Our client in this data recovery case had been the proud owner of a Samsung M3 external hard drive. Then the external drive took a tumble off of their desk and hit the floor. In a matter of seconds, our client was now the significantly less-proud owner of a paperweight. To make matters worse, their new paperweight now also moonlighted as a clock. This clicking Samsung M3 external hard drive needed the help of a team of data recovery experts. Fortunately for our client, Gillware Data Recovery has plenty of Samsung M3 data recovery specialists.
Samsung M3 Data Recovery Case Study: Encrypted SecretZone File Recovery
Drive Model: ST1000LM024
Drive Capacity: 1 TB
Operating/File System: Windows NTFS
Data Loss Situation: Samsung M3 portable external drive fell off of user’s desk and started clicking
Type of Data Recovered: Documents and photos in SafeZone encrypted partition
Binary Read: 99.9%
Gillware Data Recovery Case Rating: 9
Our engineers have no shortage of experience when it comes to clicking hard drives. This case would be a little different than your run-of-the-mill dropped hard drive case, though.
Our client here had been squirreling away their documents in an encrypted virtual partition—Samsung’s own brand of hard drive encryption, the aptly-named “SecretZone”. After fixing the hard drive, our engineers would have to deal with the encryption to make sure our client’s data was in as good shape as possible. Fortunately, while dealing with encrypted hard drives can mean harder work for our engineers, we’re more than well-equipped to handle it.
The SecretZone used in Samsung M3 external drives is a security tool that creates an encrypted “zone” inside your external hard drive. The encrypted partition is invisible and inaccessible without the proper credentials. The Samsung SecretZone software, installed on the user’s computer, acts as the “gatekeeper” for the user’s encrypted data, allowing them to create, manage, and access encrypted SafeZone partitions on their external drive.
SecretZone is Samsung’s answer to the various forms of encryption employed by other external drive manufacturers. It’s sort of a cousin to Western Digital Smartware. However, whereas Smartware encrypts the entire hard drive on a physical level and leaves only a few sectors unencrypted, SecretZone takes an area of the disk and encrypts that, leaving the rest of the external drive unprotected.
Samsung SecretZone works by creating a “soft” partition. A soft partition doesn’t physically separate the drive the way creating a partition in Windows Disk Manager (or the Mac equivalent) would.
Rather, a soft partition creates a single “container” file. If you think of a hard drive as a house with every room representing a “hard” partition, a “soft” partition is more like a cabinet or dresser (or, in this case, a safe). You can put things in it, move it around, or get rid of it easily.
The SecretZone container file has the “.msr” extension. This file is hidden, so the user can normally only see it using the SecretZone management software. Using the Samsung SecretZone software allows the user to “mount” the .msr file and view its contents.
Samsung SecretZone fulfills the same purpose as any other data encryption tool—prevent your data from falling into the wrong hands. This is a quite possible scenario whenever you store data on a portable device, making encryption a particularly useful feature.
Another word for a “soft” partition is a “virtual” partition. Virtualization allows a single file on a hard drive to “pretend” to be a hard drive within the physical drive. The .msr file used by Samsung SecretZone also pretends to be a hard drive (but only when accessed using the correct password).
We here at Gillware know a lot about virtualization. In fact, our data recovery experts have pioneered more than their fair share of groundbreaking techniques to retrieve data from virtual hard drives. That said, though, even in the virtual world, the SecretZone is a bit of an unusual beast. It’s entirely proprietary, and unlike your typical VHD or VMDK, only Samsung’s own SecretZone management software can crack it open. What’s more, the SecretZone software actually needs the Samsung external hard drive’s USB-SATA bridging dongle in order to recognize the .msr file. That means if you take the drive out of a Samsung M3 external casing and stick it into a third-party SATA case or try to slave the naked drive directly to your computer, the SecretZone software won’t recognize the virtual partition!
It was another wrinkle in this Samsung M3 data recovery case. However, for our engineers, it would not be an insurmountable one.
The clicking hard drive went straight to our cleanroom data recovery lab. There, our engineers diagnosed it with failing read/write heads. The hard drive clicking came from the sound of the heads, which could no longer read any data from the hard disk platters, sweeping back and forth across the platter surfaces.
One set of replacement read/write heads later, and we could create a forensically-sound and nearly-complete disk image of the failed Samsung M3 external hard drive on one of our own hard drives. Some platter damage prevented a complete read—but we had 99.9% of the disk’s contents.
Using the client’s own Samsung M3 external hard disk casing (and the USB-SATA bridging dongle within) with our own healthy hard drive, we could use the SecretZone software to find the .msr file. With the client happy to provide their password, we could mount, access, and transfer data from the soft partition, confirming that we had successfully recovered the vast majority of the client’s sensitive and valuable data. We ranked this Samsung M3 data recovery case a 9 out of 10 on our case rating scale.