Data recovery specialist, Craig Veness

Specifically, digital storage technology hasn't necessarily become "better". Digital storage media includes the classic mechanical hard disk drive, flash memory (USB drives, camera memory cards, etc.), SSDs (Solid State Drives which are hard drives with no moving parts, being essentially more complex and faster versions of your USB drive -- with some larger, corporate storage solutions also falling under this heading), CD and DVD discs, etc. Yes, digital storage media is cheaper than ever before, increasingly quicker and certainly more widely available in many forms, but the one thing that the market seems to be willing to overlook in exchange for this increased speed and capacity is reliability.

The hard disk drive employs one or more spinning magnetic platters on which your data is stored and accessed with one 'read/write head' per platter surface. Since 2006 when perpendicular recording became the norm (greatly increasing how much data can be stored in the same physical space), hard drive capacities have increased from a ceiling of around 120GB for 3.5" drives and around 80GB for 2.5" drives to 4TB and 1TB respectively, and the increase continues. It was around 2006 that hard drive reliability took a sharp turn for the worse, however, and since the widespread adoption of perpendicular recording, hard drives have become significantly less reliable than before (generally speaking).

Flash memory is a more recent invention but also has become generally less reliable with the move from Single Layer Cell (SLC) to Multi Layer Cell (MLC) technology, granting us greater speed and capacity than was previously possible at the cost of higher failure rates than ever before.

This constant push for speed and capacity at the cost of reliability seems to be accepted by a market which either doesn't care or doesn't know any better, and so my customers range from home users to educators and students to business users, both small and large. We use digital storage mediums for all sorts of data and so I'm tasked to recover everything from lost holiday photos from a failing camera memory card (usually MLC which is typically between 512MB and 32GB in size) to lost work, photos, multimedia files and emails on laptop and desktop systems. Sometimes I'll even be asked to recover data from a failed array in a corporate server where backups were being performed but had been failing and gone unnoticed until the main machine failed. We have no 'safe' long-term method of storing data except for 'factory stamped' CDs and DVDs (as opposed to light-sensitive 'burned' discs) and so if you value your data and do not backup, you will likely find yourself in need of data recovery when your hard drive or memory card inevitably fails!

The internal physical complexity of hard drives means they are susceptible to a wide range of ways they can be damaged or fail. Most recoveries are slightly different from each other, which means I need to stay on my toes to know how the various makes and models work and what their respective weaknesses are. I wouldn't say the awareness of a customer's hopes for data recovery weighs on me, as in most cases my customer is starting from a position of loss -- they currently have none of their data when their drive is on my workbench, so even having their drive with a data recovery professional represents some hope for them. I would say that the challenge of the repair and recovery is a driving force for my work and certainly there is the desire to provide service that exceeds expectations. I try not to let emotions into the job however as already for some people they're devastated that their data may be gone. Clear focus and logical analysis is what is required during the initial triage and emotion is certainly not welcome during that delicate stage (although of course I have sincere sympathy for my grieving customer and a strong desire to help)!

My answer in a phrase would be 'reverse engineering'. Hard drives and flash memory alike are not designed with data recovery in mind. Everything is made to a price and hard drives are no different. When something is damaged or fails, data recovery involves first working out what's gone wrong (requiring a solid understanding of how it works to begin with) and then determining the safest way to extract the data without causing further damage to the device. I would cite four elements that make a successful data recovery technician: quality tools, effective techniques, knowledge of the subject and experience.

For hard drives and flash memory alike, there are generally three stages for data recovery:

• Repair, which involves electronic repair of the drive's control board and of the delicate internal moving parts (as required). This stage is not always needed for the less-serious failures when the drive's internals are still functioning correctly. This may mean delicate electronic repair under a microscope for the electronics and/or the substitution of healthy parts from identically-matching donor drives. The aim for this stage is to get the drive functional again. This is usually the hardest stage and is what separates the professional from the general IT support technician.


• Imaging, which involves making a 'sector level' copy of the repaired storage device. This almost always involves the use of specialised equipment that is designed to address the most common types of failure. If the digital storage device did not need Repair or Imaging (stages 1 and 2), then we usually won't see it through our doors as your general IT support technician and/or home user is generally capable of performing stage 3).


• Software recovery, which basically involves running appropriate data recovery software on the imaged (or original) drive. Data recovery software is designed to look for data on drives with all sorts of problems, from read errors due to hardware failure to recovering accidentally-deleted or otherwise lost data. There is some very specialised software available to data recovery experts, some of which is designed to work in conjunction with equipment designed for stages 1 and 2, however there is also a wide selection of user-friendly software that the average computer user can use to recover lost files from physically healthy drives.

Because we're working with digital storage media there are loosely two groups of tools with which we work ? physical and logical.

• Physical tools are used to address physical and electronic problems with digital storage devices. Think soldering and electronic repair equipment, clean lab (room or cabinet with special air filter to remove floating particles), custom hard drive disassembly and repair tools, etc.


• Logical tools are typically software programs which may be found inside some of the physical devices as firmware or else installed on recovery machines or bootable optical discs as software. These tools are designed to do the actual data recovery once a device has been repaired with the physical tools.

As mentioned above, there are effectively three stages of data recovery. The first is physical or electronic repair as necessary, the second is 'imaging', where we extract the contents of each sector on the device and place this mirror copy onto a stable and safe location, and finally the third stage involves logical repair and/or recovery of data from the image.

There are specialist tools for all of these stages and even for a smaller operation the costs will quickly add up to the tens of thousands of dollars - at a minimum!

Qualifications are useful to guarantee a minimum level of knowledge and competency, however in IT in general I've found that experience and technical nous will trump qualifications every time. I surmise that this may be due to the sheer range of problems one may encounter in IT (and in data recovery particularly) - because the systems with which we work are so complicated, the failures and faults that can occur are many and varied.

To specifically answer your question, however, there are few qualifications world-wide that are data recovery specific. There are a couple of SANS courses in the USA and of course there are manufacturers in the USA, Russia and China that run training and offer a qualification for use with their own tools, however that's about it for data recovery, with the exception of contracted training for law enforcement which isn't generally available to the public. Aside from training, you're really on your own. From that point on, many data recovery tools and techniques are developed in-house and rarely shared. A data recovery specialist therefore needs to be creative, logical and patient ? patience is very important as some recoveries can be quite difficult!

I never like to present a financial wall between a person or business and their lost data. Being a smaller operator I've therefore been very glad to offer significantly lower pricing than my competition, however sometimes for physical recoveries even my lower pricing can still be expensive to an individual. Not all recoveries go ahead, and indeed even for the relatively smaller jobs of a few hundred dollars it's not unusual to get a 'thanks but no thanks' response. For those jobs where my potential client is completely serious about getting their data back, it's easy to understand why they're happy to pay when you consider what they're paying for. From irreplaceable photos of a passed family member to baby photos to happy snaps from their 'trip of a lifetime', I do understand their desire to get everything back. For a business, the decision to proceed will generally come down to costs: how much does it cost to recreate the lost data versus having it recovered? A simple business decision, generally ? if sometimes painful!

Usually there are clear signs of relief, I'd say! I always seem to have had excellent customers who are very easy to work for, quick to pay and loud with their praises to friends and family. Working for such people is a pleasure.

It does feel good to bring a successful report back to my clients, absolutely. I'd say though that it isn't the reward that drives me in recoveries, more it's how I know some will feel if the recovery fails (and that does happen). I work very hard to generate a good result and it is always a pleasure to deliver the good news.

Keep two or more copies of your most important data, ideally with one off-site copy (that is, out of the room or building where your other copies are. If you have a fire or theft and everything in your computer room is stolen or destroyed, do you have somewhere else to go to get your treasured photos or work? If not, start today.

Consider using an external hard drive with automated backup software (Windows: Syncback or Windows Backup; Mac: Time Machine; Linux: Rsync or fwbackups to name a couple) and also maybe consider trying an online option such as CrashPlan (useful in case of fire or computer theft).

Another simple idea is to buy two external hard drives between you and a friend or family member, then each keep one. Backup your most important data to your drive and then swap drives every other week or whenever you meet up for coffee/at work/wherever. This way you're protected a little better against fire and theft as well as the normal accidental deletion/drive failure/accidental drops/etc.

Basically, if all my work dried up tomorrow I'd be happy (but maybe a little hungry when the money ran out!). Please, don't be one of my customers - get a backup strategy in place today!

Actually, I've had several repeat customers, some of them quite technically-inclined people at that. I can only wonder after their first data loss (and subsequent recovery) as to why they didn't at least buy an external drive to make just one extra copy of their data! Usually the first experience with data loss is enough to prompt someone to investigate backing up if they've not done it before. It's honestly not difficult to do, so if you're reading this now and do not have a backup, take this opportunity to get something set up. Don't put it off!

That's going a bit far, I think! We're more like a last-resort for the desperate. Part of my job that I do not really enjoy is to tell business customers at the beginning of a recovery to get working on a Plan B immediately. Data recovery is certainly not a guaranteed 'fix' - it isn't always possible to recover lost data, depending on the cause of the data loss in the first place, although we do our best! Rather than a hero you might call us an emergency parachute, which is used after the main 'chute has failed and the ground is coming up fast. Not inspiring, I know, but that's the reality!

Data loss has many causes:

• Virus attack or O/S contamination
• Mechanical hard drive failure
• Accidental deletion of files or partitions
• Accidental formatting of drive or media
• Corrupted partitions or disk volumes
• Physical damage from fire or flood
• Electrostatic discharge (ESD) damage
• Software corruption

Data recovery is possible from these and other scenarios, but is never a given. I'd say the most common cause of data loss we see is from a dropped or damaged external hard drive, where photos or other important data is stored there and only there.

Hard drives fail. They're far from indestructible! In fact, there is no brand of consumer storage that you would consider 'safe'. We've sacrificed safety for capacity ? you can't do much about it except make regular backups and hope for the best. Flash memory devices (memory cards from phones and cameras, commonly) tend to fail in a few predictable ways and the data is not always recoverable. Since 2006 when perpendicular recording was widely adopted, the reliability of drives sharply dropped. Instead of having a 120GB hard drive that would last for 6-10 years, we now have 160GB to 3TB+ drives that may last 2 or 3 years if you're lucky. Drives including and over 500GB are generally less reliable than the smaller ones, too, but regardless of size I would never trust any modern hard drive alone with my data. It's a sad state of affairs, but that's the way it is unfortunately.

If you take nothing else away from our discussion today, the key point is this: backup often and to multiple locations!