Kirk, one of our cleanroom engineers, works on a hard drive data recovery case in our data recovery lab.
Gillware’s engineers perform professional hard drive data recovery on a daily basis, and have been doing so for well over a decade. There is no problem we haven’t seen (usually hundreds of times) before. Gillware has performed over 50,000 documented successful hard drive data recovery operations since 2004. Four of our engineers have logged over 10,000 hours of hard drive data recovery work each. These data recovery engineers are who you want performing the work when it really counts. There is no substitute for experience.
Hard drive repair comes in three major categories: hard drive firmware repair, hard drive internals repair, and printed circuitry repair. It is not at all uncommon for a single hard drive to have suffered more than one problem and require multiple repairs.
Hard Drive Firmware Repair
Your smart phone has an operating system, like Android or iOS. Your computer or server has an operating system, like Windows or Linux. Your hard drive has an operating system of its own as well. Hard drive firmware contains all the logic for controlling and supplying access to the data. It also contains a lot of unique information that is critical to your specific drive’s behavior. It is not uncommon for all of the physical and electrical components of a failed hard drive to be perfectly healthy, but a firmware corruption has turned the drive into a proverbial brick.
The two most common corruptions are corruptions of the SMART tables and growth defect lists. The drive wants to keep track of its internal health, so if it starts to degrade it can warn the user to replace it before it is too late. It stores this information on the platters, in the firmware zone, as SMART attributes. The drive also wants to extend its life as long as possible, and not brick itself due to a small handful of bad sectors. As sectors degrade in their ability to store the binary ones and zeroes, they are added to a G-List or growth defect list.
If these two features are trying to help, why do they commonly become corrupt and end up bricking a drive? Sometimes a drive is having difficulty writing data due to a defect in one of the magnetic write heads. It wants to report these write issues to the SMART tables or report these “bad sectors” as being unable to hold newly written binary. The bad news? It needs to use those same failing write-heads to do so!
The firmware area is much lower density than the user area so writing data to them is indeed easier, but not so much easier that it is guaranteed. So if a failing write head writes gibberish to the firmware zone, the next time the drive boots and tries to check the SMARTs it will read that junk. If the operating system isn’t coded to deal with random junk instead of what it expects to be there, a lot of bad things can happen, including abruptly failing to load the hard drive operating system.
While the defect lists and SMART tables are the most common culprits, bugs in HDD O/S developer’s code or random corruptions can occur just about anywhere in the firmware zone.
Hard Drive Firmware Repair Process
Hard Drive Firmware Repair – Achieve Access
The first step is to gain access to the firmware. Hard drive manufacturers don’t publish their internal specification for how to access the firmware. They are constantly changing and working to secure their operating system from the public. It can be difficult just to access this protected area of the disk on a healthy drive, and it can be incredibly difficult to access when the drive is a brick because the firmware can’t load. The tools and techniques for achieving access vary wildly from model to model, but they all basically boil down to tricking the drive into thinking it is in the factory, interrupting the standard boot loader process. Some manufacturers work really, really hard to make sure the bad guys can’t get in there, especially when a drive is marketed as secure, because the hard drive operating system contains things like BIOS passwords too.
Hard Drive Firmware Repair – Analysis
The good news is that we have achieved access to the firmware. The bad news is that what you find is undocumented, compiled code. There aren’t any comments in the code explaining what does what. You need to have a ton of experience in doing this forensic analysis. You need to be able to read the hexadecimal op codes like you would read a book. You need to be able to compare the compiled code to a doppelganger, ideally a drive with the exact same baseline firmware built within a week of yours and in the same country as yours. Comparing apples to apples, the job is to identify where they differ (most differences are not corruptions, but rather naturally occurring) and ultimately conclude with a diagnosis on what is wrong.
Hard Drive Firmware Repair – Fix It!
This is usually the easiest part. Having achieved access and proper diagnosis, all that needs to be done is to replace the corrupted areas of the firmware with stuff from the healthy doppelganger. It helps having over 100,000 hard drives in the building: Gillware’s engineers have lots of candidates for donor firmware. We also have to hope that it wasn’t the unique production defect lists or in-factory calibrations that suffered the hit. We also need the read/write heads to be healthy. Sometimes the reason the firmware is corrupted in the first place is because the read/write heads are bad. Even though we could read the firmware and figure out what we want to do, these heads just won’t cut it and now we need an internal data recovery.
Hard Drive Internal Component Repair
Our head cleanroom engineer Mike performs a hard drive data recovery operation.
The guts of the hard drive are common failure points. Motors, headstacks and even platters can have issues. Analysis to figure out what is wrong need to be handled by experienced professional hard drive recovery experts in a clean-room environment. Lots of data recovery labs talk about how great their clean rooms are, and Gillware has some pretty great ISO5 certified clean environments. The truth is a clean environment, while a vital prerequisite, doesn’t get you anywhere on its own. There are lots of biologists all over the world with access to clean air environments, but they can’t help you repair your hard drive.
Head Stack Assembly (HSA) Hard Drive Repair/Replacement
Hard drives suffering the click of death usually have issues with the read/write head stack assembly. Sometimes the tiny heads pick up particulate and get dirty, so they can’t read data.
Sometimes a drive suffers an improper shut-down and the heads have friction with the platters. That will result in platter damage and a bent or broken head-stack. Sometimes, they just suffer from adaptive drift. They were calibrated in the factory, but over time the baseline conditions have changed to the point that they would need to be re-calibrated, if re-calibration didn’t involve destroying all your data.
The number one rule of data recovery is do as little as possible to alter the baseline condition, remembering that each drive has all their uniqueness and every component replaced will conflict with that baseline and impede data recovery. Cleaning or replacing the entire HSA are both common. Finding compatible heads is a constant battle, even with our large hard drive library containing over 100,000 parts drives.
A head stack assembly removed from its hard drive
Hard Drive Motor Failure
Especially in external hard drive data recovery, seized spindle motors are very common. This type of recovery must always take place in a clean air environment. Even the tiniest invisible particulates in the air can cause big trouble when attempting to perform data recovery. Most often the spindle will need to be replaced, but re-balancing of the hard drive platters on the new motor can be very tricky.
Sometimes the motors aren’t fully seized and there is a small burr inside that can be dealt with, so you don’t have to take the platters off the motor. Sometimes the motor itself would spin freely if it weren’t for the set of magnetic read heads jammed on the platter, instead of resting in a bumpy/lubricated landing zone or plastic ramp. In these cases while the motor itself isn’t the problem, it is very common for those heads to have caused scratches on the platters during their massive deceleration from 7,200 RPM.
Quite often Gillware will receive broken hard drives that have previously been serviced by other labs. The other lab will mention that they failed because of platter scratching. They may have replaced a head-stack, but the replacement parts were immediately killed by impacting invisible debris, so they failed to recover the data.
The platters need to be restored in a process called burnishing. The actual data that lived on the scratches is gone forever, turned into a fine magnetic dust. Some of that particulate has scattered and embedded itself in the platters. Hardly any of it can be seen with the naked eye. Gillware needs to glide test those platters to see where the damage lies, and then burnish the surfaces to remove that particulate so replacement parts are not immediately killed by an impact.
Hard Drive Printed Circuitry (PCB) Repair
The printed circuit board on your hard drive can fail, often due to a power surge or blackout. One thing we hear all the time at Gillware is, “Why don’t you just swap the board?” This used to work. But for the better part of a decade, just about every hard drive manufactured has been putting unique and critical content in the PCB. Drives are assembled from components from many sub-component manufacturers.
The control board from a hard drive in our cleanroom
Each sub component is built with certain tolerances, but none are identical. The magnetic field strength of the magnetic read/write heads, the purity of the copper coils, the regions of the platters that hold data poorly, and more than a dozen other factors make each drive a unique snowflake.
Post manufacture these drives are calibrated to measure their uniqueness against the norm. We call these measurements adaptives. Most modern drives have a small subset of the adaptives in the ROM, along with a unique logical-to-physical head mapping and a potentially unique location of the firmware zone.
These PCBs are unique and cannot just be swapped from a drive. If you want to test this, go buy two brand new Toshiba or Seagate drives and swap the boards from one to another. They just won’t work. They’ll probably make a ticking noise as the read/write heads blindly swing back and forth across the platters’ radius (because the calibrations are wrong). Hopefully, you don’t have any data on the drives, as it is potentially hazardous to do this.
When a PCB is smoked, what can be done? This operation is going to involve an electrical engineer with a lot of experience to perform the hard drive failure analysis and make a determination on the best course of action. Most often, the engineer will know where all that unique information lives. They can physically remove a few chips that contain the critical information and transfer them to a doppelganger. Sometimes the information lives on a surface mounted chip with hundreds of pins. It might be easier to trace the failed components on the board and replace them. Sometimes, the problem is the ROM itself is corrupted, and a firmware engineer needs to attempt to either logically repair the ROM or extract its uniqueness.
Encrypted Hard Drive Recovery
Professional Hard drive data recovery is a bit more complicated when a drive has been fully encrypted. There is no way to target relevant data about the filesystem or files on a hard drive prior to decrypting it, which can make data recovery a more intensive process, as our data recovery engineers must get as close to a 100% image of the failed drive as possible in order to make sure all of the user’s data has been recovered. This can require significantly more repair and logical analysis work.
Professional Hard Drive Data Recovery by Gillware
You wouldn’t want to be the first ever patient for a heart surgeon. You’d want a surgeon that has performed that operation thousands of times with a proven success rate. You wouldn’t have a newbie car mechanic at a chain change the transmission on your 1970 Ferrari 365 GT. You’d want an experienced mechanic with decades of experience sourcing and installing transmissions on European exotics. There are significantly more heart surgeons in the US (over cardiac 1,000 surgical groups in the US) than data recovery engineers in the US(less than a dozen high quality data recovery labs).
Whether it is a single hard drive for data recovery or multiple hard drives that failed in a RAID array, Gillware is the experienced group you want working on your case. Gillware’s professional hard drive data recovery experts always give free evaluations and firm price quotes, and you never pay us unless we have successfully recovered the data that’s important to you. We’ve seen it all hundreds of times before. No matter what type of HDD data recovery service you need, we have the staff, the facilities, the proven tools, and the data recovery techniques to do the job right.
Best-in-class engineering and software development staff
Gillware employs a full time staff of electrical engineers, mechanical engineers, computer scientists and software developers to handle the most complex data recovery situations and data solutions
Strategic partnerships with leading technology companies
Gillware is proud to be a recommended provider for Dell, Western Digital and other major hardware and software vendors. These partnerships allow us to gain unique insight into recovering from these devices.
RAID Array / NAS / SAN data recovery
Using advanced engineering techniques, we can recover data from large capacity, enterprise grade storage devices such as RAID arrays, network attached storage (NAS) devices and storage area network (SAN) devices.
Virtual machine data recovery
Thanks to special engineering and programming efforts, Gillware is able to recover data from virtualized environments with a high degree of success.
SOC 2 Type II audited
Gillware has been security audited to ensure data safety, meaning all our facilities, networks, policies and practices have been independently reviewed and determined as completely secure.
Facility and staff
Gillware’s facilities meet the SOC 2 Type II audit requirements for security to prevent entry by unauthorized personnel. All staff are pre-screened, background checked and fully instructed in the security protocol of the company.
We are a GSA contract holder.
We meet the criteria to be approved for use by government agencies
GSA Contract No.: GS-35F-0547W
Our entire data recovery process can be handled to meet HIPAA requirements for encryption, transfer and protection of e-PHI.
No obligation, no up-front fees, free inbound shipping and no-cost evaluations.
Gillware’s data recovery process is 100% financially risk free. We only charge if the data you want is successfully recovered.
Our pricing is 40-50% less than our competition.
By using cutting edge engineering techniques, we are able to control costs and keep data recovery prices low.
Instant online estimates.
By providing us with some basic information about your case, we can give you an idea of how much it will cost before you proceed with the recovery.
We only charge for successful data recovery efforts.
We work with you to define clear data recovery goals for our technicians, and only charge you upon successfully meeting these goals and recovering the data that is most important to you.
Gillware is trusted, reviewed and certified
Gillware has the seal of approval from a number of different independent review organizations, including SOC 2 Type II audit status, so our customers can be sure they’re getting the best data recovery service possible.
Gillware is a proud member of IDEMA and the Apple Consultants Network.