SELF-HELP QUOTATION

Select the type of device from the list below.

 instant quote hdd icon
Hard Drive Recovery

instant quote ssd icon
SSD Recovery

instant quote flash icon
Flash Recovery

exFAT File System – to Save or Not to Save

exFAT File System – to Save or Not to Save


Background:

exFAT (Extended File Allocation Table), developed by Microsoft, is the preferred file system for use in many flash memory (USB devices, SD cards, etc.), embedded devices, and external drives with a unique combination of features.


The Most Prominent of These Features Are:

    • A fast, lightweight file system with low memory and power requirements optimised for flash memory and embedded devices.
    • Read and write cross-platform compatibility with Windows, macOS, Linux, and Android.
    • Improved free space allocation and deleted file performance.
    • Support for files larger than 4GB.


The
TL;DR:

The filesystem’s fast, lightweight, and low resource usage design is likely its biggest weakness, leading to potential data loss scenarios, especially when used as shared storage in mixed Apple Mac device and macOS environments.

Our Recommendations:

    • If you buy a hard disk drive with exFAT – reformat with APFS or HFS+ in a macOS environment and NTFS in a Windows environment.
    • If you must use exFAT:
      • Only use exFAT devices for transferring data between systems, e.g. between a camera and your PC.
      • Leave the drive connected to your PC for a period to complete pending read and write operations.
      • Always use the “Safely Remove Hardware and Eject Media” option on Windows and “Eject” on MAC before disconnecting the storage device.
      • Avoid using exFAT-formatted drives in shared data storage environments, e.g. network-attached storage (NAS), servers, etc.


Our Experience:

Over the years, we have helped many customers, mostly multi-media content creators, recover data from exFAT formatted storage devices facing potential data loss situations.


The Latest Issue:

In a recent incident, we encountered a curveball after transferring data recovered from two electro-mechanically failed 20TB hard drives to an exFAT-formatted 36TB G-RAID device using a Windows workstation. It's worth mentioning that the two failed 20TB drives were formatted with exFAT and had been used without any issues in a multi-generation Mac device and Windows workstation environment.

Within a week after delivering the data, the client contacted us about random folders that disappeared from the G-RAID device.

We re-formatted the G-RAID device with exFAT, this time using a macOS device, and transferred the recovered data. Two weeks later, the customer contacted us again, reporting that newly added videos and photos had vanished from the drive.

Upon scanning the G-RAID device, we discovered that the missing data had been classified as "deleted data". The primary folder structures, organised by event date and client name, were nowhere to be found. Only the last-level folders containing the footage remained, necessitating the time-consuming process of meticulously matching event dates with file timestamps to confirm a successful recovery. At this point, we were uncertain what was causing this “unique” problem.

The third time around, we re-formatted the G-RAID device with Apple's Native HFS file system and transferred the recovered data using the latest version of macOS. No further problems have been reported.

More Research:

This prompted us to do some research and additional testing; the results were concerning.

Since the release of macOS Big Sur and subsequent updates, numerous reports surfaced on the internet, highlighting issues ranging from read-only access to complete data loss. Some of these reported issues:

    • Read-Only Issues on Big Sur:
      • Users upgrading to macOS Big Sur reported exFAT USB external drives becoming "read-only," leaving them unable to modify or save files. This issue restricts the drives’ full functionality and disrupts the seamless cross-platform compatibility of the exFAT file system.
    • Incompatibility with Catalina:
      • Catalina users faced challenges sharing files between macOS and Windows on exFAT-formatted drives. Files written by Catalina on the exFAT drive seem to disappear when accessed from Windows 10, leading to data inconsistency and loss of trust in the file system.
    • Recognition Problems with New MacBooks:
      • Users with newer MacBook models, such as the MacBook Pro 2020 and MacBook Air M2 running macOS Ventura, reported issues with exFAT drives not being recognised. This raises concerns about compatibility and potential hardware-software conflicts.
    • Mounting Delays and First Aid Failures:
      • Some users using exFAT for its cross-platform support encountered drive mounting delays or complete failures to mount. Additionally, the First Aid utility, designed to diagnose and repair disk issues, often cannot complete its tasks, leaving users without a reliable tool for troubleshooting.
    • Data Inaccessibility and Deletion Concerns:
      • Perhaps the most alarming issue is the inability to access data from drives formatted with exFAT on an older MacBook when using a newer MacBook. In some cases, the hard drive is not recognised at all, leading to potential data loss and the inability to retrieve the data.

 Mac User Reports:

    • "Since updating to software version Big Sur, my exFAT USB is "read-only" with no way of accessing the files."
    • "I formatted to exFAT my SSD using my PC but my Macbook Pro doesn't detect it."
    • "I have a drive formatted in exFAT which I have happily been sharing files between Windows 10 and Mojave, with no issues whatsoever, until Catalina. Under Catalina, I can read files and write files to/from the exFAT drive, but any file written to the drive by Catalina cannot be found under Windows 10; it is just not there."
    • "Hi, I have a new external HDD, which I backed files up using my old MacBook. The external HD is formatted with exFAT. When I plug it into my new MacBook Pro (2020), it isn’t recognised at all. The drive still works perfectly well with my old MacBook."
    • "... I have so many issues with external drives formatted in exFAT. Since I use both Windows and Mac, I can’t use APFS (I think). Drives take forever to mount or never mount at all. First aid cannot be completed."
    • "I’m facing an issue to read files that are in ExFAT format created in the past with a MacBook Pro 2018 version in an external hard drive. Recently, with a new MacBook Air M2 with macOS Ventura I’m unable to access those files, the external hard drive is not even recognized so not possible to read them."

Finding a Possible Explanation:

This recent issue with our customer was unexpected, given that our customer successfully used exFAT file systems to store hundreds of terabytes in the past without data disappearing. We learned later from the client that the emergence of problems coincided with the recent OS updates of some of their Notebooks and Desktops. In addition to the data disappearance, they also had video playback issues, indicating a potential correlation with recent macOS updates and codec-related challenges.

Adding another layer of complexity, the G-RAID device in question is not a conventional single hard drive system; it employs a built-in hardware RAID configured with 2 x 18TB hard drives, configured as a RAID-0 volume for improved performance. This hardware RAID configuration could also influence the exFAT file system management and, specifically, how it handles file caching.

Clear As Mud:

It is still unclear why these issues occur, but it may also be attributed to the following:

    • In addition to the absence of a catalog file, another layer of complexity arises when considering the differences in GUID (Globally Unique Identifier) implementation between exFAT and Apple's file systems. GUIDs are unique identifiers assigned to various elements within a file system, such as volumes, partitions, and file entries, to ensure their distinct identification.
    • Apple's file systems, including HFS+ and APFS, utilise GUID Partition Tables (GPT) to manage disk partitions. GPT is a modern partitioning scheme that employs GUIDs to uniquely identify each partition on a storage device. This method aligns seamlessly with Apple's file systems, providing a robust and reliable structure for managing partitions and their associated data.
    • On the other hand, exFAT, being a file system developed by Microsoft, may implement its own GUID scheme for partition identification. When exFAT-formatted drives are connected to Apple machines, the differences in GUID implementation can introduce challenges. Apple's macOS, optimised for its native file systems and GPT, may encounter difficulties interpreting exFAT GUID structures, potentially leading to recognition issues, mounting delays, or unexpected behaviour.

In Summary:

While exFAT was designed to facilitate seamless file exchange between Windows and macOS, users’ real-world experiences tell a different story. The issues range from read-only problems to complete data loss, affecting users across various macOS versions and hardware configurations.

The unique combination of exFAT’s distinct file allocation table (FAT) structure, the absence of a catalog file, and potential disparities in GUID implementation can contribute to users’ reported issues when using exFAT.

As users continue to encounter challenges, it is imperative for Apple to address these issues to provide a more reliable and consistent experience for those relying on ExFAT for cross-platform file compatibility. Until then, users are advised to exercise caution and consider alternative file systems for their long-term data storage needs.

These complexities also highlight the importance of considering file system compatibility and the intricacies of partitioning schemes when seeking seamless interoperability across different platforms.

REQUEST A FREE ONLINE QUOTATION

Why You Should Transfer Data on Legacy Data Tapes to Modern Data Storage Platforms?

Why You Should Transfer Data on Legacy Data Tapes to Modern Data Storage Platforms?


1. Limited Lifespan:

Legacy data tapes (DAT, DLT, LTO1, LTO2, etc.) have a limited lifespan and will degrade over time. The tape medium, the internal components and the magnetic coating will deteriorate, leading to data corruption, normally in the form of reading errors and, eventually, rendering the tape unreadable (permanent data loss).

It is unfortunately not a matter of IF but rather WHEN.

2. Hardware Compatibility and Support:

Modern computers no longer support legacy tape hardware and their interfaces, e.g., SCSI technology. Therefore, accessing the data stored on these tapes requires specific, outdated hardware.

3. Obsolete Hardware:

Fully functional legacy tape drives have become increasingly scarce, costly and difficult to source and maintain. Sourcing one of these tape drives is not an easy feat, and if you are successful, there is typically no guarantee that the used device will be fully functional, with the added risk of causing more damage to the tape.

4. Software Compatibility and Support:

Modern operating systems and tape backup software are no longer compatible with legacy data tape devices. This includes a lack of support for the software drivers required to be able to connect to these devices and interface cards (e.g., SCSI controllers), adding another layer of complexity when trying to retrieve data.

5. Limited Recoverability:

As tapes age, they become more sensitive to the physical condition and quality of the tape drive used to read the data. Using an untested tape device may cause further damage to the tape medium, the internal components and the magnetic coating.

6. Specialised Skills:

Many legacy tape storage platforms require a knowledgeable and skilled technician to set up the hardware and software to restore and interpret or format the data if required.  Finding a technician with the required skillset for these legacy systems can be challenging.

7. Physical Storage:

Digital data tapes, like many other legacy storage mediums, e.g., CDs, DVDs and floppies, must be stored under optimal conditions. These conditions include temperature, dust, and moisture control, adding ongoing costs without guaranteeing that the data will be retrievable or that the tape will be recoverable.

8. Environmental Concerns:

Legacy tape systems can be less energy efficient as they require specific climate-controlled environments. In contrast, newer systems are more energy-efficient, reducing the carbon footprint.

9. Digital Forensics and Data Recovery:

In cases where data might be crucial, e.g., for legal or historical reasons, it's easier and more reliable to retrieve and analyse data from modern storage mediums than from aged, deteriorating legacy storage mediums.

10. Enhanced Data Protection:

Modern storage platforms come with advanced encryption and security features. This means your data is better protected from unauthorised access.

11. Data Archiving, Backup, Duplication and Redundancy:

Modern storage devices can be easily duplicated or backed up, ensuring data safety and added data security.

12. Speed:

Current storage solutions can retrieve and store data faster than legacy tapes. This speed is especially vital for businesses and organisations that require quick access to their archived data.

13. Better Data Management and Organization:

With modern storage solutions, you will benefit from better file management, allowing for easier indexing, search, and categorisation.

14. Physical Durability:

HDDs and other modern storage devices are, in general, more robust and less prone to physical damage than data tapes. Exposure to heat, pressure, dust, or exposure to magnetic fields can corrupt data tapes.

15. Enhanced Reliability:

Modern hard disks and Solid-State Drives (SSDs) are, in general, more reliable than data tapes. Data stored on these modern devices can last years without degradation due to their physical construction and features, like built-in error correction, even if stored in less-than-optimal conditions.

16. Futureproofing:

Technology is continually evolving. By migrating to a modern storage platform, you are positioning yourself or your organisation to align with future technological advances, ensuring smoother transitions and updates.

17. Ease of Integration:

Today's storage platforms can easily integrate with other systems and applications, making data sharing, analysis, and backup more streamlined.

18. Portability:

Legacy data tapes have a limited storage capacity. In contrast, modern hard drives can store terabytes of data. Consolidating multiple tapes onto a single HDD can help organise and access the data more efficiently.

Given the challenges and limitations associated with legacy tapes, transitioning them to a modern storage medium using pre-tested and configured hardware and software is essential for ensuring data longevity, accessibility, safety, reliability, and cost-efficiency.

 

Download the Infographic
Download the Infographic

What Is The SSD TRIM Command And Why Is It Important To Know How It Works?

What Is The SSD TRIM Command And Why Is It Important To Know How It Works?

The TRIM command (TRIM in ATA and UNMAP in SCSI) informs a Solid-State Drive (SSD) drive which data blocks are no longer in use and can be wiped internally. It was developed in response to SSDs' unique operation characteristics, which differ from traditional hard drives. Without TRIM, SSDs faced degrading write performance over time. TRIM assists SSDs in garbage collection, optimising write operations and preventing slowdowns.

 

Why Was TRIM Introduced?

SSDs and traditional hard drives handle delete operations differently. SSDs need to know which blocks are genuinely unused to optimise their operations. Overwriting on an SSD is more complex than on a traditional drive, leading to a phenomenon known as "write amplification." SSDs also come with extra storage capacity, which is not user-addressable. This is to assist with wear levelling, performance, and drive longevity. Data that gets deleted and marked trimmed by the OS might move into this non-addressable space, which makes traditional recovery methods ineffective.

 

How Does TRIM Work?

When files are deleted, the operating system sends a TRIM command to the SSD. After TRIM is executed and combined with the drive's garbage collection, the identified blocks can be written to without needing a prior erase, enhancing performance and lifespan. Different SSDs might implement the TRIM command differently, influencing their performance.

 

Data Storage and Deletion in SSDs:

Unlike magnetic hard drives, which use sequential writing, SSDs store data in blocks across multiple NAND chips concurrently, making them much faster. When data is deleted, rather than leaving it until it's overwritten like on a magnetic drive, SSDs often mark it for trimming. The garbage collection process in SSDs then cleans up these trimmed blocks. This can make data recovery and forensics difficult as deleted data can be irretrievably wiped in the background.

 

TRIM's Implementation & Support:

TRIM's effectiveness depends on the physical drive and the Operating System (OS). Many operating systems like Windows, Linux, macOS, and others have introduced TRIM support. The TRIM command can also be used on certain RAID configurations, but support varies depending on the RAID type and the platform.

 

Hardware Support and Variants:

Beyond ATA's TRIM, standards like SCSI have similar commands, like UNMAP. Other technologies, like shingled magnetic recording (SMR) hard drives, SD/MMC and NVM Express, have incorporated analogous commands to TRIM, suited to their specifications.

 

Data Recovery and Forensic Challenges:

Extracting deleted evidence from an SSD was traditionally done through chip-off analysis, which was labour-intensive and time-consuming. However, the increase in SSD capacities, the combining of electronic components in a single chip and features like trimming, built-in hardware encryption and how data is stored added additional levels of complexity to the recovery and investigation of data from SSDs.

 

Advanced-Data Recovery:

There are, however, several advanced data recovery methods, like the factory mode, that can provide a potential method to access deleted or non-addressable areas of an SSD. The method involves preventing the SSD from booting in its standard mode and using specialised tools (like ACELab PC-3000) to access its data in a raw format. Factory mode can prevent SSDs from running background processes that might overwrite or erase data, thus preserving potential evidence and potentially allowing the recovery of deleted data.

What Are The Disadvantages Of Having Trim Enabled?:

When TRIM is disabled, the SSD does not immediately erase the data blocks where files were deleted. This makes it more likely that deleted files can be recovered, assuming the files have not been overwritten with new data.

 

How to Check If TRIM Is Enabled or Disabled on Windows:

- Press the Windows key + X and select "Windows PowerShell (Admin)" or "Command Prompt (Admin)."
- Type "fsutil behavior query disabledeletenotify" and press Enter.
- If the result is "0," TRIM is enabled. If the result is "1," TRIM is disabled.

 

How to Disable or Enable TRIM on Windows

- To disable TRIM, type "fsutil behavior set disabledeletenotify 1" and press Enter.|
- To enable TRIM, type "fsutil behavior set disabledeletenotify 0" and press Enter.

 

The TRIM function introduced a new set of challenges for data recovery and digital forensics. Unlike magnetic drives, where deleted data remains until overwritten, SSDs actively manage and clean up deleted data. Factory access mode, for instance, presents a novel approach to accessing data previously only possible with labour-intensive methods like chip-off analysis.

REQUEST A FREE ONLINE QUOTATION

What You Should Not Do to a Failing or Failed Hard Drive?

Ten Things You Should Not Do To A Failing Or Failed Hard Drive

If the data is essential and you wish to maximise the likelihood of retrieving it!

In the era of the cloud and omnipresent digital storage, many of us forget the perils that come with storing data on physical hard drives. If you're facing a situation where your hard drive is failing or has failed, and the data stored on it is crucial to you, it's imperative to know what actions might worsen the situation. Let's delve into the don'ts of managing a troubled hard drive if you wish to have the best possible chance of recovering your data.

Electro-mechanical hard drive failure is typically associated with a clicking or noisy disk drive, the drive is no longer detected, or the drive is slow to respond to read and write requests.


1. Do Not Continue Using It

The more you use a failing drive, the more it deteriorates. Using the drive can overwork it, potentially making data recovery more difficult or impossible. This includes rebooting as constantly rebooting might cause more damage. Each start-up cycle puts stress on the drive.

2. Do Not Leave It Powered On

  • Hard disk drives - A knocking (or noisy) head stack will cause (more) physical damage to the platters and/or magnetic field if left knocking, possibly making the drive unrecoverable or only partially recoverable.
  • SSDs - Solid-state drives use a technology called SSD TRIM or trimming, whereby deleted data areas first need to be cleared before new data can be written. TRIM is an automatic function, that will erase any previously deleted data areas, making recovery impossible with standard data recovery tools, and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered on, the more likely the drive will execute trimming.
    • It is potentially possible to recover deleted data from an SSD using factory access mode if trimming has not yet been executed.

3. Don't Assume It’s Dead Immediately

  • Just because the drive isn't being recognised by your computer doesn't mean all hope is lost. Jumping to conclusions might lead to rash decisions.

4. Do Not Make Any Rash Decisions

  • Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
    • Are you willing to play Russian roulette with your data, possibly ruining any chance of recovery?
    • How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
  • The value of your (or your customers) data will ultimately determine your next action.
  • There may only be one chance at recovering data from a failed or failing drive!

Hard drives, SSDs and other storage devices are a lot more complex than many people think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - In essence, a computer within a computer. Every one of these components must be in a working condition for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.

 
5. Do Not Open The Drive

  • Hard drives are manufactured in a Class 100 cleanroom as they are extremely sensitive to airborne contamination. Opening a drive outside of a cleanroom environment will contaminate the drive, possibly leaving the drive unrecoverable.


6. Do Not Replace The PCB (The Printed Circuit Board)

  • There was a time when you could swap the PCB (between most drives) within a model range. The programming (firmware) on most modern hard drives is unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB, possibly leaving the drive unrecoverable or making recovery extremely difficult.

7. Avoid D.I.Y. Recovery Software

  • While there are many data recovery software solutions available, they might not always be the best choice for severe hardware malfunctions. These tools can strain the drive even more.


8. Do Not Run Any Disk Tool Or Utility

  • D.I.Y. disk tools are designed to test working hard drives and reallocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters complicating or hampering data recovery attempts.


9. Do Not Try To Write Data To The Drive

  • Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure, and you can possibly overwrite valuable data, leaving that data unrecoverable.


10. Do Not Format Or Initialise The Drive

  • If prompted, do not format or initialise the hard drive. This process will make data recovery much more challenging, as it can overwrite existing data. Formatting a failing hard drive may lead to permanent data loss or make recovery attempts difficult.


11. Do Not Run A System Restore Disk

  • Restore disks or system recovery programs are designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable, especially if run on a failing hard drive.


12. Do Not Bump, Drop Or Knock The Drive

  • There was a time when hard drives used bearings prone to seizing. A bump in some cases did solve the bearing problem, but you still ended up with platter damage due to the heads contacting the platters. Modern drives do not use bearings, and the only result will be platter damage and/or platter alignment issues, leaving the drive unrecoverable or, at best, partially recoverable.

13. Avoid DIY Fixes from Online Forums

  • While some online advice can be helpful, many "quick fixes" found on forums can do more harm than good. Not all solutions are applicable to every situation.


14. Avoid Heat and Cold

Exposing the drive to extremes, like using a hairdryer or putting it in a freezer, are myths that can cause more harm. Temperature fluctuations can lead to component damage or condensation.


Do not put the drive in a fridge!

    • This is an urban legend that may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or bad solder connections by lowering the temperature, causing the joints to contract to make contact again. This may have worked briefly until the device heated up, causing the “dry joints” to expand, breaking the connection again. 
    • Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint”, you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
    • The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit, leading to damaged components. The drive will, in most cases, be unrecoverable if one of those components happens to be the firmware chip.

A failing or failed hard drive can indeed induce panic, especially if vital data is at stake. However, making hasty decisions can exacerbate the situation. If the information is crucial, the best course of action is to stop using the drive immediately and consult with professional data recovery experts. This will give your or your customer’s data, the best possible chance of being recovered. Always remember, when it comes to precious data: act wisely, not quickly. You may only have one chance at recovering the data from a failed or failing drive.

Need Help In Recovering Your Data - Contact Us Now!

REQUEST A FREE ONLINE QUOTATION

Why You Should (As a Matter of Urgency) Transfer Your Data Stored On Floppy Disks To A Modern Data Storage Medium?

Why You Should (As a Matter of Urgency) Transfer Your Data Stored On Floppy Disks To A Modern Data Storage Medium?

 

1. Limited Lifespan of Floppy Disks:

Floppy disks, also known as stiffy disks, have a limited lifespan and will degrade over time. The disk and magnetic material on the disk deteriorates over time, leading to data corruption normally in the form of bad sectors or permanent data loss. 
It is Unfortunately Not a Matter of IF But WHEN!

2. Hardware Compatibility and Support:

Modern computers no longer have floppy disk drives or the physical interface to connect a floppy device. Therefore, accessing the data stored on a floppy disk requires specific, outdated hardware, becoming increasingly scarce, costly and difficult to maintain.

3. Software Compatibility and Support:

Modern operating systems are no longer compatible with legacy storage devices. This includes a lack of support for the software drivers required to be able to connect to a legacy storage device, adding another layer of complexity when trying to retrieve data from floppy disks.

4. Obsolete Hardware:

Sourcing a floppy (stiffy) device is not an easy feat, and if you are successful, there is typically no guarantee that the used device will be fully functional with the challenges of trying to sort out a malfunctioning device with the supplier.

5. Physical Storage:

Floppy disks, like many other legacy storage mediums, including tapes, CDs and DVDs, must be stored under optimal conditions. These conditions include temperature, dust and moisture control, adding to ongoing costs and without guaranteeing that the data will be retrievable or that the disks will be recoverable.

6. Physical Durability:

HDDs and other modern storage devices are more robust and less prone to physical damage than floppy disks. Exposure to heat, pressure, dust, or exposure to magnetic fields can corrupt a floppy disk.

7. Digital Forensics and Data Recovery:

In cases where data might be crucial, for legal or historical reasons, it's easier and more reliable to recover and analyse data from modern storage mediums than from aged, deteriorating legacy storage mediums like floppy disks.

8. Enhanced Reliability:

Hard Disks and Solid-State Drives (SSDs) are more reliable than floppy disks. Data stored on these modern devices can last years without degradation due to their physical construction and features, like built-in error correction, even if stored in less-than-optimal conditions.

9. Data Archiving, Backup, Redundancy and Security:

Modern storage devices can be easily backed up to cloud services or other physical storage mediums, ensuring data safety and added security. Floppy disks no longer offer seamless backup options.

10. Better Data Management and Organization:

With modern storage solutions, you will benefit from better file management, allowing for easier indexing, search, and categorisation.

11. Portability:

Stiffy disks have a very limited storage capacity, usually 1.44 MB for the most common version. In contrast, modern hard drives can store terabytes of data. Consolidating multiple floppy disks onto a single HDD can help in organising and accessing the data more efficiently.

Given the challenges and limitations associated with floppy disks, transitioning data to modern storage mediums is essential for ensuring data longevity, accessibility, and reliability.

REQUEST A FREE ONLINE QUOTATION

What Are The Advantages Of Having SSD TRIM Enabled?

What Are The Advantages Of Having SSD TRIM Enabled?


Prolonged Lifespan:

SSDs have a finite number of write cycles. The TRIM command helps by reducing unnecessary writes, thus extending the lifespan of the SSD by preventing them from wearing out prematurely.

Maintain Performance:

Over time, as data is written and deleted on an SSD, performance can degrade if the drive doesn’t know which blocks are in use and which are free. TRIM ensures the SSD can manage its storage space efficiently.

Efficiency:

Without TRIM, SSDs might waste time writing to blocks considered in use by the drive but are free, slowing down write operations.

Garbage Collection:

TRIM aids in the SSD's garbage collection process, an internal process to clean and manage deleted or invalid data blocks.

Compatibility:

Not all operating systems and SSDs supported TRIM initially. However, modern OS and SSDs typically support TRIM for better efficiency and performance.

 

The TRIM command is crucial in maintaining the efficiency and longevity of SSDs. It aids in optimising write operations by letting the SSD know which blocks are no longer in use. While it has vast support across different operating systems and hardware, it's essential to ensure correct implementation to avoid potential issues.

REQUEST A FREE ONLINE QUOTATION

10 Things You Should Not Do To A Failing Or Failed Hard Drive

Ten Things You Should Not Do To A Failing Or Failed Hard Drive

Hard drive failure is typically associated with a clicking or noisy disk drive, the drive is no longer detected, or the drive is slow to respond to read and write requests.


1. Do Not Make Any Rash Decisions.

  • Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
    • Are you willing to play Russian roulette with your data, possibly ruining any chance of recovery?
    • How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
    • The value of your (or your customers) data will ultimately determine your following action.
    • There may only be one chance at recovering data from a failed or failing drive!

Hard drives, SSDs and other storage devices are much more complex than many think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - A computer within a computer. Every one of these components has to be in a working condition for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.


2. Do Not Leave The Device Powered On.

  • Hard disk drives - A knocking (or noisy) head-stack will cause (more) physical damage to the platters and/or magnetic field if left knocking possible, making the drive unrecoverable or partially recoverable.
  • SSDs - Solid-state drives use SSD TRIM or trimming technology, whereby deleted data areas must first be cleared before new data can be written. TRIM is an automatic function that will erase any previously deleted data areas, making recovery impossible with standard data recovery tools and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered on, the more likely the drive will execute trimming.
    • It is potentially possible to recover deleted data from an SSD using factory access mode if trimming has not yet been executed.

3. Do Not Open The Drive.

Hard drives are manufactured in a Class 100 cleanroom as they are susceptible to airborne contamination. Opening a drive outside a cleanroom environment will contaminate the drive, possibly leaving the drive unrecoverable.

4. Do Not Replace The Pcb (printed Circuit Board).

  • There was a time when you could swap the PCB (between most drives) within a model range. However, the programming (firmware) on most modern hard drives is unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB, possibly leaving the drive unrecoverable or making recovery extremely difficult.

5. Do Not Run Any Disk Tool Or Utility.

  • D.I.Y. disk tools are designed to test working hard drives and re-allocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters and corrupt the firmware programming, complicating or hampering data recovery attempts.


6. Do Not Try To Write Data To The Drive.

  • Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure, and you can possibly overwrite valuable data, leaving that data unrecoverable.

7. Do Not Format The Drive.

  • Formatting a failing hard drive may lead to permanent data loss or make recovery difficult.

8. Do Not Run A System Restore Disk.

  • Restore disks or system recovery programs are designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable, mainly if run on a failing hard drive.

9. Do Not Bump, Drop Or Knock The Drive.

  • There was a time when hard drives used bearings prone to seizing. In some cases, a bump solved the bearing problem, but you still ended up with platter damage due to the heads making contact with the platters. Modern drives do not use bearings; the only end result will be platter damage and/or platter alignment issues, leaving the drive unrecoverable or partially recoverable at best.

10. Do Not Put The Drive In A Fridge.

  • This urban legend may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or lousy solder connections by lowering the temperature, causing the joints to contract to make contact again. This may have worked briefly until the device heated up, causing the “dry joints” to expand, breaking the connection again.
  • Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint”, you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
  • The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit, leading to damaged components. In most cases, the drive will be unrecoverable if one of those components happens to be the firmware chip.

Losing data is possibly one of the most traumatic events you can encounter. Give your or your customer's data the best possible chance of being recovered by not making rash decisions. You may only have one chance at recovering the data from a failed or failing drive.
Need Help In Recovering Your Data - Contact Us Now!

 

Updated - Originally published 18 January 2016

What is JTAG?

JTAG is an abbreviation for Joint Test Action Group technology.
The technology was developed in the 1980s to overcome physical access issues to the pins on programmable chips for circuit testing purposes. Today, it is however predominantly used for programming, debugging and in our case, extracting data from faulty devices.

See the illustration below for a simplified explanation of the process:

JTAG Technical illustration web

For more information see also:
https://www.xjtag.com/about-jtag/what-is-jtag

Are You At Risk Of a Ransomware Attack?

 

What is Ransomware?

Ransomware is the universal name for any harmful program that takes your data captive and then demands a ransom "at gunpoint".

CTB Locker is currently the most prolific of these programs. Its modus operandi is to encrypt your documents and then demand that you pay a ransom to obtain the key from the attacker, which will decrypt your files and allow you to gain access again.

Should I Pay To Have My Data Unlocked?

Paying the attacker does not guarantee that you will receive the key. In some cases, victims have had to pay the ransom three or four times over before receiving a key. Other victims receive no reply from the attacker after paying the ransom.

How do I get infected?

Infections typically happen via an unwanted email with an attachment claiming to come from a trusted source. 

By clicking on the attachment (PDF, ZIP, etc.), you allow CTB Locker to run the encryption function. You will typically only realize this when it is too late, as the encryption process runs in the background.

How can I protect myself?

- Back up your data regularly – this is the most effective and reliable form of data protection. A backup is defined as having (at least) two current and verified copies of your data stored in separate locations away from your computer.

- Do not click on any attachment from a source you are not 100% sure of - most of these emails (on the surface) appear to be from a legitimate source.

- Update your operating system, applications and anti-virus software daily.

Am I protected from Ransomware using an Anti-Virus program?

No, most anti-virus programs will not prevent the attack and will only detect the virus after it has encrypted your files.

Can data be recovered after being encrypted with the CTB Locker?

There is currently no known method to repair, recover or decrypt the files. Once the files are encrypted, they cannot be decrypted without the decryption key. 

CTB Locker uses an extremely high-level 2048-bit varying algorithm to encrypt files, which cannot be decrypted using a fixed pattern or algorithm. Sometimes, previously deleted and temporary data fragments can be recovered using low-level data recovery methods. The success rate is normally very low as the files are recovered outside of the normal data storage and naming structure without any filenames and are simply numbered in sequence.

However, we have developed techniques and procedures, combined with the right tools, to recover data lost in a ransomware attack. 

Contact us now for a free consultation, evaluation and preliminary quotation.

Is The 2YK Bug Back?

Y2K Version 20.15 0708

Was it the Y2K bug version 20.15-0708 that caused the New York Stock Exchange to be down for almost four hours, grounded flights at United Airlines for nearly two hours and brought the homepage down of the Wall Street Journal on 07 July 2015?

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services-Jun-2016

JTAG Technical illustration web
June 2016
New data recovery and forensic capabilities added to our mobile device data recovery service - Now supporting 19,776 mobile devices and 1,729 mobile applications, these include:

  • Physical extraction while bypassing user lock for twenty-two Samsung Galaxy devices including the Samsung Galaxy S6, S6 Edge and Note 5.
  • A new and unique extraction method that allows physical extraction for more than hundred and forty LG models, with twenty-two new devices that were not previously supported including the LG MS330 and VS880.
  • A unique capability to disable the user lock for hundred and thirty-seven Samsung devices.
  • Physical extraction while bypassing user lock and decoding for nineteen Huawei devices.
  • Disable user lock support for seventeen LG Android devices, including the LG G5.
  • Physical extraction while bypassing user lock and decoding for three Nokia 105 devices, including RM-1133, RM-1134, and RM-1135. 
  • An enhanced lock-bypassing physical extraction method supporting twenty-eight Samsung devices (MSM8916), overcoming previous firmware limitations.
  • New applications for iOS and Android devices - Don’t Touch This (iOS), HereMaps (Android), HideSMS (Android), Hot or Not, Kakao Story, Mappy (Android), Meet24, MeetMe, Nike+ Running, Scruff (Android), SpringPad FlipNote (iOS) and TextMe and 183 updated application versions.

Summary of our mobile device data recovery capabilities:

  • Logical data recovery: 8,539 mobile devices
  • Physical data recovery: 4,444 mobile devices
  • File system data recovery: 4,462 mobile devices
  • Extract/disable user lock: 2,331 mobile devices
  • Total number of devices now supported = 19,776

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services-Aug-2016

August 2016
New data recovery and forensic capabilities added to our mobile device data recovery service - Now supporting 20,165 mobile devices and 2,255 mobile applications, these include:

  • * Partial file system recovery from 105 locked and unlocked Samsung Android devices.
  • Advanced logical and file system recovery from Apple iOS 10.x devices
  • Eight new iOS and Android device applications.
  • Call log decoding for iOS and Android snap chat applications.
  • Five hundred and twenty-seven applications capabilities updated.  

Summary of our mobile device data recovery capabilities:

  • Logical data recovery: 8,663 mobile devices
  • Physical data recovery: 4,528 mobile devices
  • File system data recovery: 4,571 mobile devices
  • Extract/disable user lock: 2,403 mobile devices
  • Total number of devices now supported = 20,165

No Honour Among Hackers

No Honour Among Hackers

A group of hackers known as "The Shadow Brokers" claim to have stolen hacking tools (exploits) from another group of hackers called the "Equation Group" who are believed to have ties to the US National Security Agency (NSA).

The stolen data are now on auction to the highest bidder advertised via posts on a number of websites including Twitter, GitHub, Tumblr, Reddit, and Imgur.

A sample of the stolen tools and exploits have been released pending the outcome of the auction where the winner will apparently gain full access to the data.

The hacking tools could potentially include exploits for gaining root level access to networks, routers, and hard disk drives.

For a more technical explanation

Can Zepto ransomware encrypted data be recovered or repaired?

Can Zepto ransomware encrypted data be recovered or repaired?

The Zepto Ransomware, a variant of the Locky Ransomware, has been causing all sorts of havoc. The question is, “Can Zepto ransomware encrypted data be recovered or repaired?”

The short answer used to be no, as no known method (or technology) exists to decrypt, repair, or recover files encrypted by Zepto Ransomware without access to the decryption key.

Zepto employs an incredibly sophisticated 2048-bit encryption and a dynamic algorithm to encrypt the files, rendering decryption using a fixed pattern or algorithm impossible.

Before it encrypts the data, it also destroys any possible back doors, including shadow copy backups of the files, making recovery impossible. It also works through an encrypted connection and does not store a copy of the key on the local machine.

Earlier versions of the virus stored a copy that was deleted afterwards, making it possible to recover the key in some cases. The algorithm was also far less complicated, and shadow copies of the files could also be recovered in many cases.

These guys obviously read the online solutions. They have now improved the malware and closed all backdoors, making it impossible to recover and/or decrypt the affected data.

There are, however, situations where we can be successful in recovering data affected by Zepto Ransomware.

Contact us now for a free consultation, evaluation and preliminary quotation.

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services-Sep-2016

September 2016
New data recovery and forensic capabilities added to our mobile device data recovery service - Now supporting 20,489 devices and 2,256 applications, these include:

  • * Physical extraction and decoding of rooted and unencrypted Samsung Galaxy S7 and Note 7 devices.
  • iPhone 7 devices can now be recovered using advanced logical, logical and file system data extraction.
  • File system, advanced logical and logical extractions and decoding from apple devices running iOS 10.
  • * Extraction and decoding of encrypted and unencrypted iOS 10 backups.

Summary of our mobile device data recovery capabilities:

  • Logical data recovery: 8,785 mobile devices
  • Physical data recovery: 4,584 mobile devices
  • File system data recovery: 4,699 mobile devices
  • Extract/disable user lock: 2,421 mobile devices
  • Total number of devices now supported = 20,489

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services-Jan-2017

January 2017
Now supporting 20,850 mobile devices and 2,850 mobile applications, including:

  • * Physical extraction for 17 MTK (Mediatek) Android devices.
  • * Physical extraction and decoding from and additional 26 Motorola Android devices.
  • * Physical extraction while bypassing user lock for 18 additional Huawei devices.
  • * Logical extraction and decoding for the new Google Pixel Android devices.
  • * The ability to convert BSSID values (wireless networks) and cell towers into physical locations (longitude and latitude GPS coordinates) within a specific timeframe.
  • * Mobile data recovery from 26 new iOS and Android applications.

Summary of our mobile device data recovery and forensic capabilities:

Tecleo Data Recovery and Digital Forensics Lab - Updated mobile device data recovery & forensic capabilities

New Capabilities Added To Our Mobile Device Data Recovery And Forensic Services-May-2017

May 2017

Now supporting data recovery from 22,179 mobile devices and 4,046 applications, including:

  • * Bypassing the user lock on 135 LG devices including LG F700L G5, H872 G6 and US996 V20.
  • * Advanced physical data recovery on 214 devices.

Mobile Device Data Recovery May 2017

Apple Has Taken Further Steps At Closing Security Vulnerabilities In iOS 8 Devices.

What does this hold for the future of iOS device data recovery?

Apple Has Taken Further Steps At Closing Security Vulnerabilities In iOS 8 Devices.

Apple announced that they are closing a serious security vulnerability in iOS8 devices. All data will now be encrypted and not just some of the data. Apple also had the ability to bypass the security for the rest of the data as was the case with Oscar Pistorius’ locked iPhone. The conundrum was that having a “backdoor” not only allowed lawful but also unlawful access.

No one will after the update be able access your data without your passcode according Apple.

What effect this will have on the recoverability of iPhone data in the future where the passcode (decryption data) is lost or missing is an open question for now?