Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Show Sponsors:

ReclaiMe Pro-The All-in-one highly configurable Data Recovery Software.

For a Free 14 day trial go to ReclaiMe-Pro.com

Use the offer code PODNUTZ for a 50% Discount

Links:

5-day Data Recovery Expert Certification Class 

Location: Washington DC
Date: May 23rd 2016 – May 27th 2016

Now is the time to learn Data Recovery & Forensics. Check out this class where you will get hands on with Scott Moulton himself to learn everything you need to know to propel your business forward.

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Links:

5-day Data Recovery Expert Certification Class

Now is the time to learn Data Recovery & Forensics. Check out this class where you will get hands on with Scott Moulton himself to learn everything you need to know to propel your business forward.

Show Sponsors:

ReclaiMe Pro-The All-in-one highly configurable Data Recovery Software.

For a Free 14 day trial go to ReclaiMe-Pro.com

Use the offer code PODNUTZ for a 50% Discount

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

5-day Data Recovery Expert Certification Class

Nov 9^th-13^th 2015 in Atlanta Georgia

Now is the time to learn Data Recovery & Forensics. Check out this class where you will get hands on with Scott Moulton himself to learn everything you need to know to propel your business forward.

Links:

Kingwin HDD Power Switch Module 6 Switches for 5.25-Inch Bay (HDD-PS6)

WinHex Hex Editor

R-Studio  with a built in Hex Editor

010 Editor

SmartCTL

StableBit Scanner

ViceVersa

Show Sponsors:

ReclaiMe Pro-The All-in-one highly configurable Data Recovery Software.

For a Free 14 day trial go to ReclaiMe-Pro.com

Use the offer code PODNUTZ for a 50% Discount

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Links:

PC-3000

Hddunlock.com

010 Editor

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Links:

T862++ Infrared Rework Station

Raid 6

SAS

Racetrack Memory

Cyber Conference

Victoria Hard Drive Tool

X-ways Forensics Imager

ViceVersa Pro

SelfImage

MHDD

HDDGURU

DBAN

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Show Sponsors:

Try ReclaiMe Pro Today for Free/Use the offer code PODNUTZ for a 50% Discount when you decide to buy.

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Links:

AHCI Driver after Windows Install- Article 922976

R-Studio

Write Blocker inline hardware

Ultimate Boot CD-MHDD

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Links:

Adroit Photo Recovery

Adroit Photo Forensics Recovery

Stellar Phoenix-Mac Data Recovery

R-Studio

Pandora Recovery

CGSecurity.org-TestDisk-PhotoRec

ProSoftEng.com-Datarescue+ for Mac run on a Mac

Runtime.org- GetDataBack NTFS Classic or Simple

MaQuisition from BlackBag Technologies

ShadowExplorer.com

Vssadmin

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Links:

FTK Imager

3 ware SAS Controller

Dd Rescue

ReclaiMe- Free Raid Recovery

R-Studio_Hard Drive Recovery

ViceVersa pro

Hard Drives, Data Recovery, Forensics & More

Hosted by: Jeff Halash from TechNutPC.com

Scott Moulton from MyHardDriveDied.com

To send a voicemail, call 1-888-697-0162

Email: MHDD@podnutz.com

Seagate launches 500GB hard drive for tablets, blurs PC lines – http://www.zdnet.com/seagate-launches-500gb-hard-drive-for-tablets-blurs-pc-lines-7000020403/

Forensic File Systems: In-depth File System and Forensic Imaging Location: Atlanta, Ga Date: November 4th 2013 – November 8th 2013 – http://www.myharddrivedied.com/data-recovery-training/forensic-file-systems-depth-file-system-and-forensic-imaging

Hosted by DoorToDoorGeek aka Stephen McLaughlin and Scott Moulton of MyHardDriveDied.com.

Episode #19

We talk about Demetri mhdd32 4.6 atola

Scott has a bunch of upcoming classes

5-Day Bootcamp Expert Certification Class Santa Cruz, CA

August 19th 2013 – August 23rd 2013

5-Day Bootcamp Expert Certification Class Atlanta Georgia

September 16th 2013 – September 20th 2013

5-Day Bootcamp Expert Certification Class Washington DC

October 14th 2013 – October 18th 2013

File system class is the Atlanta Georgia September 16th 2013 – September 20th 2013

Next SD card standard SDXC – http://en.wikipedia.org/wiki/Secure_Digital#SDXC

New USB tool for forensics and data recovery http://atola.com/products/insight/

To send a voicemail call 707-6PODNUT (707-6763688)

Email: mail@podnutz.com

To support Podnutz please use the following links, and remember you don’t pay any extra for using the links !

Podnutz Amazon link (http://www.podnutz.com/amazon)

Podnutz Newegg link (http://www.podnutz.com/newegg)

Podnutz Ebay (http://www.podnutz.com/ebay)

Podnutz Deals (http://www.podnutz.com/deals)

Hosted by DoorToDoorGeek and Scott Moulton of MyHardDriveDied.com.

Hosted by DoorToDoorGeek and Scott Moulton of MyHardDriveDied.com.

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

Scott and I talk extensively on SSD this episode.

TOPICS DISCUSSED:

Upcoming Conferences

Outerz0ne (Mar 19, 2011 – Atlanta, GA)

New Website
Check out our new website at MyHardDriveDied.com.
Check our Presentations & Resources

Data Recovery Flowchart
A sample of my thought process on diagnostics for hard drives.
Download Here: < Diagnostic Flowchart >

The ShmooCon 2011 Slides and Animations:
After you download the 65meg file, unzip and open .HTM & it will run the presentation. <
Download Slides >
Shmoocon 2011 – Video: < Click Here >

Video Podcast Explaining Spindle and Bearing Replacements

1 Ton Arbor Press

Top of Form
Digital Caliper
Bottom of Form

Upcoming Conferences

Mar7 thru 11-2011

Notes by Jorge Hernandez of 123ComputerRepair.com

Washington, DC

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

TOPICS DISCUSSED:

Backup Solutions
DropBox
Carbonite
Mozzy
LogMeIn Backup
iDrive
Windows Live SkyDrive
CrashPlan

Racetrack Memory
Computer memory that’s 100,000 times faster.
We may soon have computers that boot up instantly, use less energy, and run much,
much faster.

Solid State Drives (SSD)
Data recovery requires relearning new technology, not software based yet.

NAND Flash
A type of Flash Memory technology.

Email question from Stevo:
Q: Using SpinRite to recover bad sectors compared to chkdsk.
A: SpinRite is definitely a much better tool than chkdsk.
The main purpose of chkdsk is to get your drive back to a bootable estate even if it has to kill
some data.

Email question from Mike:
Q: Recovering pictures from a dead USB drive using PC-3000 Flash.
A: This is a major project, you have to unsolder the memory, decode the chip, etc.
Cost of this device is around $4,800 which makes it impractical.

Q: If I buy an identical USB drive (same manufacturer, model & capacity) assuming the problem
is the controller chip; could I swap the memory chip and recover the data?
A: That would be the best possible choice but the problem is to confirm USB drive is indeed

identical.

Email question from Leaf:
Q: IDE to SATA Bridges recommendation
A: No particular brand, buy in bulk and choose a particular chip; will need to be more specific on
a next show.

Email question from Simon:
Q: Hard drives manufacturers recommendation
A: The main 5 manufacturers are: Samsung, Toshiba, Hitachi, Seagate & Western Digital

Toshiba is not commonly seen on US data recovery labs.

Not a fun of Samsung drives but they are taking over the solid state market.
Rumor is that Samsung may possibly buy Seagate.

Seagate has a lot of head problems and firm ware problems, board problems also and lots of
things getting fried.
Western Digital has a lot of head problems and also known board problems.

Hitachi is the one that reports fewer problems.

Upcoming Conferences

Dec-6 thru Dec-10/2010
Washington, DC
Jan/2011
DC3 Forensics Atlanta

Jan-28/30, 2011 ShmooCon 2010

Washington, DC

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

TOPICS DISCUSSED

Scott on an international traveling schedule (Spain, France, United Kingdom, Scotland).

Visiting Spain, testifying in a forensic case. International laws are extremely different compared to US laws.
Spain is under a Napoleonic code, if you lie you simply go to jail.
Not being able to speak Spanish required a translator and in a technical case this is not fun. 

Seagate HAMR Drives
Seagate successfully demos Heat Assisted Magnetic Recording (HAMR) technology.

HAMR aims to increase areal density by more than 100 times.

Technology could store up to 50 terabits of data per square inch.
It pushes the limits of magnetic recording.

It records data magnetically on high-stability media using laser thermal assistance.

DEF CON 18
Las Vegas (July 29th – August 1^st 2010)

NAND Flash Memory

Seagate drives adding 4GB NAND flash memory to the board 

exFAT (Extended File Allocation Table)
Is a proprietary file system introduced by Microsoft (Windows Embedded CE 6.0, Windows Vista, Windows 7, and Windows Server 2008). 

JFFS (Journaling Flash File System)

Is a log-structured file system for use on NOR flash memory devices on the Linux operating system. It has been superseded by JFFS2. 

HFS (Hierarchical File System)

Is a file system developed by Apple Inc. for use in computer systems running Mac OS. 

HPFS (High Performance File System)
Is a file system created specifically for the OS/2 operating system to improve upon the limitations of the FAT file system. 

Racetrack memory is an IBM project led by physicist Stuart Parkin.
GMR heads available on all current drives were originally designed by him. 

EMAIL QUESTIONS

Luis
Q: Do you have a recommendation for a DOD hard disk repair station?
A: Some of the tools I use is what I believe the DOD may be looking at:

DeepSpar Disk Imager (DeepSpar Data Recovery Systems)

Allows imaging data for selected types of files and directories

PC3000 is the premier data recovery tool accessing hard disk drives at a firmware level 

Ben (Check his podcast at Qetuo)

Q: Please explain de difference between a PRIMARY and EXTENDED hard drive partition in windows and is there a difference when recovering files?

A: There is indeed a difference when recovering files. With the current MBR (Master Boot Record) you can only have 4 possible partitions.

Primary simply means I can boot from it. You can have 3 primary partitions and 1 extended partition. Extended means I have a partition inside a primary partition.

Partitions are extremely important during the recovery process.

Ben

Q: Should you replace a 9 year old drive with 5 power on years?

A: As drives age, the lubrication and fundamental components start to deteriorate. Make sure you run a full backup on a drive before replacing it.
Western Digital and Seagate drives are the two primary selling drives and more failures are expected (common boards and head assembly problems).

Hitachi drives run well but when physical damage is present, heads tend to fail and scratch the platter.

Harun (Manchester, UK)

Q: SMART is not a reliable indicator of a hard drive health, what can be used instead?

A: There is really nothing out there. Simply said, there is no way to tell when your hard drive is going to die.
MHDD will give you a count of bad sectors only; it will give you a good idea on the conditions of the drive.

Roger

Q: Are the Western Digital “Black” drives worth the price premium and what are the main differences of those drives compared to the Western Digital “Blue” drives?

I know the black drives offer longer warranty but I’m wondering if they are built different or with better parts.

A: Typically GREEN means cheapest, BLUE is the mid line range, and BLACK is the more expensive and yes built with better components and higher speeds.

It is worth the price if you’re concerned about speed, not reliability. Survival rate may not be good because of their high speed and how hot they get.

Steve Damico

Q: Is it smart to store an external Western Digital drive inside a safe in a garage (New York area, cold winters).
A: Temperature greatly affects, metal contracts when it’s cold and it can cause a severe death. It is recommended to wait at least 24 hours before the drive adapts itself to inside temperatures, then maybe it will work OK and no harm will be caused.

ISD (InfoSec Daily)

Matthew Shoemaker left us on Friday, July 30, 2010.

Matthew M. Shoemaker (1973-2010)

The Shoemaker Memorial Care Fund has been established to provide for his children at The Peoples Bank, P.O. Box 788, Winder, GA 30680.

Make a Donation to Matthew Shoemaker Memorial Fund via PayPal also.

Next Data Recovery Classes
Las Vegas  Sept 20^th – 24^th 2010
Dallas   Oct 11^th – 15^th 2010

Washington DC  Dec 6^th – 10^th 2010 

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

Email question from Jerry:
Q: A remapping function in MHDD won’t kill your drive; you may lose your data but it won’t kill your drive. True or false? 

A: Remapping is not supposed to lose your data, it reads the data from the drive and it will relocate it. Similar to what SpinRite does.
If the reading time takes longer than expected (i.e. 350ms) then it will mark the sector as bad. 

Email question from Jorge:
Q: I have an old disk from a customer, I’m trying to extract data from it but every time I connect the drive via a USB connector I get prompted with this message: “You need to format the disk before you can use”. I already checked the jumper settings, even tried setting up the drive as a slave on an old computer and still no luck. Yes I tried Ultimate Boot CD and Knoppix and “nada”.

A: The USB connector is the biggest problem, you do not get true feedback using a USB connector; it’s not the native way to talk to the drive, USB does not respond to all the ATA commands. You need to find a good motherboard that will support the correct ATA specs for the drive, you will have a better chance to access data on this drive. A good tool to use for this would be R-Studio which is an all-in-one tool that supports: Mac, Windows, Linux, Dynamic Raid, etc. The cost for this tool runs for around US$79.00.

Email question from Mad Marv:
Q: How can I recover data from a RAID5 array if I only have the hard drives and not the server they were installed in. I do not have the raid controller or motherboard; I think these disks came from a Windows Server 2003. I’m fairly sure the RAID itself is undamaged and was working when the drives were removed from the server.

A: This is a very long topic; a video is available for this particular topic which I call “The mystery box”. The best we can hope for is that the drives were properly numbered when they were removed from the server but this is never the case. Again, using R-Studio you could rebuild your drives. Take all the drives and connect them via USB controllers to your windows machine and then create a fake or virtual array.  

Recover your PORN from your RAID Array! (PDF 3.5MB)

YouTube Video – Defcon17 Hard Drive RAID Recovery

Scot’s YouTube channel: SuperFlyFlippingA

Email question from Oliver:
Q: I’m an ICT service manager in Hastings (UK), we have a problem with students putting the hard drive passwords on our laptops in the BIOS.

These are Western Digital 160GB Scorpio drives, I loaded VICTORIA but it requires the password to unlock the drives.

Is there a way to unlock these drives?

A: The password is done in firmware; using VICTORIA or MHDD requires you to know the password.
There are 2 types of passwords: Master Password and User Password. The laptop manufacturer will usually set the Master password.

Master Password for Western Digital drives is:
WDCWDCWDCWDCWDC WDCWDCWDCWDCWDCWD

PC3000 is the premier data recovery tool accessing hard disk drives at a firmware level

HDD Unlock is a user-friendly application which allows you to easily remove HDD password.
IDE and SATA hard disk drives are supported. Both User and Master password can be removed

Email question from Stevo:
Q: I need to know if he has a preferred brand of standalone drive to drive unit he recommends. I just purchased a Bytecc T-203 hard drive docking stations. It’s a standalone duplicator.
A: I’m not very impressed with Bytecc, there are other imaging tools that I prefer such as DeepSpar Disk Imager

Email question from Roger:

Q: I want to hear what Scott thinks about CHKDSK /R and if he recommends using it.

A: This is a dangerous tool, it is a very dumb piece of software; in some cases it simply eats your records/files.

Next Data Recovery Classes
San Diego  May 10^th – 14^th
San Francisco  June 14th -18th

Atlanta   July 12th-16th

Dallas   October 11th – 15th

Washington DC December 6^th – 10^th

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

TOPICS DISCUSSED:

Now available for the very first time on Scott’s training labs DeepSpar Data Recovery Systems (Product: DeepSpar Disk Imager)

Scott Moulton at Tekzilla
MyHardDriveDied.com’s Scott Moulton talks hard drive recovery tools (Thursday, April 29th, 2010)

Email question from Stevo:

Q: Can you go into more depth exactly on how to use Victoria? 

Victoria is a freeware program for low-level HDD diagnostics, supports these interfaces: IDE and Serial ATA.

Scott normally uses MHDD as a DOS version and Victoria as a Windows version. 

USB connectors are horrible to do diagnostics; it uses a windows driver to communicate with the drive (not good).
It’s better to have the hard drive physically connected to the controller (motherboard) via SATA or PATA.

You could use an ESATA card (ExpressCard) on a laptop to run diagnostics on a drive as opposed to USB 

Email question from Stevo:

Q: If you swap out slower sectors to the G-List (bad block list), can’t you just defrag the drive in order to get them back in line so you’re not flying all over the drive for data?

This has nothing to do with defragmentation. Defrag is more from a file aspect not a physical low level.

You can try to avoid every bad block and never use them but you don’t know what they are.

MHDD and Victoria can be used to turn off bad blocks.

Bonnie++ is a benchmark suite that is aimed at performing a number of simple tests of hard drive and file system performance.

The ZCAV program (Linux Tool) tests the performance of different zones of a hard drive. It does not write any data.

Hard drive defects table 

The G-list table (Growth-LIST)
A table of hard disk sectors that have gone bad after the drive was placed in use.
It does reduce drive access speed and it may become necessary to replace the drive.

The P-list table
Bad sectors encountered during post-manufacture testing are contained within a defect table known as the P-list.
P-list sectors have no effect on drive access speed as they are automatically omitted by the drive electronics. 

System Track Area:
The system track area of a hard drive is data that is written by the manufacturer and works in conjunction with the logic control circuitry.
If the system track becomes corrupted, the drive can show symptoms of physical failure on many levels.
It is an extremely complex area of the drive and often very difficult to diagnose and repair.

Email question from Stevo:
Q: What can you do with the data you get back from MHDD. What corrections can you make with the software?
Both Victoria and MHDD do the following things:
– A sector by sector analysis of your hard drive
– Remap and relocate bad sectors to a different section of the drive
– Display SMART data 

Q: Is it better to clone a drive or to do a backup?
Backup normally connects the drive via a USB connector, the head trashes around across the entire disk (potential damage)
Using KNOPIXX does not read the entire drive (which is good) 

NTFS Master File Table (MFT)
The Master File Table or MFT is the place where information about every file and directory on an NTFS volume is stored.
The MFT is in essence a relational database table that acts as the starting point and central management feature of an NTFS volume. 

Ddrescue – Data recovery tool (Linux Utility)
Data recovery tool that copies data from one file or block device to another, trying to recover data in case of read errors. 

Email question from Andrew:
Q: Not using USB interfaces, does that mean those adapters used to connect external hard drives via external USB connectors?
Using USB is not a good start for data recovery, there is no error control, it’s better to connect the drive to the motherboard instead.
Things may change with future USB 3.0 technology. 

Q: Can you provide more information on MHDD and the error codes it gives back?
The forums is the best place to go for additional information on this particular utility 

Shadow Copy
Is a technology included in Microsoft Windows that allows taking manual or automatic backup copies or snapshots of data.
It is implemented as a Windows service called the Volume Shadow Copy service.  

DEF CON 18

Next Data Recovery Classes
San Diego  May 10th-14^th
San Francisco  June 14th-18^th
Atlanta   July 12th-16^th
Chicago  September 13th-17^th
Dallas   October 11th-15^th
Washington DC December 6th-10^th

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

My Hard Drive Died #9

Scott Moulton

Computer Forensic and Data Recovery Services

www.MyHardDriveDied.com

Topics discussed:

Question from Steve:

Q: How did you get started in the Data Recovery industry?

A: I started repairing hard drives when I was a member of the IT staff at NICS (Network Installation Computer Services).
I have no formal training; everything that I know has been self-taught based on trial and errors and many years of experience.

New Data Recovery Process

Surgical cloning allows extracting data based on selected Files/Directories instead of having to clone the entire drive.
It avoids having to read the entire drive and cause possible damage during such reading process.
Extracting a single folder (My Documents) from a 60GB drive took only about 10 minutes.

A standard cloning procedure on the entire drive would’ve taken about 2-3 hours.

Software Intelligence Cloning Companies

Salvation Data (Product: Data Compass)
A disk data recovery equipment built to extract data from failed hard drives

DeepSpar Data Recovery Systems (Product: DeepSpar Disk Imager)

Allows imaging data for selected types of files and directories

Master File Table (MFT)

Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT).

New Western Digital Drives (4K blocks)
Western Digital has started shipping drives that drop the ancient 512 byte disk sector for a 4k sector.
Advanced Format is the term to which Western Digital refers to its latest 4K products.
The main purpose is to increase capacity and to provide faster speed.

New Data Recovery Tool
Computer Science Labs’ Spindle, Extraction and Replacement Tool (SERT) is used for the precision removal and restoration of multiple platter hard disk drive systems where spindle bearings or motors have seized or failed. SERT addresses the most evident manufacturer types.
SERT Video

Past Conferences

ShmooCon 2010 (Feb 5 thru 7, 2010 – Washington, DC)
Security conference & Data Recovery

Scott’s presentation “Understanding a Broken Drive” and YouStream Video

Hackerpaces

Community-operated physical places, where people can meet and work on their projects.
This website is for everyone who started or wants to start their own hackerspace.

List of hackerspaces

Arduino

Arduino is an open-source electronics prototyping platform based on flexible, easy-to-use hardware and software.
It’s intended for artists, designers, hobbyists, and anyone interested in creating interactive objects or environments.

Upcoming Conferences
Outerz0ne 6 (Mar 19 thru 20, 2010 – Atlanta, GA)

Next Data Recovery Classes

Washington DC  Apr 12th-16th

San Diego   May 10th-14th

San Francisco  Jun 14th-18th

Atlanta   Jul 12th-16th

Chicago  Sep 13th-17th

Dallas   Oct 11th-15th

Washington DC  Dec 6th-10^th

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

Topics discussed:

Upcoming Conferences

Feb/6  Washington, DC
ShmooCon 2010 Security conference & Data Recovery

Link to PDF presentation 20MB <Click Here>

Feb/9–13 Atlanta, GA
Hardware and Software data recovery, how to start your own company, etc 

Average Forensic / Data Recovery Job
Civil Cases / Private Investigators $2,500 to $3,000 12-15 hours
Criminal Cases    $5,000 to $10,000 Hard Work

Hard Drive Cleaners
Electronic stores normally have cleaners available that can be used to clean boards

There are different levels of cleaners (corrosion, circuit boards, heads, etc)

Pure alcohol will work in most situations
3M sells a head cleaner at a cost of around $1,000 per ounce

Email Question:

Chris
Q: How to recover data from a drive that spent time under water
A: Platters may be in good shape, electronics also may be in good condition, do not dry the drive; corrosion may damage the drive

Chris
Q: How to recover data from an SD card that no longer shows the correct CHS (Cylinders Heads and Sectors)
A: Solid State is still a struggle for data recovery, only few people in the US are capable of doing this, imaging is an available option,

Solid State Drives – YouTube Video

Chris
Q: How to recover data from an NTFS partition that was formatted as EXT3 (Linux Journaling File System)
A: Only few records and tables are lost, unless it’s the new windows long format (it will wipe the drive clean) 

Light Peak Technology
Intel’s new technology which delivers high bandwidth starting at 10Gbps.

Miscellaneous protection and recovery tools:
Faronics DeepFreeze
Shadow Copy
ShadowExplorer
Windows SteadyState
RecoverMyFiles

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by: Scott Moulton of MyHardDriveDied.com and Steve Cherubino of Podnutz

Topics discussed:

New Seagate SSD (Solid State Drive)

Large drive, looks like a blade server, about 200GB in size

Handles 30,000 Read operations per second and 25,000 Write operations per second

SSD Intel-X25M handles 5,000 Read operations per second, priced around 1TB for $2,500, 512GB for $1,200

A normal 72rpm SATA drive handles 90 operations per second

SCSI drives handle 180 operations per second, they are more reliable and intended for servers

ColorSpace UDMA

World’s fastest & most advanced memory card backup

ioDrive

The ioDrive is a revolutionary new solid state technology that dramatically increases bandwidth and application performance

Solid State device on a card, high speed (server based device), made by Fusion-iO

Flash on card, has its own processor for faster data processing

Handles 80,000 operations per second, largest ioDrive available is 80GB

Review by Steve Wozniak

Phreaknic
Second longest computer conference (13^th year, approximately 250 participants)

October 30th-31st, 2009 (Nashville, TN)

DIY Hard Drive Diagnostics: Understanding a Broken Drive
< Link to the Speech Slides > PDF: Big – 39 Megs

MHDD
Is the most popular freeware program for low-level HDD diagnostics

Chip Quik SMD Removal Kit

Low melting point soldering tool

YouTube Video à SMT Soldering Class (Courtesy of: CuriousInventor.com)

YouTube Video à How and WHY to Solder Correctly

Heat Resistant Tape

Protects the motherboard from soldering heat

Hard Drive Motor Problems

< Link to the Speech Slides > PDF: Slides 71 thru 79

Companies that provide Data Recovery Tools & Services

HDRCOnline (India)

SalvationDATA (China)

Question:

Blaine

Q: Does Harmonic Vibration causes performance degradation in modern hard drives?

A: Scott ventures to say “No”, drives are supposed to adjust to their own environment; heat may cause expansion but small vibration will no degrade the performance.

Q: Can you please compare MHDD to SpinRite?

A: MHDD is free, uses a remap function (moves bad sectors to bad blocks section).
SpinRite reads bad sectors and will run complex read algorithms trying to recover such bad sector, writes to the same drive
Media Tools Pro writes to a different destination drive (much better than SpinRite)

Data Recovery Classes

http://www.myharddrivedied.com/presentations_classes/

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

Topics discussed:

Phreaknic
Second longest computer conference (13^th year, approximately 250 participants)

October 30th-31st, 2009 (Nashville, TN)

DIY Hard Drive Diagnostics: Understanding a Broken Drive
< Link to the Speech Slides > PDF: Big – 39 Megs

How to know what’s wrong with your hard drive

Let’s think about the problem first, let’s listen to the sounds before we disassemble a drive

Stop and think about the problem first, do not take the lid off

It could be a Firmware, Head, Board, Motor or Platter problem.

Seagate and Western Digital have exceptions: replacing the head or known firmware problems

Five Phases of Data Recovery
1) Diagnostic Copying/Imaging the drive

2) Repair Repair the drive, requires hardware or special equipment

3) Image Image, Copy or Recover the physical drive
4) Recovery Perform Logical Recovery of files

5) Repair Repair files or partitions, re-assemble data

Absolutely do not ever run any utilities on the original drive until you image it

CheckDisk, FIXMBR, FIXBOOT, say no to SpinRite (it writes data to the same drive, instead of a destination drive)

Media Tools Pro Data recovery and forensic tool

Do not use USB connectors

It is a dumb connector, it doesn’t handle ATA commands, cannot handle errors very well,

Connect a drive directly to a motherboard instead.

Ultimate Boot CD for Windows
Includes MHDD which is the most popular freeware application for low-level HDD diagnostics.

VICTORIA Russian utility
DDRescue Data recovery tool, copies data from one file or block device

MyRescue A program to rescue the still-readable data from a damaged hard disk.

Recovery Services/Sites

Pandora Recovery
Ontrack Data Recovery

Imaging Software
Only works on good working drives, they do not deal with a physical damaged drive
Acronis True Image, Drive Cloner Rx, Micro-Scope Diagnostic Suite

Chip Quik SMD Removal Kit

TVS Chip

Power Supplies
The heavier they power supply is, the better it is.
Brands: Antec, Cooler Master,

Light Peak Technology
Light Peak is a new high-speed optical cable technology which delivers high bandwidth starting at 10Gb/s.
At 10Gb/s, you could transfer a full-length Blu-Ray movie in less than 30 seconds.
Intel discovery, connects drives via optical interfaces.
Coming to motherboards around 2010.

Email question:

Jeff:
Q: 160GB WD drive, detected as a WDC Rom Model, Drive will click 3 times, MHDD reports a recall fail, what could be the problem?
A: The system area wasn’t read correctly, could be problems with: head, preamp, scratch on the platter or board/firmware damage.

Data Recovery Classes

http://www.myharddrivedied.com/presentations_classes/

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

In this show we cover:

• Story about the Keynote at The Computer Forensic Show – www.techfusion.com

• Discussion about overwritten hard drives and how and why people think there is some magic machine that can recover data

• REDIRECTION of bad blocks leaving data on the hard drive that is not overwritten

• How you can properly overwrite current hard drives

Topics Discussed

• Computer Forensics Show‘s keynote speaker, described how overwritten data was restored, but the conference was not anywhere about that.
• Back in 80’s Drives worked like floppies making the recovery of overwritten data was maybe possible, with a very high error rate.
• Hard Drives that had been made about 10 years ago are a completely different thing, making it more impossible to recover overwritten data.
• An equipment called a Magnetic Microscope to try to recover data.
• An other equipment called Spin Stand to try to recover data.
• Disks have a “reserved area” to store information from the bad block, also called P-list
• A G-list is a list of bad blocks for the disk not to use them again.
• A good idea is to look for the S.M.A.R.T. results before the HD crashes.
• If there’s a S.M.A.R.T. warning it would be a good idea to change your drive.
• How to Properly Overwrite HD? Use the ATA Command to erase and overwrite HDs, doing a DoD sanitation.
• A program written by Dr. Gordon Hughes from the Center for Magnetic Recording Research
• A software tool used is Boot and Nuke (DBAN)
• Tools to recover data, PC300, Atola, among others.
• Data Recovery classes.
• Is it ok to freeze a Hard Drive? Scott says it’s not the best solution, it might cause damage the drive, but sometimes it might work.
• Maybe try the refrigerator first before the freezer, not to cause to big of a temperature change.
• Tip to use instead of freezing: use a USB cooler (small refrigerators) to cool the HD and keep it cool, Scott uses an aluminum bay and hook up a couple of these ceramic pieces to keep the HD cool.

Thanks, and out -click-

Show Notes by Luis Perez from GeekForce Guatemala

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

This episode covers many topics such as:

• Why you shouldn’t open western digital drives before sending them in to Scott
• Ractrack memory, what is it?
• Deepspar Disk Imager
• SSD and large drives in laptops
• Setting up your own NAS box

Topics discussed:

Steve:
Q: Scott, when you get drives in your business what’s the biggest problem when you try to fix them?
A: One of the biggest problem is people sending open drives to be repaired.
Western Digital drives definitely should not be open. Once the screws are out of the lid, the lid is part of the alignment.
Users should practice first with old spare drives that may be available to them.

SCSI Drives (Small Computer System Interface)
Scott believes SCSI drives are the more reliable drives available in the market.
Most servers rely on SCSI drives. They are more difficult to extract data and require a different set of equipment.
Reliability is based on: lower density, made with better components, chips have been tested longer, head assembly are more robust, and they’ve been around for 30-40 years.

Steve:
Q: What’s the most reliable brand of drives?
A: No preferences on a specific brand but be careful with Samsung and Western Digital drives. Hitachi is very stable.
Using a RAID array is the most reliable way to go because you have redundancy.
FreeNAS is a very inexpensive way of setting up a NAS on your network, just add a $100 RAID card on an old machine, several drives and in 5 minutes you’re setup. Everything is configurable via a browser, easy to setup.

Microsoft SkyDrive – 25 GB of free storage
Gladinet will mount SkyDrive as a local drive on your computer allowing you to run a backup via the cloud
Gladinet Cloud Desktop Introductory Video

Available online backup options:
Bandwidth is the biggest limitation, not practical for disaster recovery situations
Mozzy, Carbonite

Apple Time Machine:
Not as practical as they show it on TV. Recovering a single file may not be a simple thing to do.
The option to show “Previous Versions” available in Windows is not available in a Mac.
Windows Vista and Windows Server 2003 & 2008 already have space already design to duplicate/backup files.
Performance is affected but not a big impact.
A right-click on any given file will show a list of multiple previous versions available on the local drive.
This is an extremely helpful tool in forensic.
Microsoft should promote this feature more via an extensive marketing campaign.

Drobo Storage Products
Simple, scalable, reliable data storage solution, easy to setup.

Does not perform as fast as people expect, does a better job with redundancy; attempts to do compression on the fly.

Don’t mix drives with different sizes; stick to same size drives; RAID5 is the best algorithm Drobe will attempt to use.

http://www.drobo.com/

DeepSpar Disk Imager
This is a disk imaging device built to recover bad sectors on a hard drive.
Built to handle disk-level problems and to recover bad sectors on a hard drive.
Excellent tool for forensic people.

Laptop Drives
The largest the drives are, the less reliable they are and harder for data recovery
Laptops with 750GB drives have already started to hit the market
1TB drives have been released but are a little bit thicker, they do not fit very convenient; seen more on external devices or Play Station-3
New 1TB SSD drives cost around $2,200 right now, they are a higher potential risk. Once it dies, it’s gave over, age poorly, speed is not recoverable
Spinning drives will not go away on Servers or Desktops yet.

NAND Flash Memory

Storing data in solid pieces of metal?
This will be the first time in history that we ever store data without making a change to the state of an atom.
Racetrack memory is an IBM project led by physicist Stuart Parkin.
GMR heads available on all current drives were design by him.

Data Recovery Classes

http://www.myharddrivedied.com/presentations_classes/

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by: Scott Moulton of MyHardDriveDied.com and Steve Cherubino of Podnutz

Topics discussed:

DEFCON 17

DEFCON is the world’s largest annual hacker convention, held every year in Las Vegas, Nevada.
The first DEFCON took place in June 1993, and in 2008, over 8500 people attended DEFCON 16.

Many of the attendees at DEF CON include computer security professionals, journalists, lawyers, federal government employees,
crackers, and hackers with a general interest in computer code and computer architecture.

Scott demonstrated how to repair a RAID Array by looking at picture.

Samples of pictures from a hard drive will give you an idea on how many disks there are, how many slices, what the slice size is, which order the disks go in

MP3 sound files can also be put together using the same approach as Scott uses with samples of pictures

A presentation via YouTube is available showing you piece by piece how this all works à Defcon 17 – RAID Reconstruction

Upcoming Conferences

Sep/2009 HTCIA High Technology Crime Investigation Association

Nov/2009 ToorCon
Feb/2010 ShmooCon Probably one of the best security conferences in the US and in the World

Questions:

Richard:
Q: What tool can you use to determine if your hard drive is good or bad?
A: There are two main programs Scott recommends:
MHDD (Ver 4.5 has Virtual Terminal, Ver 4.6 does not)
VICTORIA (Ver. 4.6 – Russian utility)

Roger:
Q: How do I know when a hard drive is going bad?
A: Depends on the number of bad sectors, the more reallocated sectors you have, the slower the drive will be

Roger:
Q: I have a hard time judging the health of a drive from the SMART data, what programs do you use to accurately determine the health of a drive, most of the drives you already work on are already bad but what about if you wanted to check the status of your drive ?
A: Scott recommends GSmartControl, a tool that provides a lot of details and graphical views on the drive (Available for: Linux, Mac & Windows)

Steve:
Q: Steve wants to destroy old drives, what is the best method of choice?
A: Secure Erase runs a process that will erase the drive block by block, is one of the most reliable tools available

Steve:
Q: The computer doesn’t have to recognize a hard drive in the BIOS, but can it still access it?
A: Windows is able to see the drive via special tools, the fact that the drive doesn’t show up on the BIOS it doesn’t necessarily mean something is bad with the drive

Comments on Windows 7
Is functionally more stable and definitely much better than Vista
It is more responsive and more stable specially in the corporate environment
It’s the easiest installation Scott has ever seen and he is very impressed

SMART Self Monitoring Analysis and Reporting Technology
Is a monitoring system for computer hard disks to detect and report on various indicators of reliability, in the hope of anticipating failures.

SeaTools
Is a diagnostic tool that helps you determine the condition of a hard drive.
It includes several tests that will examine the physical media on your disc drive.

Notes by Jorge Hernandez of 123ComputerRepair.com

Hosted by: Scott Moulton of MyHardDriveDied.com and Steve Cherubino of Podnutz

Topics discussed:

Solid State Drives (SSD)
A solid-state drive is a data storage device that uses solid-state memory to store persistent data.
It emulates a hard drive interface; it is basically a hard drive with no moving parts
SSD drives has a built-in processor, keeps track of contents, has logs and also emulates IDE or SATA drives,
A proper name for SSD drives should be something like “IDE Flash” or something that will differentiate them from SSD memory cards
New generation of SSD have buffer for better performance

There is a size issue with SSD drives in terms of pricing:
– 500GB costs around $1,000
– 128GB costs around $500.00

Scott favors SSD drives if there was no need of space
SSD drives add additional hours of power on a laptop
They have less problems with heat, they have no fans, they are very quiet, and they have no moving parts
On a desktop he recommends using a regular physical spinning disk
The data recovery market for SSD drives is still not ready yet but as time goes on it will start to catch up.

SanDisk compared to MicroCenter sticks are way just much better.
SanDisk uses “TrueFFS” (True flash file system) encoding format which is one of the best
Samsung also uses this encoding format, they are a reseller for iPods and iPhones

Listeners emails:

Door-To-Door-Geek:
Q: How do you feel about whole disk encryption?
A: Encryption doesn’t really tax the drive, it taxes the CPU instead BUT today’s processors are much faster and more reliable
From a data recovery perspective, you can recover a drive that is encrypted without decrypting the content

Types of encryption:
– PGP (Used on corporate environment)
– SafeDisk
– BestCrypt
– GPG (Open Source Version, also known as GnuPG)
– TrueCrypt (Free version)

Door-To-Door-Geek:
Q: Is SATA going to be the standard drives connector for any length of time?
A: SATA will be the connector that is going to survive, is the most robust connector
There is another connector “ZIF ribbon cable” (PATA connector – Parallel ATA)
They don’t last very long, allow probably 20 connections, ZIF to USB connector is hard to find
Ribbon cables is better to buy new ones instead of cutting them

Blaine:
Q: Which store controller chip is more reliable (Intel, JMicron, Oxford)
A: Intel chip is one of the most robust and reliable
Scott likes “High Point” controllers with built-in processor, they also sell IDE/SATA controllers
PCI controllers still use your CPU

Blaine:
Q: Has Scott found any drive mounting orientation to be better (Vertical, Horizontal) ?
A: There is no better orientation, physically the drives adapt to the orientation and angle
If a drive is changed from one orientation to another, little fragments that come off the platter during spinning, sometimes may affect the performance of the drive and may get it stuck.

Blaine:
Q: Has Scott found any external enclosures to have better built quality than others? Which are the more reliable brands?
A: All depends on the chip they are going to use
Vantec & Maxtor drives have higher quality

Data Recovery Classes

SANS Classes

Data Recovery Forensics Course (SEC606)

Notes by Jorge Hernandez of 123ComputerRepair.com