Not all data loss situations involve your hard drive physically failing. At Gillware, we often see perfectly healthy storage devices brought to us after a logical hard drive failure. In many cases, these drives may appear to have failed. They will spin up, and they won’t make horrible or unusual noises. But the user can’t boot up, and might be greeted by a black screen or blue screen. None of the startup repair techniques they’ve looked up online or system repair options they’ve tried have worked. Their local computer repair expert or IT department couldn’t pull the data off of them. And so the users brought their drives to us.
There are many different ways hard drives can sustain logical damage. Logical damage can be self-inflicted—the result of your hard drive inadvertently writing corrupted data to itself—or inflicted by the user, usually by accident. In these cases, the drive’s physical components are almost always totally healthy. The platters are unscratched. The motor spins fine. There aren’t any shorted-out spots on the controller board. The read/write heads work fine, but maybe they just had a little bit of a hiccup when your external hard drive was prematurely unplugged and wrote corrupted data.
Hard drives and other data storage devices need to be designed in a very specific way so that your computer can detect them. When you connect a hard drive via SATA or USB cable, or you plug your USB thumb drive into an open port, your computer looks for the device’s firmware first. When your computer can find it, that’s good. It will recognize that there actually is a device attached to it. The next thing your computer will look for is sector 0. At sector 0, your computer hopes to find a blueprint for the whole drive.
Sector 0 will tell the computer how many partitions are on the hard drive, and which sectors they start at. Sector 0 may say, for example, “I have a superblock at sector 2048.” The computer will look at that sector. It tells the computer that a NTFS partition starts there and spans the length of the entire drive. Or Sector 0 may say “I have a superblock at 63 and another at 404,640.” And the computer will check those sectors and find a small FAT32 partition at 63 and a larger HFS+ partition at 404,640.
These superblocks also point the computer toward the file definitions inside each partition. The file definitions tell the computer where all the files and folders live, how much space they take up and how to reach them. In a process that seems almost instantaneous, your computer has a complete picture of your device.
But if this picture is incomplete in any way, the whole process breaks down. This typically happens due to some sort of corruption of the partition table. As a result, the computer will see a “blank” drive and ask you for permission to format it. Computers are fast, but they’re not actually all that smart. They need a lot of hand-holding to find their way around a storage device.
Deleted Files, Reformatted Drives, Reinstalled OSes: Where Does Your Data Go?
Hard drives can also suffer logical damage when you delete files, reformat your hard drive, or factory reset your operating system. Unlike in cases of physical drive failure, you aren’t actually damaging the drive. What you are damaging is the data inside it.
When you delete data or reformat your hard drive, you are actually making a very small change (albeit with big consequences). That is why these processes can happen very quickly. Deleting a file doesn’t change every sector in it into zeroes. Instead, your hard drive goes to its bitmap file and looks up the clusters containing the file you want to delete. The bitmap keeps a record of all the clusters, with a flag marking the ones that are in use. The drive takes the deleted file’s clusters and marks them as unused. Voila—no more file! But it’s still there, if you know where to look and how to get there.
Reformatting your hard drive only changes the partition table and writes a new superblock, along with new file definitions and a new bitmap file. The new partition table points to the new superblock. And the new superblock points to the new file definitions and bitmap. Most, if not all of the old data will still be there. The new file definitions and new bitmap might overlap the old ones, but they are much smaller (since the new partition is empty).
Data recovery can be a little more difficult after a System Restore or O/S reinstall. When you delete files and reformat data, you’ve marked that data as available free space. And when you write more data to the drive, as is the case when you reinstall an operating system, you risk covering up the old data and destroying it—for good. In these cases, we can identify how much of the old data has been overwritten and corrupted, and how much is still viable.
How Gillware’s Logical Hard Drive Failure Recovery Tools Work
The same forensic imaging tool we use to create disk images of customer drives also helps us with logical analysis. HOMBRE is an intelligent, write-blocked imaging tool with extreme fault tolerance. With HOMBRE, we can control a hard drive’s performance in order to read it, even if no other computer can. And because HOMBRE is write-blocked, it is impossible for us to make any changes to the drive.
In logical hard drive failure cases, our engineers use HOMBRE to record every single sector on the hard drive. HOMBRE keeps a status map of how many sectors it has read and how many it hasn’t. Sometimes, if a drive is damaged or its platters are aging, it isn’t always possible to get a complete read. But we strive to get as close to 100% as possible. Hombre cross-references the status map with its relational database to help us figure out the drive’s partitioning geometry.
HOMBRE is a powerful logical data recovery tool when a hard drive has been reformatted. As long as the superblock (or the backup superblock) for the old partition still exists, HOMBRE can find it, even if the partition table no longer points toward it. From there, our engineers can figure out how much of the old file definitions still exist. When data has been deleted, our engineers can also search for old versions of the file definitions that can point to the deleted files. As a last resort, our engineers can use HOMBRE to scan the entire drive for common file headers. This technique can uncover thousands of different types of user-created files that no longer have any signs pointing to where they live.
Why Choose Gillware for Logical Hard Drive Failure Recovery?
At Gillware, our data recovery lab is staffed with world-class data recovery experts. The recovery tools like HOMBRE we use are some of the most powerful and robust logical data recovery tools in the industry. You can trust our experts to recover as much of your data as possible after your logical hard drive failure. Our logical hard drive failure recovery services are 100% secure and 100% financially risk-free. We even offer to cover the cost of inbound shipping. You only pay for our logical hard drive failure recovery efforts at the end, and only when we’ve recovered your critical data. To make absolutely sure your data is safe, we ship your data back to you on a new, password-protected hard drive. We delete your recovered data from our facility after you have received your new hard drive.
Ready for Gillware to Take Care of Your Logical Hard Drive Failure?
Best-in-class engineering and software development staff
Gillware employs a full time staff of electrical engineers, mechanical engineers, computer scientists and software developers to handle the most complex data recovery situations and data solutions
Strategic partnerships with leading technology companies
Gillware is proud to be a recommended provider for Dell, Western Digital and other major hardware and software vendors. These partnerships allow us to gain unique insight into recovering from these devices.
RAID Array / NAS / SAN data recovery
Using advanced engineering techniques, we can recover data from large capacity, enterprise grade storage devices such as RAID arrays, network attached storage (NAS) devices and storage area network (SAN) devices.
Virtual machine data recovery
Thanks to special engineering and programming efforts, Gillware is able to recover data from virtualized environments with a high degree of success.
SOC 2 Type II audited
Gillware has been security audited to ensure data safety, meaning all our facilities, networks, policies and practices have been independently reviewed and determined as completely secure.
Facility and staff
Gillware’s facilities meet the SOC 2 Type II audit requirements for security to prevent entry by unauthorized personnel. All staff are pre-screened, background checked and fully instructed in the security protocol of the company.
We are a GSA contract holder.
We meet the criteria to be approved for use by government agencies
GSA Contract No.: GS-35F-0547W
Our entire data recovery process can be handled to meet HIPAA requirements for encryption, transfer and protection of e-PHI.
No obligation, no up-front fees, free inbound shipping and no-cost evaluations.
Gillware’s data recovery process is 100% financially risk free. We only charge if the data you want is successfully recovered.
Our pricing is 40-50% less than our competition.
By using cutting edge engineering techniques, we are able to control costs and keep data recovery prices low.
Instant online estimates.
By providing us with some basic information about your case, we can give you an idea of how much it will cost before you proceed with the recovery.
We only charge for successful data recovery efforts.
We work with you to define clear data recovery goals for our technicians, and only charge you upon successfully meeting these goals and recovering the data that is most important to you.
Gillware is trusted, reviewed and certified
Gillware has the seal of approval from a number of different independent review organizations, including SOC 2 Type II audit status, so our customers can be sure they’re getting the best data recovery service possible.
Gillware is a proud member of IDEMA and the Apple Consultants Network.