Advice on HDD PCB swap

[mwrldn]

Dear All,

I had the misfortune over summer (I'm in Aust) of having some nefarious character(s) break into both my house and my office (they found the office keys at home) and steal everything of value that wasn't bolted down.

Fortunately I had hidden (quite well) three external drives used to back up my entire life, and I have spent a large block of time over the last month restoring my life to normal, but here is the problem.

All the drives are encrypted (truecrypt) but unfortunately one of the drives will not mount in TC due to a large number of bad sectors. (Yes, I have tried it on different machines, including linux based TC with option not to mount file system)

I have been very careful with the drive and read both this forum, the truecrypt forums, and various data recovery forums extensively, but I would appreciate some (any) advice how best to approach the recovery, as the data is very important to me (as it is with many people).

I have a licensed copy of Winhex and followed some instructions regarding truecrypt in the following post:

http://www.wilderssecurity.com/showthread.php?t=336671

and confirmed the encryption headers are fine and that a 2M testfile extracted will decrypt.

My dilemma is where to proceed from here. So first the situation thus far:

The disk in question is a 2TB ext USB western digital drive (WDC WD20EARS-00MVWB0 51.0AB51) with a single RAW partition. I removed the drive from its housing and attached it to an internal SATA controller and have tried ddrescue, clonezilla and rawcopy (currently running) to image the drive but the data rates I am getting (30-100kb/s) are so slow that by the time I get the data back it will be no use to me because I will have already died.

The disk shows in Win7 disk manager as healthy. Gsmart is reporting reading faults due to CRC check failure [3000+] and a small number of reallocated sectors[20 to date (originally 4), but increasing slowly as I recover the data]

I bought the 3 identical drives at the same time from the same shop, and I was toying with the idea of taking the PCB board off one of the functioning drives and trying it out to see if I can get the drive to function reliably enough to clone at a decent speed.

I understand from what I have read that the information on the SA tracks contains most of the firmware, but that I might have some issues with P-Lists and G-Lists etc?

Could anyone give me some advice on this, is it likely to work, or am I wasting my time and likely to end up with two ruined drives?

Perhaps it is not critical to the task at hand but the disk in question contains a lot of work(most of it replaceable over time), but more importantly, the backups of all the digital footage of my children since they were born (the oldest being 9 the second being 7) and everything else has been lost since computers and copies have been lost from both sites due to these a$$hole thieves, so if you can help I will be forever in your debt.

And one further question, does anyone know if Rawcopy can be stopped and resumed?

Thanks in advance,

Mark

[Vulcan]

I don't have time to answer many of the points in your (sad) story, but I'll make a few comments and hope that they are some help:

a) As always, you risk making things worse with any of your DIY recovery attempts. It is not the case that if DIY fails, you can use a DR company and the situation for them will be the same as when you started. Assuming that you realise you may make the situation worse (or even totally lose your data) through the DIY you have attempted so far, as well as the risks of misunderstanding (at either end) through any forum like this, then...

The disk in question is a 2TB ext USB western digital drive (WDC WD20EARS-00MVWB0 51.0AB51)

b) As far as I can tell, that is the part number on the drive, and does not tell us whether the enclosure itself (is that also made by WD too? your comments are unclear to me on this point) has in-built encryption in its USB-SATA bridge. If this is a WD enclosure with automatic encryption, then that adds a whole extra layer of complication for you. If you give details & the part number / name of the enclosure, you may get more advice on this point.

Gsmart is reporting reading faults due to CRC check failure [3000+]

c) It would help if you supplied the full data (inc raw values) from Gsmart, because I don't know for sure which SMART attribute you are referring to. If it is attribute 0xC7 (199 decimal) then that counter (i) refers to errors detected at the interface, not when reading from the media, and (ii) the value (typically) never resets to zero, so you have to look for changes - a current raw value which stays fixed at any number (even 3000) is showing historical problems, not new ones.

does anyone know if Rawcopy can be stopped and resumed?

d) AFAIK, no, as it doesn't write a log file. This is why (if I'm taking the risk of DIY cloning attempts in my lab, on non-critical data) I use GNU ddrescue and always enable its logfile (being written to a known-good filesystem, unrelated to the "problem" disk).

e) You can't just swap PCBs on those drives, and expect the "problem" drive to work. In any case, with the behaviour you describe, this is likely not to be a PCB-related problem anyway, IMHO.

Summary: It's up to you as to how much value you place on your data, and the potential for making it unrecoverable (or much more expensive to recover) by DIY attempts on that failing drive, but I would seriously consider using the services of a professional DR company, if the data is more important than just "nice to have". Your data; your risk; your choice. Good luck with whatever you decide!

[mwrldn]

@Vulcan

Thank you for taking the time to give me your thoughts on the matter.

I did contact 2 DR companies and they both had approximately the same advice, being that as the drive was encrypted that the only option was to recover the whole drive, and that neither would rate the chances of recovery as high. Unfortunately I think that the DR companies are really aiming and pricing their services at corporates that can afford to pay (or be blackmailed) because both quoted rates per megabyte of recovered data that would far exceed the amount I earn in a year if the whole drive was recovered. If you know anyone in Aust that charges reasonably I would be happy hear about them.

As for encryption, I personally encrypted all three drives using Truecrypt 7.1a and have backups of the headers for all three on each drive, which are WD Elements drives. The USB-SATA bridge does not play a part in the encryption. I removed the disk from the external casing (and the bridge) in the hope of getting better recovery rates through the internal ATA interface.

I have attached a screenshot (below) of the latest GSmart report noting that it is not the 0xC7 attribute, and what I said before could be confusing. If the rest of the info can help you (or anyone else with experience in the area) understand what might be the likely problem with the drive, I would appreciate any thoughts. In the last week or so the item on the the top row has gone from 3000+ to its current value of 5309 and the rallocated sectors has gone from 4 to 20. Not much else appears to have changed greatly.

Thanks for the info on Rawcopy. I thought as much re: stopping which is why it was my last choice, but so far it is getting the highest data transfer rates (varying from 50kB/s to 1.5MB/s depending on where on drive it is and number of difficult to read sectors). I would normally use GNU ddrescue also and I did try with various -r settings and also -R trying to get it to run backwards in non-cached mode, but the best data rate I could get out of it was about 30kB/s which equated to hundreds of years for the whole 2TB.

I note further that the failure to read any given sector is not always consistent, excepting for LBA's 1641532328 to 1641677540 which I have had very limited success with, leading me to the assumption (perhaps incorrect - any advice welcome) that these maybe trashed, and perhaps that the head(s) are damaged. However I had a look at the Scott Moulton Youtube videos, and was looking into the PCB swap as a possibility that there were power issues or faulty solder joints causing weak readings and therefore inconsistent sector reads, but will hold off for now on the PCB swap (thanks for your opinion), and do a bit more research.

Just for the record, according to my research thus far, with truecrypt you can technically patch all of the recovered data together into an image file filling the gaps with 0's and it will decrypt as long as the partition size is correct, just some files will be missing. Any further thoughts appreciated.

Cheers,

Mark

Attachments

[Vulcan]

A few brief comments:

Thanks for the Gsmart screenshot. The highlighted SMART attribute is completely different than the one with "CRC" in its name (which was the best guess that I could make, given your earlier comment), so obviously that part of my last reply was a waste.

Now that you're using the (non-restartable) rawcopy program, I don't see any point in me making further suggestions until rawcopy either finishes (in which case you don't need (much? any?) further help ) or it fails completely (in which case you may have "DIY'd the drive to death", and there may be nothing more you can try anyway ).

I don't know of any Australian DR companies which I can recommend, but forum members in that continent may have. Good luck with your challenge - I hope you're successful

[mwrldn]

@ Vulcan

I terminated Rawcopy as the data rates also fell to a trickle. Thanks anyway for your suggestions to date.

Out of curiosity was there enough information in the GSmart report to give anyone with experience an insight as to what is going wrong? @Spildit you suggest that heads might need replacing, is that was you see from the info in the screenshot?

BTW if anyone else in the forum knows a decent DR company in Australia, I would be happy to hear your recommendations.

Thanks again.

Cheers,

Mark

[mwrldn]

Thanks for the reply @Spildit

I fully understand that if I ever manage to get the data back that the drive can't be trusted anymore. I am trying to find someone who can do the swap for me at a price that I can afford. As I said I purchased three identical drives at the same time and I am in the process of cloning those (the good ones) onto new drives, with the hope that a good DR compnay will be able to use the parts from one the properly functioning old drives to get the failing drive operational for long enough to retrieve the data. After that I might use them as doorstops

[mwrldn]

Can anyone tell me whether the PCB boards on the following drives are compatible?

I have been trying to recover data from the left hand drive which is failing inconsistently and noticed that there is a tremendous amount of heat coming from the PCB board of the left hand drive and there is the characteristic electrical aroma. (see pic below)

I have tried to find a DR company in Australia, but the costs I am been quoted are just prohibitive.

Both drives are identical models, manufactured on the same date from the same factory and have the same PCB board.

However the DCM numbers are different, being HHNNHTJCAB and HBRNNTJMBB, and I can't seem to find a definitive guide on what they mean.

The research I have done thus far seems to indicate that the firmware is on the disk, so I am making the asumption (perhaps inccorectly) that I may have a chance with this board swap.

Naturally I have backed up the good drive and would be prepared to lose it if I have a chance of recovering the failing one.

Any additional thoughts/comments appreciated.

Cheers,

Mark

Attachments