Seeking Interesting Data Recovery Stories

[Jonesisonthelam]

Hello
My name is Liz, and I am a writer and filmmaker. I am interested in writing a story involving the recovery of data from hard drives, and was wondering if any data recovery technicians out there can share interesting stories about their work - strange discoveries about data they were hired to recover, strange clients who you interacted with, or other interesting situations you have experienced in your work.

Feel free to reply here, or you can write to me at my email address jonesisonthelam@gmail.com.

Thanks for your help!

[digitalferret]

Hi Liz, & welcome to forum.

Weirdest one i got never made it in to the lab.

The potential customer rang asking what could be recovered from a computer that had maybe been formatted. The usual dissociative "its for a relative" story was rolled out.

Eventually, after long, and very vague explanations it occurred to me the client likely wasn't looking for recovery but some sort of reassurance that the PC was "beyond recovery".

Every turn of the conversation was "so, if they did "that" then it wouldn't be recoverable then would it?" or that or that or that

methinks they have tried to cover up some sort of track by formatting or deletion, and having let the PC go, are now worried that data are recoverable.

Told them that the only guaranteed way "to be sure" (a la nuke it form orbit ) was to see the drive go through a pulverizer.

Even then there are other means to recover data (evidence).
Was the machine monitored.
Was it on a network.
Were backups made .... blah blah blah

made for an interesting evening chat

Kern

[dobrevjetser]

You can start here: viewtopic.php?f=9&t=21708

Dobre

[PlatinumDataRecovery]

Hi Liz,

Intersting stories happens to us everyday

[Keatah]

Some of my older posts detail ridiculous experiments with disks and just plain outright silliness. You'll have to look them up.

Perhaps you can elaborate a little as to how much of the story involves data recovery operations and what genre is it?

[falther]

Coincidence ....

A guy - ok looking - entered the shop yesterday afternoon and asked for someone
for data recovery.

I asked what he needs:

He started: "Well you should know that I am really sick... and as you are a specialist,
a technician, you are aware that "they" control us from outside and influence us with
waves etc. You, as a data recovery specialist should be able to find the data which is
used to make me sick and who is responsible for that" ......

After more than 26 years in IT biz I have learned my lessons and assured this guy that
he needs to look for someone else, because I am not that very special data recovery
specialist to solve his problems.

+++

[HaQue]

My work is mainly in Edu. I had another it tech from a school send me a flash drive to recover. Said he's tried everything but windows did not detect it. Well the USB header fell off in my hand when I opened we'll packaged parcel.
How do you not notice that?
Quick solder and all data copied off

[CK]

We had a really strange case last week... http://goo.gl/PAzZ3g

[Jonesisonthelam]

Cool guys, this is great so far! I guess I'm interested in the topic because increasingly, we save more and more of our lives and data electronically - either onto hard drives, or on the cloud, etc. Because of that (and my own recent experience having a hard drive crash on me and having to have it recovered), I would guess that you guys see all kinds of situations in how drives are damaged, and all kinds of different data and information that people are asking you to recover, that would make for an interesting story.

I'm thinking of it as a thriller/mystery, but any stories you have to tell are interesting

[Jonesisonthelam]

I guess one thing I may be unclear about - when you are recovering files from a damaged drive, do you often see the content of those files? Or is it just a matter of re-connecting file names and directories?

[labtech]

I guess one thing I may be unclear about - when you are recovering files from a damaged drive, do you often see the content of those files? Or is it just a matter of re-connecting file names and directories?

Data content can be seen at any time depending on circumstances, however nobody really has time to look through and frankly nobody cares. So, much of it is duplicated over and over.

[HaQue]

It is a common theme that people hesitate to do DR on drives because they are scared to let the DR Engineer see whats on there. Well I would re-iterate, we don't care and we don't have time to look through peoples data. And personally I feel a sense of responsibility. I would think there would be very few things that would surprise me at this age, though the obvious exception about reporting a crtain disgusting behaviour towards children applies.

I would read a good story based around a DR Engineer recovering *something* that was indeed surprising and unexpected, and was of significance to a lot of people. - or Something. I am thinking Daniel Suarez'ish here.

I don't know how you would do it as I am no writer, but..

[Jonesisonthelam]

It is a common theme that people hesitate to do DR on drives because they are scared to let the DR Engineer see whats on there. Well I would re-iterate, we don't care and we don't have time to look through peoples data. And personally I feel a sense of responsibility.

Yes, I would imagine (and hope!) that for the most part, it's a matter of professional ethics that you avoid looking at peoples files unnecessarily.

One case that I read about from a while ago was about a hard drive that was stolen (not damaged or needing recovery), from the home of a VA Medical Center worker, who had taken a drive home to do work without permission, that contained the personal identity and medical data of thousands of patients and active duty military personnel, here in the states.

I guess I'm thinking more along those lines for the story - of that kind of sensitive personal data.

[craig6928]

I guess one thing I may be unclear about - when you are recovering files from a damaged drive, do you often see the content of those files? Or is it just a matter of re-connecting file names and directories?

of course people wont tell you the truth if they look at the data or not

but they do check the data out after the recovery
have to make sure that file structure is correct and open up the photos or documents

and some well know companys will report anything to the authority if its illegal

they will report a person who has downloaded movies or mp3 or anything that looks illegal on there computer

they search for these things.

[hddguy]

I guess one thing I may be unclear about - when you are recovering files from a damaged drive, do you often see the content of those files? Or is it just a matter of re-connecting file names and directories?

of course people wont tell you the truth if they look at the data or not

but they do check the data out after the recovery
have to make sure that file structure is correct and open up the photos or documents

and some well know companys will report anything to the authority if its illegal

they will report a person who has downloaded movies or mp3 or anything that looks illegal on there computer

they search for these things.

A lot of companies dont have the time to check through clients information. also, this would depend on the failure. Certain failures can result in some level of damage to the data such as complex firmware rebuilds, overwritten partition, deleted data etc. In some cases databases would need to be verified, especially in some RAID recoveries to eliminate possibility of some stale data.

For the most part, its simply a matter of process. Once all manual repairs have been made, specialist software is used to extract the data which can display folder and file structures but doesnt display the content. Once it completes, the next case gets worked on.

That been said, there often are requests to check data and on occasion there are definitely some surprises

[HaQue]

well, there is rule 34...

[scratchy]

One thing worth mentioning in your video are the urban myths around data recovery, many of the tips can make a simple problem either totally impossible or extremely difficult to recover.

One of the favourite urban myths is to put the drive in the fridge or freezer and then some hours later it is magically fixed. This is an urban myth. They will probably find that in cases where this has worked, that it would work without putting in the fridge, just leave it to cool down for a few hours and try it, if that doesn't work ask for professional help.

What can happen is that when the drive is removed from the fridge to room temperature - condensation forms on the platters also when the user puts the drive into the freezer any water vapour that was inside the drive will have condensed on the platters and frozen solid = ICE.. these two issues are where the major problems can arise. Water vapour and ice will break head sliders and potentially cause more problems than already existed.

As an analogy, when you turn the hot tap on in the bathroom the mirrors and windows steam up. That is because the water vapour is warmer than the mirror or windows surface and so condenses out onto those surfaces, it is exactly the same process that happens with disk drive platters.

Oh yes, there is also another urban myth and that is hitting the drive with a hammer and some people really do that too.

[fzabkar]

One of the favourite urban myths is to put the drive in the fridge or freezer and then some hours later it is magically fixed. This is an urban myth. They will probably find that in cases where this has worked, that it would work without putting in the fridge, just leave it to cool down for a few hours and try it, if that doesn't work ask for professional help.

What can happen is that when the drive is removed from the fridge to room temperature - condensation forms on the platters also when the user puts the drive into the freezer any water vapour that was inside the drive will have condensed on the platters and frozen solid = ICE.. these two issues are where the major problems can arise. Water vapour and ice will break head sliders and potentially cause more problems than already existed.

Hitachi Endurastar J4K20 and N4K20 2.5-inch hard disk drives:
http://www.hgst.com/tech/techlib.nsf/te ... 0final.PDF

"Operating temperature range from -20° C to +85° C"

EE25.2 Series Product Manual:
http://www.seagate.com/staticfiles/supp ... 48541e.pdf

Operating [Ambient Temperature]

Extreme: -30° to 85°C (-86° to 185°F)
Rugged: -20° to 75°C (-68° to 167°F)

[Keatah]

This is something I posted at Wilders Security Forums: Best course of action when you lose data and have no backup?

This situation (hopefully) doesn't apply to many of us here, we're all backed up and secure against disaster. But consider:

What's the first thing one should do when they think (or know for a fact) that they've lost irreplaceable critical data? And have no backup..! Whether it be personal information or business information, whether it be user error, accidental delete, hardware failure.. the question is all the same.

Now typically I tend to observe that people do the following:

1- They do what the o/s tells them, sometimes that includes reformatting the disk that they're trying to recover!

2- They blindly use some of the built-into-the-OS tools, like chkdisk. They do this because they were instructed by internet forums or people that sound knowledgeable but are not.

3- They start using all kinds of DIY data recovery programs and then when those don't work they go back to the publisher of said programs and post a list of cringe & crawl-under-the-desk mistakes on their support forums. In my direct observation this is a "blind leading the blind" scenario. This happens mostly on free program's forums. People go there and come away more confused and in worse shape for having indiscriminately tried the offered solutions. These forums sometimes instill a false confidence in the hapless user. And this false confidence tends to make the user more adventurous and willing to take more risks. Ultimately this ends up in Destroy-It-Yourself. Things like SpinRite and Recuva come to mind.

4- Call data pro-data recovery establishments and get shocked at the $1,500 bill. They then proceed to save up over the next months till they have enough to pay.

5- Give up on it, lost cause, move along..

6- Begin the long process of recreating what was lost. They become overcautious and lose all faith in the reliability of electronic systems - thus developing Obsessive-Compulsive behavior patterns when it comes to computing.

In general people don't understand that the internet is full of advice on how to effect recovery operations, but short on diagnostic material. Just how is one to know what tools and procedures to use? It is this imbalance that gets people into trouble more than anything else.

And furthermore, a lot of this advice is written by people wanting to be a hero. You know the type, the ones that are too happy and too helpful and make it a personal crusade of theirs to set you right. The ones that are of the approval-seeking type.

Some of it is written as filler material for "fix-it" and "how-to" sites, and the articles are so generic they can mean anything.

[HDD Spaz]

I've had some heart breaking stories, the last pictures of a women that was murdered, also somebody sent in their hard drive for data recovery, they died three days later, their parents contacted me and explained the situation, requested me to complete the job in order to get the pictures back.