Back From the Dead

If you have been in the IT business long enough, you've already experienced it. You, or one of your users will turn on a normally reliable computer only to hear a nasty clicking, whirring or grinding sound; followed by either a sad Mac face or a request to please "insert system disk."

Not the start of a great day for sure, and of all the ways to lose your data, the worst possible scenario is when your hard disk physically fails. Sometimes you get a warning, but most of the time you don't. Spindle motors cease to spin, actuator arms stop moving, controller circuitry loses power, or worst of all; write heads floating on a cushion of air 2 millionths of an inch thick suddenly crash into disk platters spinning at up to 15,000 rpm.

Even with the best of modern drives, many boasting hundreds of thousands of hours of "mean time before failure," mechanical breakdowns can and do occur; and the simple truth is that there's really nothing you can do about it, other than make regular backups. Even the most highly rated manufacturer's warranties only offer drive replacement and make a point of claiming absolutely no responsibility for missing data. Fortunately, when disaster does strike you have one final chance at rescue. It comes in the form of a data recovery service that specializes in extracting data from damaged or otherwise inoperable storage devices.

Viruses, operating system failure, application problems and human error probably make up the greatest number of data disasters the average user will encounter. These types of problems can often be repaired by any competent IT support team using one of the many software solutions available for data recovery. But if your drive has been dropped, drowned, run-over, scorched in a fire; or is clicking, grinding or failing to spin up at all, it's time to shut everything down and bring in the experts.

For John Ford, manager of technical vitality for Celestica Inc., one of the world's largest manufacturers of OEM equipment, the end came unexpectedly for his company-owned laptop computer. "I had dropped off my laptop at our IT help center to have my data transferred to one that was just coming out of repair," Ford recalled. "I drove the 150 mile round-trip to the location and returned home to find that about 90 percent of my data did not make the trip with me."Surprisingly calm in the face of potential disaster, he got in touch with his IT support team the next morning and they went back to the original laptop to diagnose the problem. "They tried to use capture programs and repair programs, all to no avail. Approximately 12 months of work on several major programs was about to be lost," Ford said. To make matters worse, the data backup made from his corrupted drive had overwritten his previous backup on their servers, leaving him with nothing for backup data. In the end the only thing his support team could do was recommend a drive recovery service, and at his request supplied him with a short list of reputable firms to contact.

John's search eventually brought him to Kroll Ontrack Inc., and its Ontrack Data Recovery service. One of the oldest and largest data recovery companies, Ontrack has four U.S. and 10 worldwide locations and offers a variety of software, online and lab-based data recovery services. After discussing the situation, a recovery specialist requested that the drive be shipped to the service provider, where they discovered that it had undergone what Ford described as "an internal meltdown".

After their initial inspection Ontrack was only able to offer Ford the possibility of a 50 percent recovery; and based on a preliminary list of viable and damaged files supplied by Ontrack, he approved the recovery estimate and set them to work. The drive required a major overhaul, and once the necessary repairs were made, Ontrack was able to call with some excellent news. "Almost 95 percent of my data was recovered, and the only ones that were not useable were some of the system files that would have had to be reinstalled anyway," he said.

This turned out to be an exceptional result by any standards, and by Ford's estimate, well worth the trouble and $2,200 it cost to have the data recovered. His opinion was echoed in dozens of other testimonials where grateful customers from medical, legal, media and the arts raved about how they were saved from disaster by data recovery. Even more interesting was the statistic showing that the success rate of data recovery averages somewhere between 80 and 90 percent for drives that are not physically damaged beyond any hope of recovery.

Like most users in similar trouble, I chose to start the quest for data recovery online; unfortunately, a Google search for "data recovery services" got 330,000 hits. As I dug through the list it seemed that many of these were either software solutions or flat-rate discount offerings. Though some of these low-cost options may be worth pursuing by individual users who are hoping to retrieve personal data from their home systems, enterprise customers facing the loss of valuable, irreplaceable corporate data should set their sights a little higher.With the enterprise customer in mind, I specifically looked for key factors such as years in operation, industry experience and emergency response capabilities. I also took the time to read through many of the testimonials that most reputable services featured on their site. As I pored through the massive number of offerings I began to realize that the upper echelon of data recovery companies shared a few similarities worth looking for in any recovery service provider.

Perhaps the most important feature turned out to be access to a Class 100 clean room. This was a key element because mechanical hard drive repair usually requires either partial or complete disassembly, and it's imperative that this be done in a contamination-free environment, given the microscopic tolerances required by modern drives. Top companies also offer multiple teams of highly-skilled technicians; capable of handling the specialized hardware and software required to reconstruct drives, analyze disk surfaces, synchronize multiple platters and extract data from corrupted RAID arrays under any combination of striping and parity.

Another interesting similarity between services was a large drive-parts inventory. That's a necessity because most of the drives referred to this level of data recovery are in need of some degree of mechanical repair. Disk-drive designs are in a constant state of change, and extremely specific parts like spindle motors, read/write heads, voice coils and even the electronic components in the controller circuitry can vary dramatically from drive model to drive model, even within a family of drives from the same manufacturer. This means that many services choose to maintain an archive of thousands of hard drives so that parts will be available immediately in emergencies.

As a result of my research I chose to speak with five different recovery services to get a feel for how the process works. These were, (in alphabetical order): CBL Data Recovery,

Data Recovery Group, Disk Doctors, DriveSavers and Ontrack Data Recovery. In my conversations with these I found a great deal of similarity in their level of professionalism, pricing, concern for the customer's needs and commitment to making the data recovery process as painless as possible.

The process usually begins with a phone call to discuss the specific problems being experienced by the customer, something worth doing early to avoid compounding the problem by continuing to access a physically damaged drive. If warranted, the next step is to ship the drive, or drives in the case of RAID, to the service for a detailed analysis. Some companies offer free analysis, but as a rule you should expect at least nominal inspection fee in the range of $100 to $200 that can be applied to the cost of your repair, if approved.At this point, usually within 24 hours of receiving the damaged drive(s), you should receive a written report that indicates the nature of your problem, the cost to retrieve your data, a close approximation what data can actually be saved and how long you can expect it to take. Most companies offer a higher-priced, accelerated recovery option for emergencies, but on an average most single-drive recoveries can be done in three to five days, not including shipping. Of course, exceptions may be required for extremely damaged or unique drives, or extremely large arrays that may require additional work.

As a rule, most companies make an exact, block-by-block backup of your data as soon as the drive becomes readable, so that any software-level recovery may then be done on a copy. That copy is then retained for a number of days until the customer can confirm the success of the recovery. Recovered data can be returned in a number of formats, with the most common method being recordable CD or DVD, and most recently, external hard disk. Many companies also offer an online data return option from a secure FTP site, but the pricing and availability of these services needs to be negotiated at the beginning of the recovery process.

Be aware that you should not expect to receive a bootable version of your old hard disk; the purpose of data recovery is to retrieve any possible data that would otherwise be lost. You also have the option of requesting that only specific data be returned to you, a choice which may save you time and money, but at the risk of forgetting to include data that you may eventually need.

When asked about data security during recovery, all of the vendors I spoke with expressed a total commitment to customer privacy and a willingness to negotiate any agreement necessary to address concerns. As a rule, drive-level compressed and encrypted data is returned as normal data, and though not necessarily required, a password will speed up the process. Several services also mentioned that they have already achieved government- and military-level security clearance, and for those companies requiring the ultimate in response and monitored security, onsite data recovery may also be an option.

The biggest variable in this process is price, mostly because of all the factors that must be taken into account. Issues like drive condition, degree of damage, parts availability, data quantity and urgency all play into the price picture. When pressed for the average cost to recover a typical 40-gigabyte laptop drive, all the vendors estimated that reasonable expectation would be $1,200 to $1,500; depending on all other factors. Estimates for RAID arrays start between $4,000 and $5,000, and can run into tens of thousands of dollars for extremely large or damaged systems.Ultimately, it comes down to the question of whether or not the data on the failed drive is worth more than the cost of recovery. Unfortunately this is a decision that can only be made after you've gotten a list of what can actually be recovered and a firm commitment on the recovery costs. But as you make those calculations, don't forget to take into account the value of system downtime, business interruptions, potential customer impact and all the man-hours necessary to re-create that lost data. For users like John Ford, it wasn't even a close call.

Steven Hill owns and operates ToneCurve Technology, a digital imaging consulting company. Write to him at [email protected]