FileSlinger™ Backup Reminder 05-26-06: Disappearing Partitions, Part II

This week (as I prepare to dash out to a 7:30 AM meeting) we return to the saga of my brother’s attempt to recover data from his failing external drive. Last week, you may recall, the recovery program (which I mistakenly identified as Final Recovery) had been running for 48 hours and was 1/3 finished. Now that a week has passed, I asked my brother what kind of progress he’d made. Here is his answer:

I ended up running the Recover my Files program. When I first installed and tried to run these two programs, it seemed that the system would freeze and/or not recognize the corrupt drive. After awhile of that mess, I decided to quick format the drive, hoping that it would be recognized and trusting that the programs would be able to recover files anyway.

That did seem to help, but Final Recovery still appeared to hang. Perhaps I didn't let it run long enough to register that it was working.

Recover my Files has a status bar that showed activity right away, so I let that one run.
After 5 or six days, it showed that if had located 14,000+ files and was 80% finished searching the drive. Because it hadn't picked up any new files for a day, I stopped the search before it was complete. After another day, it had restored a few thousand files at least. But I haven't had time to really go through what it saved. I can tell that there is a lot missing and that there are a lost of recovered files that seem to be corrupt. So it looks like I will lose a fair amount of data (mostly image files).

Before this happened, I had been accumulating all of my images onto this disk to facilitate an eventual backup to DVD (looks like I was dilatory). This means that many of the files had been copied from other drives, and it looks like I will be able to recover a large number of files that had been deleted on those drives too. All in all, I might be able to save 50% or more. Some of the lost files are on CD or online storage, perhaps another 10-15%. The biggest loss is of raw (.crw .cr2) image files; .tif and .jpg files seemed to have been recovered with better success. But I'd toss all of those to save the raw files.

RAW files, for those who aren’t familiar with them, are uncompressed image files, the native format of my brother’s very fancy digital camera. A lot of the photos are doubtless of his children (who are adorable, if I do say so myself).

The moral of this story, as of all the stories I tell in this newsletter, is back up sooner rather than later. It’s also important to remember the difference between storage and backup. If you’re an avid photographer like my brother and don’t have room on your main drive to keep all those photos, putting them onto an external drive is a logical move. But just because the photos aren’t stored on your internal drive doesn’t mean they’re backed up. You still have to make a second copy of them, and it’s a good idea to make that backup copy to a different medium. If you’re using DVDs as your main storage method, back the files up onto an external drive, and vice versa.

All of this reminds me that I should make more DVDs, myself, even though I now have many of my files stored on two or even three different hard drives. DVDs can get scratched or suffer from rot; hard drives, as we know, can fail in countless horrifying ways. By using more than one kind of backup, you’re insulating yourself against more possible problems.

Next week I’ll talk about why people don’t back up—even if they’ve suffered catastrophic data loss in the past.

FileSlinger™ Backup Reminder 05-19-06: Disappearing Partitions

Tuesday morning I got a message from my not-so-little brother in Cleveland:

OK computer expert, I've got a question for you. I have an external HD that had two partitions. I just noticed that one partition - the larger one and lower logical drive letter, will not read. When I click on it in My Computer, it hums for awhile and then says that the drive is not formatted, do I wish to format it. Not really, because I would like to recover the files on it if possible. The other partition seems to work fine. I have no idea how the partition might have been wiped or whatever. I recently ran defrag on it, but other than that, it was working fine. Any ideas?

Well, no, actually. This was one I hadn’t run across before. I haven’t had a lot of experience with partitioning drives, because most of my hard drives have been small enough not to need partitioning, and I now have two separate physical drives on my main computer, though one of them has a small partition for DVD QuickPlay in addition to holding the C:\ drive.

So I passed my brother’s message on to the Ur-Guru to see what he had to say about it, which was this:

I'd say before trying any recovery tools... first make an image backup of the entire xHD to some place, just in case the recovery screws up (which sometimes it does and makes it worse).

A "not formatted" usually indicates that the partition got damaged but it says nothing about the data. On the other hand it could be an actual surface failure.

Check in the event log and see if any disk failure type entries are in there and what details they might reveal.

Go to computer management (admin tools) and select the disk management from the tree, check what it says there. Often it could be that the system remembers the partition and drive letter but it needs to be imported. Red warning icons or error icons might appear on the disk management bars where it shows the partitions and disks. That might also reveal what's going on with the xHD partition. Status in the listview should say "Healthy" if everything is fine.

My first guess would be it's an actual drive failure that has affected just the one partition. If the entire xHD was a single partition it might affect the whole thing which at least would make it look more like a total failure.

Before sending that on to my brother, I added a note about where to find the Administrative Tools (in the Control Panel; though they may also be on your “All Programs” list) and where to look in the Computer Management tool for the disks (under Disk Management, which is at least logical, unlike, say, using the Start button to shut down).

I also included a warning. Physical damage to a hard drive is very bad news. System failures may put your data out of reach temporarily, but damage to a drive—which is what data recovery geeks mean when they say “crash”—can destroy your data as if it never existed. If your hard drive is making evil noises (clanking, clacking, screeching), your best bet is to shut the machine down and get the drive to a professional data recovery service where they can take it apart in a sterile environment rather like a hospital operating room.

My brother’s response was that he didn’t have Ghost or TrueImage, but did have enough space to copy the disk. Since he was at work by this time and the problem was with his home computer, he wasn’t able to check the Event Viewer immediately. Once he did, however, what he found was definitely not good news:

In the event log, there are a hundred or so errors listed from the last few days that are all the same.

Event Type: Error
Event Source: Disk
Event Category: None
Event ID: 7
Date: 5/15/2006
Time: 8:04:10 PM
User: N/A
Computer: MAIN
Description:
The device, \Device\Harddisk2\D, has a bad block.

That was confirmation of the Ur-Guru’s suspicions. This left my brother with two choices: attempt to use data recovery software, or go to the professionals. Why is this an either-or case? Amateur attempts to recover data can sometimes make things worse. To quote the Ur-Guru, “The serious recovery folks don't want you to even look at a drive before sending it off, actually. And they have a point.”

Either way, it was clear that the drive had reached the end of its usable life, because even if it could be reformatted, it might give out again at any moment. (The argument against disk-based backup is that hard drives, with all their moving parts, are just as vulnerable to failure outside your computer as inside it.)

My brother professed himself willing to ditch the drive as long as he could get the data back, and elected to try using FinalRecovery. I’ve never used that one myself.

As of this morning, the program has been running for 48 hours and is only about 1/3 finished, so we don’t know how much data my brother will get back. At least the disk doesn’t seem to be damaged in such a way that trying to use it makes the problem worse.

Tune in next week for the exciting conclusion to the saga!

---

I'll be speaking about podcasting (and blogging too, a little) on May 24, June 28, July 28, August 9, and at the Podcast Expo on September 29. Details will be posted on my other blog under Author-ized Appearances as soon as I have them.

FileSlinger™ Backup Reminder 05-12-06: Will They Be Bidding on YOUR Data?

This week’s topic isn’t precisely about backups, but it’s of sufficiently mind-boggling importance that I felt compelled to write about it, and it does tie in nicely with last week’s discussion of data theft.

Idaho Power Company sent 230 SCSI hard drives off to Grant Korth salvage to be recycled—without erasing the data first. Eighty-four of these drives, which were packed with confidential company information, appeared for sale on eBay.

Oops.

Simon Garfinkel of Harvard’s Center for Research on Computation and Society has been buying used hard drives on eBay since 2001, just to see what he can see. And what has he seen? Thousands of credit-card numbers, and enough other information to trace the drives to their original owners.

Oops.

Last spring a student bought a hard drive once owned by the police in Brandenburg, Germany, for a mere 20 euros. The information on it should only have been accessible to high-level police and intelligence employees.

Big oops.

Now, the sellers of these drives don’t necessarily know what’s on them. If they did, they’d either use the information themselves or ask a hell of a lot more money for them.

There are people who sell or recycle their computers without making any attempt to erase the data, whether through oversight or ignorance. But what’s more common, according to Garfinkel and others who analyze these drives, is insufficient purging of the drives, even when corporate regulations mandate either complete destruction or degaussing of any drives before they can leave the premises. (Degaussing is a technique involving powerful magnets which essentially causes a hard drive, or other magnetic media, to forget everything it ever knew.)

Reformatting your hard drive before giving your computer away will certainly protect you against casual discovery of your passwords, Quicken files, confidential client records, and so forth. But unless you actually overwrite the erased drive with new data, a skilled hacker can still retrieve and reconstruct far too much information. Installing an operating system and tons of programs does a tolerable job of overwriting, as I learned once to my dismay, but to be absolutely certain you have to do a multiple overwrite with meaningless random patterns of data.

That no longer necessarily falls into the “Kids, don’t try this at home” category. There are several commercial software products designed to do this (see the CNET article below for more details), including iSafeguard Freeware for Windows.

So unless you want your data being sold on eBay, make sure you wipe your drive clean before giving away, selling, or recycling your computer or the external drive you’ve been using for backups.

Of course, if the drive has suffered the kind of crash that means even the data recovery specialists can’t get anything off it, you’re safe.

Source Material:

ComputerWorld: “Idaho Utility Hard Drives—and Data—Turn up on eBay”

TechWeb: “Buyers Scour eBay for Data-Rich Hard Drives”

CNET: “Skeletons on Your Hard Drive”

The Register: “Police Hard Drive Sold on eBay,”

The Ur-Guru's Laptop Alarm

After reading today's Backup Reminder, the Ur-Guru suggested I post a link to the Targus Defcon 1 Ultra Notebook Security System that he uses.

Why is it that I have to post everyone's comments myself? C'mon, folks, it isn't that hard. Really.

FileSlinger™ Backup Reminder 05-05-06: There's Data Protection, and Then There's Data Protection

Last week Faithful Reader Mike Van Horn suggested that since the real purpose of backup, and therefore this newsletter, is protecting data, I should talk about protecting data in other ways, specifically the issue of securing computers against theft.

Unfortunately, I know nothing at all about this subject, apart from the fact that when the Ur-Guru needs to leave his laptop in a hotel room, he puts it in his unbreakable Samsonite suitcase and then uses a cable with a combination lock and alarm to secure said suitcase to a large piece of furniture, like a bed.

I’ve owned and traveled with laptops since 1994 and never had one stolen, possibly because I don’t let them out of my sight (or, usually, grasp) unless locked in the trunk of the car. Mostly, though, I think I’ve been lucky. Actually, I know I’ve been lucky, as on a couple of occasions I’ve managed to leave the house unlocked when I went out, but came home to find all my possessions where I left them.

Iron Mountain hasn’t been so lucky: they just lost more backup tapes. Just because the storage giant acquired LiveVault and its Continuous Data Protection technology doesn’t mean all its data-storage customers have switched from tape-based to disk-based backup. But I’ve talked about the vulnerability of tapes in trucks before (in the March 4, 2005 backup reminder), and nothing much has changed on that front, so I won’t repeat myself here.

Instead I’ll replay my generally-uneducated answer to the theft question and then ask readers for their input.

Mike’s Question:

“I've done a few Google searches on security kits for computers. I'm surprised at the paucity of good solutions. Laptops have cable locks with flimsy connections to the computer that I've been told can easily be broken off. With larger computers, you can encase them in metal, like Robocop, or else super glue a D-ring onto the case, to which you can attach a cable and lock. Why aren't computers designed with a better security connection?”

My Answer:

“I don't know whether people prefer to have insurance, or what. Some people have systems with removable drives, so they can take their data home at night. (Complete computer towers and servers are bulkier to shift than laptops.) Of course, data centers have security guards at the doors and keep the machines in wire cages, with nothing but dumb terminals out in the open.

“The less accessible your machine is for thieves, the less accessible it is for you or your IT repair staff. Most modern tower machines can be opened with a simple latch pull, and unhooking the drive and the various boards is a trivial effort. That makes taking the whole tower away rather beside the point, particularly if it’s your business data they're after and not just salable parts--though they can still realize a substantial profit on anything they rebuild from the components they take from you.

“I think protecting your computers is a bit like protecting your car. A garage that thieves can't get into is going to do you a lot more good than a car alarm.”

One thing I didn’t think of at the time is that there’s a difference between protecting your data and protecting your hardware. Good encryption can protect your data from all but the most skilled hackers even if all your hardware gets hauled off in a truck. (Without off-site backups, though, you may not have any more access to your data than the thieves do.) But encryption, like locks and steel cages, makes working with the data yourself more trouble. This is part of why most of us only encrypt a few files at best. I password-protect my Quicken files and the PDFs of my tax returns, as well as invoices and contracts. I also password-protect sensitive client data, and my own collection of passwords. But anyone stealing my computer or my XHD would still get some pretty comprehensive information about me.

Mike asked what I’d heard from other readers on the subject of protecting computers against theft. Nothing, so far—but I’m hoping that will change. Any of you with experience in this area, please send your recommendations to sallie@fileslinger.com or post them here on the blog (click the little link below that says "comments").

See you next week with more backup news!