All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 43 posts ]  Go to page Previous  1, 2, 3
Author Message
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 27th, 2018, 0:03 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
There is much difference between someone doing this on the back of his garage, and that will just tell the customer that it was impossible to recover his data, and the professional business, that have to pay taxes, personnel, and will not survive with telling those kind of excuses.

As for crook business ? That would be not informing the customer about costs and the possibility of increase in the price due to unknown things that will only appear after the service starts. If you explain what needs to be explained, tell the truth, and the customer agrees, it is a correct business.

And lets not degenerate this into another of those discussions about the right to define prices and the (sometimes low) value people place in the data recovery work. This kind of thing usually ends up on unpoliteness from many sides.

Well, if you read carefully what I wrote, I just tried to get a more nuanced perspective, in reply to “Spildit”'s statements about the supposed high profitability of the data recovery business (based on the fact that many computer users are ignorant and careless). I spoke about “crook practices” for very specific examples — of someone abusing clients' ignorance to sell an easy service at a very high price (“$300 for simple file un-deletion” : this is clearly abuse), or selling refurbished drives for the same amount as new ones (although I may have misunderstood that part, maybe it meant : purchasing non-tested drives in bulk for a cheap per-unit price, then thoroughly testing them, then, and only then, if they pass all the tests, re-selling them at a “fair” price, i.e. significantly cheaper than brand new ones, but still at a higher price than they got purchased so as to make it profitable — but in that case, I don't think that this can be highly profitable, as it takes a lot of time to thoroughly test a drive, and most likely many of them on average don't pass the tests and get discarded as defective, or re-sold for parts for a much cheaper price). I never implied that data recovery in general was a crook business, on the contrary, my point is that, despite the common perception that the fees are very high (regular users often compare them with the price of the device itself, and don't understand why such a service is about 10 times more expensive on average), I get the feeling, especially since I read this forum, that it is not the right career choice for someone who just wants to make big bucks quickly and effortlessly, it seems to require a lot of dedication, and an ability to cope with a good amount of frustration on a regular basis.

What I don't understand is how HDD's manufacturers can get away with not providing aftermarket parts for at least their current lineups of models with all the relevant data readily available to find the proper match, or schematics, or informations to deal with firmware failure (which from what I understand have to be retro-engineered by the conceptors of dedicated software tools, hence their staggering price tag), all of which would make those tasks considerably easier, less time-consuming, and thus cheaper for the clients. Things like this are considered standard practice in the vast majority of manufacturing activities, even when it comes to computers, despite the strong competition and the inherent industrial secrecy in the development of CPUs for instance, detailed schematics of their inner architecture get released officially, so why is it different for storage devices, which are more prone to fail than most electronic equipments, and can cause much greater damage when they do fail ?


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 27th, 2018, 8:07 
Offline

Joined: October 16th, 2013, 13:21
Posts: 713
Location: Brazil
What we may call easy ( recover deleted files ) may not be easy to other people. We had an example a couple threads before : I think it was you who told about a customer that used Recuva but recovered the files to the same disk. And many other things can go or be done wrong. So, if one don´t want to learn how to do it, he needs to pay the price of someone that does. Simple as that.

Same thing as a 7200.12 disk. If someone reads just one page in the internet, and goes using the old 7200.11 commands on it, then do not complain when things get much worse and he now has to pay a lot do deal with a partial accessbility problem.

You described a lot of procedures as "crook business". Maybe you understood them at the wrong way, as you stated. Most are just normal practices, the same as a doctor charges a lot of money just to recommend some medicine.

HDD manufactures could supply parts, and people would complain about price and demand support. Then manufacturers would supply support, and charge for it, and people would still complain. So, no way for it.

And good luck finding internal schematics of anything newer then a P4 ( even older ) . Can you get a schematic of an Intel chipset with SATA controller, complete with programming guide ? Don´t think so.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 28th, 2018, 18:06 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
@rogfanther
Quote:
What we may call easy (recover deleted files) may not be easy to other people. We had an example a couple threads before : I think it was you who told about a customer that used Recuva but recovered the files to the same disk. And many other things can go or be done wrong. So, if one don´t want to learn how to do it, he needs to pay the price of someone that does. Simple as that.

Of course, but don't you agree that $300 is exaggerated for that particular kind of task ? Unless someone is wealthy and willing to pay a premium to get it done by a major corporation with a stellar reputation, which is akin to some rich dude inviting over Jim Carrey to tell jokes at his wedding party to make sure that nobody's bored... or Iggy Pop, on the contrary, to be the “chairman of the bored” !)
On the other hand, I'd be interesting in knowing the average pricing for the kind of task I performed when manually repairing about 100 files out of an already very satisfying recovery (100% of the owner's personal pictures were already recovered for instance) — because that was another story, definitely painstaking and time-consuming ! Is this usually charged on a per-file basis, or according to the actual time spent on it, or added as a global service for a fixed fee ? Is what I did a standard practice (identifying possible duplicates so as to repair damaged files), or is it done by completely different methods ?


@Spildit
Quote:
To patch sysfile 93 you can use F3 ARCH firmware tools or get the file by hyperterminal and patch it with hex editor. Also you can use congen commands with terminal.

Alright, if I need to search more thoroughly on that issue I have enough key words... :)
(I've already tried to read several related threads but without practicing it's a bit like reading a phone book...)


Quote:
If it's just 6 file you can donwload them again and you are done. If not use r-studio, copy the files out and try to fix them with some video editing software.

If you saw the SuperUser thread, I went the painstaking way of :
– getting and saving the list of sectors for each of these files (using three methods : with HD Sentinel, Recuva, nfi.exe) ; some of those files were highly fragmented, probably because they were downloaded simultaneously (8000-12000 fragments) (at this point I had no idea that this would prove very useful later on, I was merely trying to gather as much information as possible before proceeding with an actual recovery attempt, and more specifically to determine the interval of sectors I would have to extract if proceeding with ddrescue to encompass all six files in their entirety) ;
– making a partial clone with ddrescue, large enough to include all six files (based on the information gathered in the first step), plus, IIRC, 10GB at the begining (I could have done a full clone right from the begining, but judging retrospectively from the way the drive deteriorated once I tried to access those bad areas insistently, I think that I had the right intuition and did the right thing, since those bad areas were around the 2TB mark on a 3TB drive, and a significant chunk of the MFT was located right at the end, the overall recovery success might have been vastly inferior and I might have had way more than just 6 corrupted files, so from that experience I would say that cloning is not always the best option when dealing with a failing drive, especially for a home user with no access to advanced hardware-assisted software tools) ;
– since the 10GB chunk at the begining didn't contain the whole MFT I was kinda SOL with the regular methods of extraction, hence why I created that thread, got no relevant input, but managed to use ddrescue itself, and edit the list of sectors (using Calc from LibreOffice) to create custom command files, so as to re-generate the whole files, fragment by fragment, but in an automated way... (And that wasn't just luck, it took some thinking and effort to fix my fuck-up !)
At that point the drive had become too unstable, and without the complete MFT, neither R-Studio (even – IIRC – with a .scn scan information file made prior to the drive's severe deterioration) nor WinHex (with – for sure – a volume snapshot made before when the whole drive was still accessible) could extract those files. So I had to improvise...
“We're into plan B. You still breathing? We gotta make the best of it. Improvise. Adapt to the environment. Darwin. Shit happens. I Ching. Whatever. We got to roll with it.”
(Collateral)
My other option would have been to directly copy those six files on Windows (when the drive was still stable enough i.e. before the partial cloning attempt) with Roadkil Unstoppable Copier (which is designed to skip bad sectors but on a per-file basis). I don't know if it would have resulted in a better or worse recovery rate, but it sure would have been less tedious than this !


Quote:
If the seller of the Toshiba drive "disapeared" the problem is with the seller not with the brand ...

Western Digital and Seagate provide a direct RMA service, no need to deal with the seller, so no such worry. (WD even proposes an “advanced RMA” service, meaning that you get a replacement drive and then have a one month delay to return the defective one, which is tremendously appreciable as it allows to make a proper cloning or transfer of the whole contents even when there's no extra budget currently available to purchase a replacement unit. Surprisingly enough, I still haven't had to deal with Seagate's RMA service : my Seagate drives which failed did so past the warranty period ; some of them have been purchased used / second hand market, including the one this thread was initially about, which for what it's worth was used in an orthodontic practice.) Whereas, in Europe, for retail 3.5" internal HDDs, Toshiba doesn't provide any direct RMA at all. (Probably because they have a very small market share ; from what I read, Toshiba began to produce 3.5" units at WD's request, just so that the two giants could be compliant with anti-trust laws. From Western Digital Wikipedia article : “In March 2012, Western Digital completed the acquisition of Hitachi Global Storage Technologies and became the largest traditional hard drive manufacturer in the world. To address the requirements of regulatory agencies, in May 2012 WDC divested assets to manufacture and sell 3.5-inch hard drives for the desktop and consumer electronics markets to Toshiba.”)


Quote:
The way you fixed the 1 TB HGST makes me think that you are a very lucky guy ! Your procedure is full of problems ... If you are cloning with ddrescue or hddsupertool or whatever and you do your homework you wouldn't be letting your OS to access the drive (mount) and because of that it shouldn't matter what partition the drive does have as you are working at LBA level only. You should NEVER write to a drive that you are attempting to recover from.

How do you figure from what I wrote that I tried mounting it before the cloning part was over ? ddrescue does have a preview option, which shows the bytes being copied at any moment, if that's what you're alluding to, that's where I saw at some point that only 00s were copied – I just didn't know yet that this was normal since a large portion was actually empty, and it was a mistake to stop it ; but the strange thing is that, whereas there were many slowdowns and skipped areas at the first attempt, it copied flawlessly and at a constantly high rate (around 50MB/s) the second time around, although it became unstable earlier. I still made mistakes and was still kinda lucky, but not for the reasons you seem to think.
What I should have done right from the begining (I learned about it halfway through) is using ddru_ntfsbitmap from ddr_utilities to 1) first get the whole MFT ; 2) generate a mapfile to restrict the cloning process to actually allocated areas (less than 25% as it turned out — I couldn't know it at that point unless the owner had told me, but he was probably too clueless to even know about that) ; 3) run the cloning process with ddrescue and that mapfile loaded with the “-m” switch ; 4) optionally, run a pass without the mapfile, to try to get the unallocated data which may still contain useful remnant of files.
As a matter of fact, when doing the repair procedure at the end, there was one set of instances of the same video file for which one was partially corrupted, and the other was totally empty/blank : I figured that the empty one was probably on the unallocated space, because it had been deleted, and skipped by ddrescue because at that point I was using ddru_ntfsbitmap's mapfile. So, using the first sector LBA information found in R-Studio and making some calculations, I figured out where exactly on the image file that second instance was located, and made a custom ddrescue command to extract just the end of the file which was corrupted on the first instance, a mere 20MB... and it worked perfectly on the first attempt : the copy was quick and flawless as this happened to be a good area of the drive (or an area read by a good head ?), and the patch matched perfectly (I purposefully extracted a few extra sectors to make sure that they were duly identical), the file could be repaired completely and was playable to the end. I'm rarely proud of myself, but in that moment I was ! :)
Oh, and I created an image file with ddrescue, I didn't make a direct clone, that's why the destination partition was relevant. At first I wrote that image – on a Knoppix live system – to a NTFS partition, so as to be able to access it easily on Windows in order to do the extraction with R-Studio. Then I read on this french guide that writing an image file with ddrescue to a NTFS partition had been reported to cause significant slowdowns. Translated quote :
“Avoid using a NTFS partition to store a disk image of important size (more than a few GB). Several persons have reported that the recovery slows down progressively, to such an extent that it's impossible to finish the recovery.”
Then, since the copying rate had gone down to about 600KB/s, I asked on SuperUser if at this point it was worth the trouble to stop the process, create an Ext4 partition, transfer the image and resume the process. At someone's suggestion I created another thread dealing more specifically with the possible impact on performance of writing sparse files to a NTFS volume on a Linux system. The replies I got in both threads were inconclusive, but I still went through with it, with the results described above.
(Sorry, many words again, but apparently I was misunderstood, despite my best efforts to be clear and thorough and write in as good english as possible ! :) Still, I think that this is an interesting issue, which may deserve its own thread...)
(I shall add that this seems to be a general problem on this forum : even when some issue or method is exposed clearly, especially by non-professionals, whose knowledge and skills are naturally disparate, inhomogeneous, the first few replies – and they can be the only ones if the OP doesn't insist and/or doesn't understand that he or she was misunderstood – are often based on assumptions or prejudices, which may be related with very common mistakes or misconceptions that professionals encounter regularly, but it doesn't mean that each and every rookie will repeat them cluelessly. Sometimes I read a first post which explains an issue or asks a question quite clearly, I can understand what that person did or means, even though I may not be confident enough to provide a perfectly accurate reply, yet the first member who replies does it based on what the “average dude” would have said or done in a similar context, not on what was actually stated.)
Just to illustrate, the final recovery image looked like this in ddrescueview (is it consistent with one failing head ? model was HDS721010CLA332) :
Attachment:
ddrescueview Hitachi1TB2 201709100503 mod - grid size 4px.png
ddrescueview Hitachi1TB2 201709100503 mod - grid size 4px.png [ 25.16 KiB | Viewed 12346 times ]



Quote:
As for buying and re-selling drives i was thinking among the lines of buying 20 or 30 drives for $20 under "untested" "removed from working computer" sort of listing and just secure erase, check S.M.A.R.T. and re-sell those for $20 each. If drives are bad re-sell the PCB for $20 each. That sort of thing ... Of course "testing" doesn't have to be necessarly very time consuming. Just get a bunch of cheap PSUs, plug the drives there and just use secure erase on them at the same time. The ones that can't be re-sold can still serve as PCB donnor.

Alright... In that context it seems fair (depending on the drives' capacity of course).
Time-consuming : again, depends on each drive's capacity, relatively quick for a sub-500GB unit, but can require the best part of a day for the largest capacities currently available. But yeah, with such a custom setup it doesn't have to hamper a whole computer. Still, is just a PSU enough to run that command ? I understand that this function is embedded within the firmware, but how do you issue the command itself ?


Quote:
- Data Recovery can be used to get $$$ fast and without problems as well even more on some countries where people will buy chinese translated tools and will do some operations charging like big firms and destroying many drivs on the process.
- There are people on some countries that can buy or download firmware tools and fix one or two drives and charge $1000. Even if they destroy all the other drives and get clients angry they can get away with it and they will still make $2000 from the 2 drives they did manage to recover.

Yeah, but I think that almost every pro member here will agree that these are unfair and unethical practices... and they damage the reputation of the whole data recovery activity.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 43 posts ]  Go to page Previous  1, 2, 3

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 69 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group