible. Windows Surface Scanner will alert you to the fact that the MFT is corrupt and may cause problems when accessing certain files.
File Allocation Table – The File Allocation Table, or FAT, is the FAT32, and FAT16 file systems answer to a runlist. Although not embedded in the File Entry record data, the File Entry Record points to the first cluster in a data run which is reflected in the FAT. The FAT then uses an old school technology called single linked list using a terminator to cap off the end of the run. If the FAT has a corrupt sector then many files may be affected since a single sector in a FAT may hold several linked cluster runs for multiple files. Windows Surface Scanner will indicate that the FAT has a corrupt sector and may be affecting access to some sectors.

You can download the Windows Surface Scanner Here.

The Quick Start Guide can be found here for the Windows Surface Scanner

If your hard drive has a bunch of bad sectors, you will need hard drive data recovery. Call 727-251-2058 for more information or support on Windows Surface Scanner.

DTI Data Recovery Rescues ZION and Humanity!

bizopps@dtidata.com (Michael Stankard) — Tue, 06 Jul 2010 15:54:54 +0000

The other day we received a great testimonial from Harry Lennix the Matrix’s Commander Lock. He was very pleased with the hard drive recovery we performed for him! We treat all of our clients like they were stars, and everyone’s data is important to us. It is always nice to have a testimonial from a celebrity though.

Why People Choose DTI Data’s Hard Drive Recovery Services

DTI Data is celebrating 10 solid years as a data recovery company. For all those years we have a Better Business Bureau rating of A+. We are only one of 8 companies in the US listed as an authorized Western Digital Data Recovery partner.

Our goal is to provide our customers with fast and professional services. We don’t charge any money unless we recover the data and give you back your files in a working manner. Call 727-345-9665 or visit hard drive recovery for more info.

Hard Drive Data Recovery Clicking Disk

bizopps@dtidata.com (Michael Stankard) — Thu, 03 Jun 2010 16:03:53 +0000

By far the most common problem we hear about are clicking hard drives. Most data recovery companies automatically assume that a clicking hard drive means physical hard drive data recovery. While in most cases the clicking sound is indicative of a head crash and will require clean room work, there are other problems that can cause “the click of death” Below are 3 different types of clicking disks that we performed hard drive data recovery on:
Clicking Hard Drive

Why Hard Drives Click

The most common reason a hard drive will start clicking is because of a head failure. The heads can no longer find the first sector on the disk and go into a seek pattern. Things like heat can actually warp the platter and make the drive inaccessible. When looking at high capacity hard drives that are over 500GB, this problem is intensified because the sectors are placed perpendicularly on the platter, making it even harder to read. While this is great for mass storage, it doesn’t take much to cause a problem.

Below is a close up of hard drive heads:

Hard Drive Heads Up Close

When Clicking Disks Do Not Need Physical Hard Drive Data Recovery

Newer high capacity hard drives use a language called micro-code to communicate internally. Any chip on the PCB board that hiouses firmware uses micro-code to get it’s instruction set. As you can imagine, if there is a breakdown in firmware the drive can go haywire.

This type of hard drive data recoveryis considered a logical recovery, not a physical recovery and is often thousands of dollars less expensive. The first thing DTI Data does when it triage’s a clicking hard drive, is to determine if it is a logical problem or a physical problem. That way we can give our customers the best pricing! DTI only charges if it recovers the data. Call Toll Free: 1-866-438-6932 to ask about hard drive data recovery.

Knocked External Hard Drive Off Desk – Fell To The Floor

bizopps@dtidata.com (Michael Stankard) — Mon, 19 Apr 2010 19:40:19 +0000

One of the most common calls we get is when someone has knocked their external hard drive off of their desk or counter. I have heard cats knocking the hard drives off, kids and users tripping over external hard drive cables. If an external hard drive falls 3 to 5 feet there is a good chance it might become damaged. This is for sure if it was running at the time.

When a hard drive has a physical shock, the heads can impact upon the platters and cause damage to the data. Sometimes the damage can be with the USB enclosure and not the hard drive. It is always a good idea to take your hard drive out of the case and slave it onto another machine to see if the BIOS can recognize it.

Call 727-345-9665 if you need help with your external hard drive. We also have software and tips for external hard drive repair here.

DTI Data 10th Anniversary Celebration

bizopps@dtidata.com (Michael Stankard) — Wed, 07 Apr 2010 18:57:00 +0000

We are very happy to announce that 2010 marks the 10th anniversary of DTI Data’s hard drive recovery service. Even though we had been selling software since 1994, it was in 2000 that we opened our main hard drive recovery facility. This has been a great decade for DTI and its customers and we are not going to stop now!

DTI 10th Anniversary Special!

To honor 10 years of business we are offering a special package of premium software for only $149.99

Save Over $50.00 On Data Recovery Software!

Recover It All – The industry standard in advanced data recovery software
DART XP – A fast and powerful data recovery software
DART UNDELETE – Super fast undelete tool with a powerful scanning engine
Digital Picture Recovery – Powerful digital photo recovery tool
Speed Clone Suite – hard drive imaging tools that work in both Windows as well as a self loading operating system that can access hard drives without running Windows. 3 distinct drive imaging tools included in the suite!

Hard Drive Data Recovery From Bad Sectors

bizopps@dtidata.com (Michael Stankard) — Mon, 08 Mar 2010 19:19:12 +0000

One of most common hard drive data recovery scanrios is when we are faced with multiple bad sectors on a hard drive. Since we have released our popular Windows Surface Scanner, I have gotten a ton of emails about what to do when your drive has a bunch of bad sectors.

What do bad sectors mean?

Bad sectors on a hard drive can be caused by a lot of different things, but some of the common problems we run into are:

The integrity of the sufaces of the platters are compromised by old age, excessive heat or misuse like being dropped in external hard drives.
Track data corruption which can be a result of a logical problem that leads to incorrect writing, viruses or physical movement of the sectors themselves from platter warping.
Read/Write heads failing make magnetic media getting worn out from excesses read/writes. There are limited amount of read/writes that every hard drive has. Each hard drive has its own MTF or mean time between failures. This is an average based upon normal computer use.
Damage to the actual drive system area.This is very common when there has been a loss of error correction control. There are 2 lists, a permanent defect list and a growth defect or (dynamic)) defect list. Can’t be made perfect, so there are lists that are scanning sectors which is manufactured. New maps are created as bad sectors, there is a limited pool of sectors. When pool is used up, then you get bad read writes.

When Bad Sectors Are Really Really Bad

If you have used the DTI Windows Surface Scanner and it reports bad sectors you need hard drive recovery. Call 727-345-9665 to speak with a data recovery tech.

Western Digital WD5000AAJS Hard Drive Recovery

bizopps@dtidata.com (Michael Stankard) — Fri, 12 Feb 2010 17:31:46 +0000

Western Digital WD5000AAJS hard drive recovery usually entails repairing the heads. Like many drives the WD5000 has a parking mechanism that is meant to protect the platters so the heads don’t impact upon them. This doesn’t help if the heads fail during normal usage.

Read Write Heads Caught in Orange Keeper or Park Area

The park area is allocated for the read write heads of a hard drive to remain stationary in transit, in the off or sleep position so the heads do not make physical contact with the platter or media surface

In many cases due to slight warping of the platters rotation, the armatures read write heads flying height above the platters surface will slightly increase or decreases in size… resulting in an incorrect alignment when being brought back to the park position.

The Result

FIG 1: The read write heads have bent after being forced off the platters with the wrong alignment

FIG 2: Upon restarting the bent read write heads now scrape the surface of the platter causing data loss

FIG 3: You can see now see how badly the heads have been damaged when removed

FIG 4: This shows the worn condition of the orange keeper from when the read write heads jammed

Missing Exchange Data File

bizopps@dtidata.com (Michael Stankard) — Mon, 01 Feb 2010 17:38:38 +0000

I had a customer recently that called saying his Network Attached Storage (NAS) device had crashed and now his Exchange Priv.edb was missing. He tried running checkdisk on it, tried several undelete and file recovery programs with no luck. The weird thing about it was that viewing the properties of the drive letter under windows showed 140 GB in use even though the only other file on the drive was the Priv.stm streaming file which was 60 GB in size.

Luckily for me that it was a network drive, only had one other file on it and had not be written to since the crash. If any data had been written to the drive after the fact the file disappeared, data recovery may have not been possible.

How I ended up fixing it was to use a hex editing piece of software (I happened to use Winhex, though there are others that would work as well) that allowed opening up the drive to view the raw data. I located the file that was already visible on the drive (the .stm file) to be sure I knew what the header looked like so as to not mistake it for the .edb I was looking for.

An Exchange Priv.edb file is made of pages exactly 4096 bytes in length, the header of the database is shadowed so there will be another 4096 bytes identical to the first right after it.

I located what I thought was the header of the Priv.edb and marked the beginning of it, then I counted down about 8 pages (around 32KB) and marked the end of the 8^th page and wrote it to a file (on a different drive of course!) called Priv-Temp.edb. At that point I was able to run eseutil /mh (dumping an exchange header) on my little temp .edb file. I could then verify that it was the correct Priv.edb file I was looking for based on the information provided by the header dump.

Then remembering that windows showed 140 GB in use and knowing the .stm file was only 60 GB, I counted down from the start of the header 80 GB and marked the end, and wrote that data to a file (on a different drive) called Priv.edb and copied over the existing Priv.stm. I used a calculator to make sure my file was perfectly divisible by 4096, it was not. I looked at the end of my new file and trimmed away the excess data I had grabbed so the file would be perfectly divisible by 4096 (the page size).

This was the first time I had done a recovery like this, so I was not very optimistic about it working. We tried to mount the database and SURE ENOUGH it mounted! Even if it had not mounted, other steps I could have taken would have been to run eseutil /p on my new data file, or I could have used other Exchange specific data recovery tools to extract the mailboxes from my created Priv.edb file.

Well, thank you for reading this, and once again if anyone has any questions you can email me at exchangesupport@dtidata.com

Failed Hard Drive Recovery From Stuck Heads

bizopps@dtidata.com (Michael Stankard) — Wed, 27 Jan 2010 18:07:49 +0000

One of the most common problems facing computer users is a failed hard drive. We see all types of failed hard drives, but the most common fatal problem revolves around broken heads. If there are any issues with the platters, often times it will be the heads that fail. They are fragile and don’t stand up to a lot of wear and tear.

The video below shows 2 things of importance when looking at failed hard drives, the initialization process that lets the heads know when they are ready to start scanning the drive, and a drive with stuck heads. Newer hard drives have built in safety mechanisms that stop the heads from scanning the platters.

Learn more about hard drive recovery.

SATA Hard Drive Recovery Reversed Cable Causes Smoke

bizopps@dtidata.com (Michael Stankard) — Mon, 25 Jan 2010 18:18:10 +0000

When connecting a SATA drive, you might think that the interface is pretty straight forward, but you would be amazed at how many damaged hard drives we get in due to reveresed power cables.

The video below shows the result of two very bad things that happened to a SATA hard drive. First off the connector was put in upside down, but then it was taken out and put in the right way. Both times, the chips on the PCB board got fried.

Hard Drive Data Recovery Challenges

bizopps@dtidata.com (Michael Stankard) — Fri, 08 Jan 2010 16:30:49 +0000

When performing hard drive data recovery, it is often a physical problem that requires the disk to be opened. We open hard drives in our clean room to prevent dust and static charges to interfere with the media. Our most commonly faced problem is head failure. The heads float on a tiny cusion of air that is generated by the spinning platters. A brown out or drop in electricity or excessive heat can make the heads impact on the platters. In external hard drives, being dropped or suddenly losing power can also cause an impact.

Every now and then the heads will impact on the platters and cause scratching. This is as bad as it gets as the scratches are eliminating ones and zeros. In the photo below, the scoring of the platters is on the very edge of the media. This cuses severe damage to the heads which have to travel over the edge of the platter at every read and write. Even if we replace the heads, the new ones will soon become damaged as well.

Hard Drive data Recovery Options

To learn more about your options when facing a clicking or grinding hard drive. Call us at 727-354-9665 or visit our hard drive data recovery page.

DTI Data Recovery Now On Twitter

bizopps@dtidata.com (Michael Stankard) — Tue, 22 Dec 2009 20:21:46 +0000

For all of you tweeters out there, DTI has started updating our visitors with new software upgrades, new products and new articles pertaining to data recovery, backup and storage. Stay up to date on all things happening with the team at DTI by following us on Twitter.

This won’t be an online advertisement for us, but a way for users who need our products and services to stay on top of the updates and feature changes to our line of data recovery software and freeware.

Hard Drive Recovery Of Magnetic Media Explained

bizopps@dtidata.com (Michael Stankard) — Fri, 18 Dec 2009 23:10:44 +0000

By now you all know that DTI data is a hard drive data recovery company that not only repairs damaged disks, but also provides data recovery software. We offer full version freeware, RAID diagnostics and file system viewers for our customers. We get a lot of questions about hard drives themselves, how they work and what are the steps that are taken to repair them. Since there is so much information on the Internet, we are going to do a series on what hard drives are and how they work.

Hard Drives Are Magnetic Media

OK, so what does “magnetic media” mean? If you look at the graphic below it shows the different parts of a hard drive. The platters actually hold your data. They also hold a magnetic charge. The heads float over the platters on a buffer of air created by the spinning on the platters. The heads should never contact the platters since that will damage both the heads themselves as well as the data on the platters. Like the Earth, hard drive platters have a north and south pole. The relationship of where bits are stored according to the poles, determines if the bit contains a negative or positive charge. Each charge plus or minus reflects either a 1 or a 0, which can be translated into data.

Hard Drive Parts Laid Out

The motor spins up the drives to a certain RPM such as 7200, which is the most common rotaion per minute on modern hard drives. Once the platters are spinning at enough velocity to create the proper buffer of air, the heads will unlock and start to access the information on the hard drive. Information like the size of the drive can be sent to the BIOS and the computer can boot up.

Here is an up close look at the heads and actuator arm:

: Up Close look at hard drive parts

In most hard drive data recovery cases, the problems we encounter are considered “logical”. A logical hard drive data recovery involves repairing system files, partitions, boot files and system restore recoveries. This article is geared towards physical hard drive recovery which entails either repairing an electronic problem such as from a power outage or surge as well as head problems. If you have ever had a clicking hard drive, then you have had a head problem. In our class 100 clean room, we can replace heads and allow a damaged hard drive to be read.

Even though hard drive data recovery starts with the mechanical or electronic repair of the disk, that is not as easy as some of the videos you might have seen on YouTube portray. Every hard drive has its own firmware as well as its own language called micro-code that allows the drive to communicate with your computer. In cases where large capacity hard drives are clicking, the same exact heads are essential to recover data in a successful manner.

There Is Likely Only One Attempt At Hard Drive Data Recovery

If you run into a situation where your hard drive is acting flaky, slow, losing files or is showing you files but only allows you to see them not copy them, you have a serious problem. If your hard drive is clicking, whining, not spinning up or making a metal on metal grinding noise, you have a crises on your hands. It is essential that you stop trying to boot a hard drive that is showing signs of failure. In a lot of cases a professional hard drive data recovery company like DTI Data can recover the data without total parts replacement. If the hard drive gets to the point where the BIOS cannot see it, then hard drive data recovery is the last resort.

24 Hour Hard Drive Recovery & Server/RAID Recovery Hotline:
Toll Free 1-866-438-6932 or direct 1-727-345-9665.

Online Hard Drive Data Recovery Quote

Exchange Data Recovery Guide

bizopps@dtidata.com (Michael Stankard) — Fri, 18 Dec 2009 16:37:27 +0000

First and foremost, DON’T PANIC. I cannot remember how many times I have seen somebody (myself included) do something completely idiotic and often times irreversible because they didn’t take the time to think things through. For example, wanting SO badly to get the database mounted again before anybody notices that you don’t do the MOST important step when recovering any data, making a backup and working off of the backed up copy rather than your live data.

That being said, here are the steps to take when disaster hits and your Exchange server is not cooperating.

Make a backup of your important data, NOW! Do not hold off on this step:
1. For Exchange 5.5, you will want the Priv.edb, Pub.edb and Dir.edb at the very least. For Exchange 2000 and 2003, grab the Priv.edb, Priv.stm, Pub.edb and Pub.stm. For 2007, there is no longer an stm so just grab the Mailbox Database.edb and Public Folder Database.edb
2. Grab any uncommitted log files. I will explain later in this article on determining which log files have been committed and which have not. You may also want to grab committed log files because if you need to go to an older backup of your database, these can be played back to bring the database up to date.
3. By default the data files and log files are stored in the <exchange directory>\MDBDATA folder but can be split over 2 different drives.
4. I highly recommend backing 2 separate backup copies of your data, at least one of which is stored on a completely different physical drive, computer or storage device.
While you are waiting for your data to copy, assess the situation and gather information:
1. Find out what the problem is that is preventing Exchange to function by checking the application and system event logs. Copy any events related to Exchange to a notepad document or write them down.
2. Check for any other serious errors in the logs that could point to an issue possibly related (hard drive going bad, virus, etc…)
3. Check to make sure there is enough hard drive space. A hard drive filling up can corrupt your database if there is not enough room to grow it.
Gather information from ESEUTIL:
1. Run ESEUTIL.exe /mh
  1. This will tell you if your file is in a Dirty or Clean Shutdown state
  2. It will also tell you which log files are needed to bring it to a Clean state on the “Log Required” line.
Resolve underlying issues first:
1. If your problem is because of faulty hardware, inadequate drive space, a virus / malware, or something else external to Exchange, resolve that first.
Research the errors obtained during step 2:
1. One of the best resources: Google it! Searching for your error on Google can produce a wealth of useful information
2. Also look on support.microsoft.com
Decide on a recovery strategy:
1. Your options are:
  1. Recover yourself using Microsoft tools, 3^rd party software and online resources
  2. Restore from backup.
  3. Call a professional recovery company to assist.
For a corrupted database, here are the steps I would take to recover:
1. See if ESEUTIL can solve the problem with a soft recovery
  1. Run ESEUTIL.exe /r E00 /d /l /s where E00 is the first 3 characters of your log files.
2. Try to fix with ESEUTIL hard recovery
  1. I actually forego this step in most cases and only use it as a last resort as it CAN lose data from your database, but it can bring a database to a mountable state. Use at your own risk!
  2. Run ESEUTIL /p
3. Restore from a recent backup.
  1. If you have a recent backup, sometimes this may be a better option than trying to fix a corrupted database, because there is almost always some data loss when fixing a corrupted data file.
4. Restore from an OLD backup and replay logs to bring current.
  1. If you have located an old backup AND you have ALL logs files from then until now, the log files can be replayed into it to bring it up to date. If any logs are missing or corrupt, this may not be a viable option.
5. Restore from 3^rd party software or call a professional.
  1. If all other recovery options fail, it may be time to enlist the help of outside sources. Only you can put a value on what your data is worth to you and if it is feasible to hire (or purchase) outside help to restore your server back to normal.

Well that’s it for now. This is NOT a comprehensive list, just a few pointers that are often overlooked. If you need any help with an Exchange issue, you can email exchangesupport@dtidata.com

Recovering from a RAID Controller Failure

bizopps@dtidata.com (Michael Stankard) — Fri, 18 Dec 2009 16:36:16 +0000

There are many reasons why a RAID goes down. A technician will normally assume that one or more of the drives have failed. This is a common diagnosis as the diagnostic lights on each of the drives may be blinking, the lights may have gone amber, or in some cases the drive may not be spinning up at all. All of these surface indicators would surely lead the most seasoned technician to assume that the drives have either failed or are definitely on their way out. There is another reason why all these things would happen, and that would be a RAID controller failure. The challenge is to diagnose the problem with a damaged controller. Using a damaged controller to make a diagnosis is the same as having a sick doctor diagnose his own health problems. Some technicians will try and replace the controller and hope the configuration will reload from the drives and the RAID will mount. DTI Data has made a very good living on technicians that swap controllers and cross their fingers in hopes that the RAID will come up. There are so many problems with this method of trying to bring the RAID online that they are too numerous to mention.

What needs to be done is to separate the primary component of the RAID which is the hard drive from the controller in order to make a legitimate diagnosis. The following are some methods you can use that are isolated from a damaged RAID controller that will help you recover the data of your client.

First of all check the drives to make sure they are electronically sound. If you have SCSI drives use an Adaptec SCSI controller. Perhaps an Adaptec 2930 would suit your needs. They are inexpensive and have been around for a bit so all of the firmware bugs are worked out. Put the SCSI card in a reliable computer and mount each drive individually. If the drives are SATA, or PATA use a standard interface port to mount the drives.

If the drive shows up in the ‘Disk Manager’ item of the ‘Computer Management’ then it is a pretty safe assumption that the interface is intact and you have some I/O between the drive and the controller. In addition to this DTI Data has a free surface scanner that will allow you to look at each drive and map any bad sectors on the drive. If two or more drives come up having bad sectors then that could be the reason why the RAID went down. RAID controllers are very sensitive to more than one drive exhibiting bad sectors or slow reads. A RAID 5 controllers’ firmware may be fault tolerant, but when two drives have bad sectors the controller will degrade the array and bring it offline.

If, however, there are not any bad sectors on any of the drives then that is normally a controller problem. You may have received a power spike, or some kind of memory fault but the fact of the matter is that barring those kinds of things the raid controller failed and will not mount your array.

In addition to doing a surface scan to verify if in fact you have had a raid controller failure you can check the integrity of the raid. In a raid 5, the controller will do a set of mathematical operations on the data in order to be able to reverse engineer the data if a drive drops out of the array. These XOR math functions are used to do a rebuild on the array and take a degraded raid 5 hard drive and build it. The drive will have to be replaced before the build but a raid 5 controller has the ability to integrate a brand new drive back into the array.

I bring up the raid 5 mathematics, because in order for the array to have a ‘clean bill of health’ the parity integrity must be intact. If a raid card does not detect the fact that a drive has dropped out of the array then the drive will become stale. A raid 5 will continue to function even if one drive is out of the array; however the raid card should notify the technician that the array has been degraded and the drive should be replaced and a rebuild performed.

DTI Data has a free diagnostic tool for raid 5 and will allow you to see if in fact there is a stale drive in the array. I wrote a blog on how to detect a stale drive in the array and hopefully this will help you diagnose drive array controller failure. If in fact the software finds a stale drive and the raid controller did not indicate that then the only way to recover the data is to create a virtual raid 5 array offline using software and images created from the raid 5 drives.

In order to create the images DTI Data has an inexpensive solution on our web site. The software was designed and written with the technician imaging multiple drives to a single drive. It is as easy as mounting the drives, selecting the source drives, the destination drive and then just walking away. The software will not only image the drives but it will map all the bad sectors its finds and generate a comprehensive report.

These are just a few things that you can do to detect a raid controller failure. DTI Data offers a set of comprehensive tools that will check all aspects of the raid 5 hard drive. These tools are all on our website and will hopefully be an addition to your tool set.

If you need RAID Data Recovery Call Toll Free 1-866-438-6932 ext. 203 or direct 1-727-345-9665 ext. 203 to speak with a qualified RAID engineer now!

Western Digital My Book Problem Question and Answer

bizopps@dtidata.com (Michael Stankard) — Thu, 03 Dec 2009 18:53:29 +0000

Below are some more fun Q&A about hard drive recovery. I have given what I think is the best solution to these problems. As always please leave a comment if you have a question or contact me directly at 727-345-9665 ext 236.

Question:

I have a 1TB Western Digital My book Hard drive. When I plug it in to either the USB or FireWire ports the computer detects and the instillation wizard pops up.
I follow the wizard steps and it says “successfully installed” but I cannot find my hard drive.
-My USB drives all work and I have other hard drives on the computer
-It says “you may safely remove hardware” in the task bar
-I’ve tried it on a different computer and had the same result

Answer:

So this gets a little tricky because just because “My Computer” isn’t seeing the drive it does not mean the computer is not seeing the drive. You would need to go to disk management and then see if it is reporting as a mass storage device in the machine. If it is then it is likely that the drives problem is a MBR (master boot record/partition record) problem that can easily be fixed with something like a remote recovery. The other option is to run data recovery software on it and you should be able to tree the hard drive, move the files off, repartition/reformat, and move the data back. If it is not being seen in disk management then it is likely a communication problem with the USB enclosure (box holding the hard drive) and the computer. Usually popping the enclosure open and then slaving it or putting it in a new enclosure fixes that problem.

Question:

I bought a Western Digital My Book Essential Edition 1TB External Hard Drive in July ’09. I moved ALL my music, photos and personal files onto this hard drive. My CD-ROM drives quit working right before I got this….so I had not gotten around to “backing them up” on discs. STUPID-I KNOW!!!!
2 weeks ago it just quit working. I used it in the morning and in the afternoon, it wouldn’t work. It appears that it isn’t getting any (sufficient) power. It does not show up as an available drive when it’s plugged in.
Is there ANY POSSIBLE way for me to get my files off of this thing? I plan on sending it in to get it warranted-but I want to recover my files first.

Answer:

Ok, so like the above user he eludes to the face that it just isn’t showing up. it really could be all of the above fixes. My guess would be that if he wanted to get permission from Western Digital to pop open the enclosure he would be able to rule out the insufficient power problem. My guess would again be that the chassis has gone bad since this a very common problem. I always say that a My Book is a good product but only if you are going to plug it in just to back up and then leave it off most times. If you want an external device you can run all the time the best course of action would be to buy a high end USB enclosure and a hard drive in the size you want and build your own. This will give you the option to install fans in it as well as be sure it has good power to the hard drive. Heat is one of the major causes of hard drive recovery.

RAID 5 Stale drive detection

bizopps@dtidata.com (Michael Stankard) — Wed, 02 Dec 2009 19:26:56 +0000

Over the course of a week I receive several calls regarding the recovery of a RAID 5 array. In the course of the initial interrogation of a client I ask several questions regarding the state of the array, what has been done to recover the array and most importantly what happened to the array that made this particular technician begin a recovery? In over half of the conversations I have with the client/technician two drives have dropped out of the array. By virtue of its design a RAID 5 can run with one drive down which is why it takes a second drive to fault before the RAID goes offline. That being said, when a second drive goes down then the RAID firmware will flag the RAID as offline and refuse service.

The fact of the matter is very rarely do I see only two drives go down simultaneously. I will see a single drive down, or all drives down, but almost never do two drives go down at the same time. Almost without exception one drive has failed before the second one has. In other words, one drive fails, the RAID card degrades the array and continues to provide service, then a second drive fails and the array goes offline. How does this happen?

There are several reasons. First of all, a RAID card will normally send a loud alarm that can be heard in the far reaches of the universe. In order for that alarm to work it has to be configured in the firmware, and the speaker has to be undamaged. Many times the alarm does work, however the technician does not want to take the array offline since there are several users who would burn his image in effigy if he did. So, he turns off the alarm and promises himself to replace the drive when he shuts down. That day never comes. If the array is software managed and not hardware managed then there is no alarm, however an email is usually sent to apprise the technician of the impending catastrophe he will experience if the drive is not replaced and a rebuild initiated. But! The email address that was used at configuration time 8 years ago is long gone, or, the spam filter set up by the same technician bounces the email that has the ominous warning. For whatever reason, the drive is left offline and the RAID continues to provide service.

Then a second drive goes offline and the entire array comes crashing down. Most technicians try several reboots, or forcing the drives online. Some will try a rebuild, and some will replace both drives and try to do a rebuild of the array with two new drives in the array. None of these work, and all will cause permanent data loss making recovery impossible. The best course of action for any array recovery is to take the drives that are still working and make images of them onto another hard drive. We have a very good piece of imaging software on the web site that will allow you to image multiple drives onto a single drive titled “Speed Clone for Windows”. If you have more than one drive in the array that is damaged then those drives need to be sent to a clean room for an image recovery, however, the majority of the time there is no damage to any of the hard drives in the array and the imaging software will act as a safeguard for any steps you take for a recovery.

With all of this being said a technician will still have the problem of a stale drive. If the stale drive can be isolated and the drives in the array are not damaged then the stale drive can be replaced with a new drive and a rebuild performed on the stale drive. So the challenge is, how does a technician find the stale drive? Using a simple hex editor which has a search routine any technician can find a stale drive. One note, this technique only works on the NTFS file system, but I am sure it can be adapted for other file systems as well.

NTFS uses a table for keeping track of the files stored on the drive. This table is called the Master File Table (MFT). Each file on a drive has one entry in the MFT. Each MFT entry houses a great deal of data pertinent to the file. The MFT keeps the dates of the file, security attributes, the file type, the file name, where the file is stored and many more items too numerous to mention. The MFT also has an internal attribute that is unique to the record. That attribute is called the MFT record ‘magic’ value. Each record has the same ‘magic’ value to allow the operating system to verify that it is processing an MFT record. This ‘magic’ value for the MFT is the four letters ‘FILE’. This value is located in the first four bytes of the MFT record. Knowing this, if we count every sector that has the ‘magic’ number located in the first four bytes we would get a very accurate idea of how many files are on this drive. In other words, by counting the magic numbers for the MFT, we can determine how many files reside on a drive. In addition to the magic number, the MFT is normally stored in one area, this can also help us find each MFT record. Now knowing that we can find every MFT record by using a search for the magic number how a RAID 5 stores data across the array becomes very important and I’ll explain why.

A RAID 5 stores data equally between all drives in an array. Using a four drive array as an example a 800 KB file will be stored across all four drives equally. In other words each drive in the array will receive 200 KB of the file. This fact does not hold true for smaller files due to the stripe size, however, for our purposes we are dealing with a very large file, the MFT. The average server will have between 250,000 and 500,000 files on the array. As an example let’s use 400,000 files to illustrate this point. If a four drive array has 400,000 files then each drive will have 100,000 MFT records. In other words, if we were to search each drive for the MFT ‘magic’ value we would find 100,000 entries per drive. Let’s take this scenario one step further. A drive drops out of the array with 400,000 files but continues in service. As the array is used more and more files are added to the array until a few weeks later the server now has 500,000 files on the array. If we do a search now for the MFT magic we will find 125,000 files on the three drives that have remained online, and only 100,000 files on the drive that dropped out of the array several weeks ago. As you can see it is an easy matter to determine that the stale drive in the array is the one with fewer MFT entries.

It must be noted that even though one drive has dropped out of the array it is still a four drive array. The drive that has dropped out of the array becomes virtual. In other words, there is no data written to the drive and all data read from the drive is calculated from the other three drives. For this reason a degraded RAID 5 will run slower since it is calculating the virtual drive on the fly.

This is example is somewhat simplified but the method is sound. I have written a scanner that does all of this automatically and will tell me which drive is the stale one. The software uses a much more enhanced MFT record filter and keeps track of the calculations real time. The software is also available from attending one of our training classes.

I hope this information has been of service to you. If you have any questions I will be more than happy to answer them on our blog which is updated daily or you can call me directly at 727-345-9665 ext 203.

Network Attached Storage NAS and Other Nightmares

bizopps@dtidata.com (Michael Stankard) — Tue, 24 Nov 2009 20:37:28 +0000

Network Attached Storage (NAS) devices have been a boon for storage technology. What a great windfall for the industry. Grab yourself an Open Source operating system, stick it on a prom, get yourself an inexpensive motherboard, some hard drives and presto chango, abbrakadabbra you got yourself a $1000.00 4 terabyte storage device that will mount on the network using a gigabyte transfer rate. NAS is cheap, fast, and easy to setup. However, if you have trouble with a drive, the file system, or the hardware in general, all of your valued data that is stored on your NAS device can be an agonizing nightmare to recover. Unless you call the right company, and they have the right technicians your valued data is probably lost forever and here is why.

NAS devices come with a very nice web like interface. It allows you to configure your NAS device, set permissions, add users, setup stores, so on and so forth. The interface keeps track of the health of your device and has a nice log file that you can print out and look at. However, the underpinnings of a NAS device are meant for the Linux, and BSD gurus of the world who are familiar with terms like LDM, RAIDED LDM, XFS, XFSCK, and many others that would bake your skull. With that being said if your NAS device hiccups there is no real way to get to the device other than the web interface. On some devices there is an RS-232 port on the back of the device that allows you access to a Linux or BSD prompt by terminaling in. I’m not sure what good that will do you considering the file system is probably hosed to the point where it will not mount, or the RAID is degraded so badly that it will take five men and a small boy to try and get it back online. In other words, as long as nothing goes wrong, the device is a dream. BUT! The minute something happens you have no control over your data, and in this industry, it is not ‘IF’ you have a crash, its ‘WHEN’.

I have written several articles on SNAP devices, the file system and how to recover your data. I have also worked on Falconstor which is the subject of this particular article. The following is a recovery I did without using a recovery tool. I used Linux and some tricks to fake out the operating system, and the XFS file system handler so it would mount this four drive RAID five array and allow me to transfer data through the network.

Recovering a badly fragmented Outlook PST file after a few rounds with chkdsk The Final Installment

bizopps@dtidata.com (Michael Stankard) — Tue, 24 Nov 2009 20:27:06 +0000

Welcome back! As before, we still have the problem where chkdsk was run on a RAID with a stale drive. We have had a brief explanation of how NTFS 5 works and how the data is stored on the volume. Lets take a much more detailed look as to how the data is stored in a virtual database and how this helped me recover the PST file.

There are two types of databases. Static, and virtual. A static database is allocated before run time, and the size stays the same. In addition, the record format is usually static as well. Static basically meaning that all the sizes remain the same, and if you want to change a field size, of record size the database must be rebuilt. I used to work in a UNIX database called UNIFY that had both options. The upside to a static database is speed. They are much easier to index and in many cases no index is needed. Record placement in the file is used as indexes. The down side is that if you want to change a record, or a field in a record you must make the change, export the data, and import the data back into the database. You don’t see many static databases anymore if at all, but the database admin and designer really earned there money in the day when this type of database was used.

Another type of database is a ‘virtual’ database. This database has record sizes that are virtual, field sizes that are virtual, and the database itself can grow as large as is allowable by the file system so it is also virtual. The upside to this type of database is that you can make any changes you want to the records, fields, size, data type, etcetera and you do not have to rebuild, or import the data. A database change can be done live. The downside is that you need indexes, and that can cause design issues. Maintenance on the indexes can slow drive access. There is one issue that came to light for the old PST file format which is a virtual database using static data types. Some of the data types used to access offsets in a PST file were INTS which have a maximum value of 2147483647. If this value is translated into bytes then this is 2 GB. Coincidentally, the PST files in Office 2002 and before would corrupt data in files 2 GB or larger.

Why all this talk about virtual and static databases? NTFS 5.0 is virtual. The MFT is virtual, and all file and folder allocation is virtual. The problem with this virtuality is that the main component of a MFT is not virtual. A Master File Table Record is not virtual, it is static. It does not exceed the size of 1024 bytes. That being said, what happens when an attribute of an MFT record exceeds the 1024 byte limit? What happens when a file is so fragmented the a run list grows so large that it outgrows the MFT record?

Microsoft uses a facility called an attribute list. In my next installment I will explain the attribute list and how it plays a starring role in the PST recovery.

We have learned about RAID rebuilding theory. Stale drives in a RAID 5. We have covered NTFS 5 and some of its design components. We have even looked at database design and how it plays a part in the recovery of a data file. Finally, we covered static and virtual database sets, and what to do when they are mixed. Now I bring you the attribute list.

As I stated before, the MFT has a static size of 1024 bytes. It contains all the information about a file INCLUDING the runlist. The runlist is the cluster map of a file and can grow very quickly. One of the things that can cause a runlist to grow is file fragmentation, and when talking about a PST file, fragmentation is the byword.

When a runlist exceeds the confines of an MFT 1024 byte storage limit Microsoft implements a method called an attribute list. To put it as simply as possible, an attribute list is another MFT record that houses ONLY ONE attribute type. In other words, the runlist that was stored in the primary MFT record is now moved to another MFT record that is only used to store the runlist of primary record. The runlist is exactly the same as if it were being stored in the primary record, it is just stored in another area of the Master File Table. The MFT record is EXTENDED by using the attribute list.

There are two components of an attribute list. An attribute type, and the data related to that attribute type. The attribute type is maintained in a data structure called an attribute header. The attribute header has several components, but the attribute type is a flag to tell the file system handler how to process the following data. In this case we have a data type of 0×80 and a data storage type of non-resident. These two attributes mean that we have a data runlist and should process the next set of data accordingly.

The attribute type also has another value which can be -1. This value means do not process the following data and continue to the next attribute type. Now here is where it gets very interesting.

When deleting a set of data Microsoft has ALWAYS left the actual data behind. In the FAT file system the File Allocation Table may have been updated but the File Entry Record was only ‘flagged’ as deleted. A value is placed in the first byte of the record to indicate to the record is no longer in use, and in fact, this space can be used. This is called a ‘virtual’ delete and has been used in databases for years. In NTFS, a flag is also set in the MFT but all of the record data is intact, just one bit in a flag is changed.

With this knowledge I will explain what happened to the PST file and how I used these virtual flags to recover my clients PST file.

Well, if you have stuck with me this far then you have made it to the end. Just to recap, we have a PST file that has a file size of zero, and cannot be recovered. We had a RAID with a stale drive that marked the file system as dirty and caused a chkdsk to be executed. We have an NTFS file system that uses virtual flags to mark data as active and inactive in a database type environment. Lastly, it is important to note that marking data as virtually inactive leaves the data intact. Until something writes over the cluster where the data is stored, the data is not deleted, wiped, or otherwise changed. It remains intact.

The final ingredient to this recovery is the fact that the file was so fragmented that an attribute list had to be used. By storing the attribute list as an extension of the original MFT record it has a data type flag. By changing the flag from a 0×8000, to a 0xFFFF the data is marked as inactive and not to be used by the MFT to find the runlist for our PST file.

So here is the secret to how I recovered this PST file.

The original PST record had index pointers to the MFT records that contained the attribute list data. When the client did the rebuild he used a different drive and this data was not touched. After the rebuild with the stale drive chkdsk ran and marked the file with zero bytes, and flagged the attribute lists type with 0xFFFF. Now, knowing where the attribute lists were stored, and how the flags were set I executed the following steps.

First I took my hex editor and changed the file size to the original file size. I use the size of the cluster map to find the original size. Second I copied the original pointers to the attribute lists into the new MFT record. Third, I changed the attribute type flags from 0xFFFF, to 0×08000. This told the file system handler that the attribute list was now active again and could be used to retrieve the data. Fourth, I used a modified Recovery It All 2008 to move the PST file onto my server. Coincidentally, the file was almost two GB in size. Finally, I used scanpst to cleanup any bad records in the PST. During the rebuild some data got moved and overwritten but 95 percent of the file was recovered.

This was an excellent exercise and I really enjoyed this recovery. I hope you learned something, I know I sure did. Take care, and as always…

Learn more about RAID 5 data recovery here.

Data Recovery Forum Questions Answered PST Recovery and Hard Drive Not Detected

bizopps@dtidata.com (Michael Stankard) — Tue, 24 Nov 2009 20:22:05 +0000

So I trolled the Internet for topics to write about and found tons of forums with very good questions not being answered so I am going to post the questions and then give you the best possible answer I cam up with.

Q: Yesterday I was cleaning out the rubbish from my PC, as it was getting a bit slow. Along the way I deleted an old user account folder from Documents and settings on my C drive.
Later that day I went to check my emails only to find my PST file was missing. at which point I remembered it was in the old user folder. I started looking for software to recover this file. The file is about 1GB and has lots of info that I need.

A: Their are a a bunch of schools of thought on this recovery method but generally they are all just that THOUGHT. You have to take into account a ton of different variables. The first being how much data was applied to the drive after he deleted the PST file. My guess would be a lot since he eludes to the fact the drive was full in the post. If the drive was being written to at all recovery options are dropped DRASTICALLY since the data is more then likely gone due to an over write. If there was no data put on the disk after he deleted it, then the best course of action would of course be an piece of software that could UNDELETE the file. As a last ditch effort I would sometimes recommend that the customer try some for of raw file harvesting but the drive will have to been defragged on a regular basis other wise the file will be all over the hard drive and the harvester will not be able to locate all of the pieces.

Q: I got an old Dell Dimension 3000 laying in pieces on my hardwood floor… and I can get other hard drives to read in it, even get an operating system to boot, and such. No issues.. But when I try to put this… Seagate Barracuda 7200.9
160GB hard drive in, it will not detect it, at all. Pulled up the bios, planning on inputting everything manually into it… But I can’t seem to find the option to do it… I can change the “Master drive” from … “Auto” to “Off” and that’s it.
I’m curious if there’s a way to know if the bios is compatible with this hard drive… if there’s a way to find out if it is, or isn’t.. Or just something I’m completely lacking intelligence on figuring this thing out. Seriously need this computer up with this hard drive. I can still access the drive from my computer… But I’m worried that if the HD Is infected.. IF it would infect my other HD’s… and I don’t want that to happen. I currently run No anti virus. I tend to avoid virus’s pretty easily, and very rarely actually get hit with them. and when I do, it’s usually pretty simple for me to remove them because I catch them pretty instantly..

A: So here is the deal this is a boot drive from another computer, slaving it into the machine COULD be causing some kind of “which drive should boot” conflict. The second problem he could have is that the bios is too old to see the drive, that it doesn’t support LBA mode or something strange like that. My personal recommendation would be to pull the drive out and get yourself a USB enclosure this will take all of those other issues out of the equation and then you can just deal with the OS seeing it which will make things much easier. It is a trick we use as a data recovery company when either Windows is having trouble booting with a certain drive in it or when we can not get the bios to see a drive.

Do It Yourself Dual LCD Monitor Stand

bizopps@dtidata.com (Michael Stankard) — Fri, 20 Nov 2009 16:52:52 +0000

Cheap Do-It-Yourself Dual LCD Monitor Stand

OK, so I was really wanting a dual monitor stand for my two LCD flat panel monitors, mainly to get them up off the desk more to give myself more desk space and to raise them up higher. The cheapest I could find one for was around $80.00, so I decided to attempt to build my own. I did a little research and saw how other people were building theirs and came up with my own design (based on the size of the LCD’s, the height I wanted them and distance, angle, etc…) I am SURE there are much better ways of doing this, but I wanted to keep it rather inexpensive. Total cost of all parts came to around $25.00, give or take a few dollars.

Design:

First come up with a design. Measure your two monitors and find out the length of pipe you will need.
Here is a scan of my original design:

Parts:

I chose to build it out of Galvanized plumbing pipe. I used ¾” for the base and used a reducing coupling to make it ½” for the rest. I also decided to use a 45 Degree elbow to have the monitors at an angle to each other. The LCD mounts I cut out of plywood scraps.
Here are the parts I used:

Assembly:

Putting it together:

After painting it black:

Mounted to desk:

Make sure you have mounting hole measurements correct on the LCD mounts. I had to go back and redo several times because I had measured the holes to be exactly 4” apart and it turns out they are not exactly 4” apart. Also getting the correct machine screws gave me a problem. #8 – 32 screws appeared to be the right size, but it turned out I needed metric size 4mm for the back of the monitors.
Mounting first monitor:

Finished!