The client in this data recovery case study came to us with a beeping Seagate hard drive. When they powered on their laptop one morning, it wouldn’t boot. The computer told them that the hard drive was not detected. So the client opened up their laptop, removed the Seagate Momentus Thin hard drive inside it, and connected the drive to a USB adapter to try and read it on another computer.
And that was when the client heard the beeping from their hard drive. The hard drive tried to spin up when the client ran power to it. But there was something in the way. Instead of producing its usual noises, the hard drive could only make a weak, repetitive beeping noise.
Beeping Seagate Hard Drive Recovery Case Study: Rubber Meets the Road
Drive Model: Seagate ST320LT007 Momentus Thin
Drive Capacity: 320 GB
Operating System: Windows
Situation: Hard drive is inaccessible and won’t spin up, making a beeping noise; is encrypted with McAfee SafeBoot
Type of Data Recovered: Documents
Binary Read: 100%
Gillware Data Recovery Case Rating: 10
When you run power to a hard drive, a spindle motor inside it begins to move This motor spins the drive’s platters containing your data at 5,400 to 7,200 revolutions per minute. The movement of the hard disk platters produces a cushion of air that holds the drive’s read/write heads aloft a scant few nanometers above the platter surfaces.
However, something had happened to this client’s Seagate hard drive to prevent this process from carrying all the way through. Like CDs, DVDs, and records, the platters in your hard drive need to be in motion in order for you to read the data on them. When some sort of hard drive failure interrupts this mechanism, the hard drive becomes inaccessible.
There are several kinds of failure that can stop a hard drive’s platters from spinning and produce the beeping our client had heard. The motor’s lubricant, which keeps it spinning freely, can dry up over time. Or the read/write heads can crash on the platters and stick to them, holding the disks in place while the motor tries to spin them. Upon opening up the client’s beeping Seagate hard drive, our engineers found that the latter scenario had happened.
The hard drive’s read/write heads had crashed, rubbing on the platters and sticking to them. The heads, clamped down like a vise, restrained the drive’s platters. Try as the motor might, it couldn’t budge them at all. The struggles of the hard drive spindle motor to spin the platters in vain produced the beeping noise the client had been hearing.
After removing the read/write heads, our engineers found that the spindle motor still spun freely. Sometimes, when the read/write heads rub up against a hard drive’s platters and stop them from spinning, the motor can burn itself out—especially if the user keeps running power to the drive to see if it will start working again on its own. Fortunately, this hadn’t happened, and so the only part of the hard drive that had to be replaced was the set of crashed read/write heads.
The next step was to create a sector-by-sector copy of the client’s hard drive on one of our own healthy hard drives. After repairing the drive, our engineers could read 100% of the sectors on the hard drive’s platters.
After making repairs to the client’s beeping Seagate hard drive (which no longer beeped), it was time to deal with the encryption. Generally, all forms of software full-disk encryption work about the same way, with minor variations between different vendors and techniques. Our data recovery engineers must use our forensic imaging tools to create an image of the user’s encrypted data on a healthy hard drive, then use the user’s password to decrypt the data.
Our engineers handed our complete forensic image of the failed hard drive to our logical engineer Cody for decryption. For encrypted hard drive data recovery cases, this is the moment of truth. While a failed hard drive is still encrypted with full-disk encryption like SafeBoot, there’s no way for our engineers to see what we’ve recovered until we decrypt the disk image. Granted, in this case we had fully imaged 100% of the contents of the drive’s platters, so we could be reasonably certain that we’d gotten everything. But we couldn’t fully rule out the possibility of some logical damage.
After decrypting the disk image, Cody examined the drive’s contents, just to make sure all was safe and sound. If the drive’s directory structure or file definitions, or the files themselves, had suffered any logical damage as a result of the drive’s physical failure, it could impact the quality of the recovery.
Cody’s examination showed that all was well with this drive’s contents. Nothing appeared to have fallen out of its proper place, and none of the data had suffered any logical damage or corruption. The client’s critical documents were all in good shape. Our engineers had recovered all of the valuable data from this beeping Seagate hard drive. We rated this data recovery case a perfect 10 on our ten-point scale.