File and Image Copy Comparison

image copy

Typical terminal output when imaging a drive using Linux Application dc3d

Used for many functions, including data recovery and digital forensics, image copies and files copies each have their own specific purposes. In some cases, using the wrong type of copy can have consequences from wasting some extra time to corrupting digital evidence. Let’s compare the differences between an image copy and a file copy and give some examples of when each is best used.

Explaining an Image Copy and its Uses in Data Recovery and Digital Forensics

An image copy is the precise clone of a drive, sector-by-sector, all the ones and zeroes included. When a drive is backed up this way, the absolute exact state of the drive at that time is saved for future reference. When a file is stored on a drive, it doesn’t always overwrite every byte of the file previously stored in the same spot, and extra data from the old file may still exist on the drive. An image copy will preserve this extra data whereas a file copy will ignore it.

For digital forensics, extra data existing on a drive can be a treasure-trove of clues and evidence. Forensic analysts must create image copies of suspect drives to enable a complete analysis. Any tests on the data should be done on the image copy instead of the original drive, keeping it safe from unintentional contamination. Examining a piece of evidence before imaging it, is something to be avoided. An image copy may also need to be given to a legal opponent to examine the drive on their own, in its entirety. By handing over an image copy, the opponent can’t possibly harm the original source drive in evidence.

Continue reading “File and Image Copy Comparison”

Data Recovery from a Water Damaged Phone

water-damaged-phoneHave you ever forgotten your phone in the balcony on a rainy day? Left it in the pocket of the jeans you have just washed? Accidentally dropped it while relaxing in the Jacuzzi/tub/pool? Or simply had a drink spilled on it? Whatever the circumstances were, chances are your water damaged phone quit working and you were extremely upset. If you just backed up your data the night before, you may not be too affected by this, but if you didn’t have a proper iTunes, iCloud, Google Drive, DropBox, or any other type of backup in place, you may find it difficult to accept the idea of all your contacts, texts, and latest photos be gone forever.

Corrosion Buildup

What damages the phone is not so much the liquid as it is the corrosion that quickly builds up. The main phone components that normally take the most damage in this situation are the battery, screen, charging port, and motherboard. The first thing to do is power off the water damaged phone and pop the battery out if possible. If you know how to disassemble the other components, you should by all means do so and quickly wipe them with a soft cloth. While using a blow dryer is not recommended, leaving the water damaged phone in a bag of rice overnight or longer will help soak up some of the liquid. It will not stop the water residues and minerals from forming corrosion, but it may help slow down the process.

As tempting as it may be, turning on the phone should only be done once the phone’s components are thoroughly dried out and properly cleaned. Otherwise, the motherboard and various connectors will sustain heavy electrical damage, adding more problems to the already challenging phone failure.

Professional Data Recovery Procedures

A water damaged phone is not easily fixed! So how can you get your non backed-up data back? A professional data recovery company that specializes in phone recovery can often save the day. One way to recover the data is through ‘chip-off recovery’, which essentially refers to the extraction of data by connecting directly to the memory chip, where your critical data is stored. However, this recovery method is limited to phones that don’t have their memory chips encrypted, as the case with all Samsung Galaxy devices up to S5, LG G2/G3, and others. But what if your iPhone 6 (and up) or Galaxy Edge are water damaged?

In this case, “reviving” the phone enough to have it recognized by professional recovery tools is the only way to go. The process begins with a full disassembly of the various phone components followed by an initial board-level inspection and deep cleaning procedures using special solutions. Once the corrosion is successfully removed, a micro-soldering repair of the faulty components begins. A deep knowledge of what each component is responsible for and how they all work together is essential for the success of the recovery procedure as, otherwise, irreversible damage can be EASILY caused, resulting in a possible permanent data loss.

It is not always possible to visually see the damage (even with the use of a microscope), which is when the use of highly technical schematics and advanced diagnostic software are required. Once the phone is responsive, it is not uncommon to encounter logical issues with the data, which call for additional recovery procedures to be preformed before any usable data can be successfully recovered.


If your phone ever gets water damaged, it is important that you immediately turn it off, remove the battery, and take as many of its components apart as possible. Wiping and drying them well will help control the damage although it is unlikely to fix the problem as some corrosion will inevitably build up inside the phone components. If the data on the water damaged phone is critical and not backed up, it is recommended to seek the help of professionals with extensive water damaged phone data recovery experience.

The Complexity of RAID Data Recovery

raid-data-recoveryAs a RAID user, RAID data recovery is a service you wouldn’t ever expect to worry about. Considering the investment, you may think that RAIDs are bullet proof storage media devices that you can completely rely on. Should the disk array unexpectedly fail, it is important that you understand the complexity of a RAID data recovery service before attempting any quick DIY fixes.

RAID (Redundant Array of Inexpensive/Independent Disks) is a data storage technology that syndicates multiple hard drives into a sophisticated single logical system for the purposes of data redundancy and/or performance enhancement. There are various RAID levels (RAID 0, RAID 1, RAID 5, RAID 10, RAID 6, etc.), and each comes with its own capacity-redundancy-speed ratios, as well as data recovery challenges.

Don’t Confuse RAID with a Backup System

Many end users and even companies often confuse RAID with a backup system, but it is important to differentiate between the two. RAID arrays can be used as backup systems, but only if there is another copy of the same data saved elsewhere. The confusion arises from the redundancy feature of a RAID, but as any digital storage device, RAIDs can and do often fail as well. It can be the result of a failed controller, one or multiple hard drive failure, or even a logical corruption, so make sure you always keep a proper backup system in place.

The Process of RAID Data Recovery

Due to the complex and customizable nature of RAID systems, RAID data recovery requires a highly technical expertise and a deep understanding of the logic behind the way that the data is laid out across the drives. If a RAID fails as a result of a multiple hard drive failure, the first step to recovering the data requires gaining access to the failed drives (some or all), preferably the last one(s) that failed, which would usually contain the most recent data. Rebuilding the unit is then needed before any data extraction can take place. Sometimes this stage takes a few attempts until the right configuration is found. Some RAID systems are more complex than others, which require a more careful approach.

When it comes to RAID data recovery, it is important to emphasize the importance of creating sector by sector image copies of ALL the drives involved prior to rebuilding the disk array as you never want to risk the possibility of getting anything written to or deleted from the RAID, which may result in an irreversible damage to the data. Therefore, it is recommended that a hardware write-protect tool is used during the imaging step to ensure that the original RAID drives are not altered in any way.

Unique RAID Systems

These days, we see a lot more proprietary RAID systems, such as Drobo BeyondRAID, QNAP, Synology NAS, and many others. The closed nature of these RAID systems adds another layer of complexity to the already difficult RAID data recovery service. This is because many of them use non-standard RAID configurations and/or combination of RAID types within a single system. In many cases, these unique RAID systems require advance reverse engineering to understand how the data is distributed across the hard drives.


In conclusion, RAID data recovery is normally a lot more complex than a single hard drive recovery and should be always handled by professionals. If you ever encounter a RAID data loss, it is highly recommended that you stop using the system immediately and refrain from any troubleshooting to avoid the possibility of further damage to the disk array. We often see clients that seek professional RAID data recovery service after some failed initial rebuilding attempts have been already made. This makes recovery a lot more complex, sometimes partial, or completely impossible, even when performed by the most skilled and experienced RAID data recovery specialists.

Why Does a Hard Drive Contain Less Storage Space Than Claimed?

It can be really frustrating to find out that a hard drive you have just purchased doesn’t actually contain the claimed storage space but rather a lot less. You would think that a 1TB drive should provide you with a 1TB of actual storage space. While this is a correct assumption, the claimed storage capacities are not technically incorrect.

hard-driveHard Drive Storage Capacity Calculations

The reason for this discrepancy lies in the way manufacturers and computers calculate storage capacity. Hard drive manufacturers calculate it using the decimal system (base 10), therefore, for them, 1 Megabyte is equal 1000 Kilobytes, 1 Gigabyte is equal 1000 Megabytes, and 1 Terabyte is the same as 1000 Gigabytes. However, computers and RAM manufactures use the binary numeral system (base 2) to calculate storage space, which means computer memories are counted by groups of 1024 so for them, a 1 MB is really 1024 kilobytes, a 1GB is 1024MB, and a 1 TB is 1024GB. Since the end users are mostly familiar with the decimal system, drive manufacturers use it to their advantage when marketing their storage media.

Hard Drive Formatting

An additional layer of storage reduction kicks in when you format your new hard drive. Once you do, the drive’s usable storage space is further reduced, although not by a lot. The actual amount by which the space is reduced depends on the file system (NTFS, FAT32, HFS, XFS, etc.) you format it to. Since a drive can be formatted into various file systems, it is unreasonable to expect hard drive manufacturers to advertise the actual storage capacity after the hard drive is formatted.

Will the Recovered Data Fit on the Destination Hard Drive?

As a data recovery company we witness the confusion that this capacity discrepancy causes on a daily basis. At the end of each successful recovery our clients get to choose if they provide us with a healthy destination hard drive to transfer the recovered data onto or purchase one from us. Oftentimes confusion occurs when we tell them that their spare drive they have provided us with does not actually have enough free space to transfer the recovered data.  For instance, if we recover 2TB of data, a new 2TB hard drive will not fit the entire recovered data, as in fact this hard drive only contains around 1.86TB of usable space.

To help you further understand this, the table below shows a few examples of the discrepancies between the claimed and actually usable hard drive storage spaces:

Claimed Space  Actual Space Difference
32GB 29.8GB 2.2GB
100GB 93.13GB 6.87GB
250GB 232.83GB 17.17GB
500GB 465.66GB 34.34GB
1TB 931.32GB 92.68GB
2TB 1862.64GB 185.36GB


Always expect your new hard drive to contain less usable storage space than advertised, especially once the drive is formatted. Even though there is a discrepancy between the advertised and actual storage space, which may at first be portrayed as misleading information, drive manufactures are not technically wrong in their claims. They simply use the decimal system to measure hard drive storage space versus the binary one. To avoid running out of space, next time you shop for a new drive, always get a bigger capacity hard drive than what you actually need to store or back up your data.


The Uniqueness of Drobo and Why It is Considered “Beyond Recovery” by Many Data Recovery Professionals?

Unlike a traditional RAID, where the drive capacities must normally match and its configuration is set up manually, a Drobo ‘Beyond RAID’ system is extremely unique and user friendly, as it can be configured using drives without matching capacities or order, as well as having the option to expand the RAID by adding more drives if required. From a data loss and reliability point of view, you can switch from single to dual disk redundancy which will allow for two drives to fail while the Drobo remains operational and your data uncompromised. A Drobo does this by allocating space across all hard drives in the array, so in the event of a two drive failure, the Drobo will automatically shift the data to the remaining working drives, essentially rebuilding the array, without any user intervention. It will then complete the process when the failed hard drives are replaced with new ones. The drawback from this is that there is less usable space.

What Makes Drobo Data Recovery So Challenging?

Even though the advantages of using a Drobo RAID system are evident, recovering data from a failed Drobo system is extremely challenging for numerous reasons. Firstly, it is designed to only run on the Drobo box, so in the event that the controller or firmware becomes faulty, then the data will become inaccessible. Secondly, unless the Dual Drive Redundancy option is activated in the Drobo dashboard, Drobos typically cannot handle more than one drive failure. Lastly, Drobo’s Beyond RAID configuration is so completely unique and proprietary that it is like dealing with an entirely dissimilar file system, which adds an additional layer of complexity to the recovery process.

One-of-a-Kind Drobo Recovery Tool

By diligently researching and studying various Drobo systems inside out, we were able to develop a brilliant program that essentially virtualizes the Drobo box allowing us to create an exact sector by sector image copy of the RAID. This gives us more flexibility (in terms of using any other data recovery or computer forensics tools) to rebuild the array, as well as extracting and analyzing the data.

Protecting Your Drobo Data

Even though the frustrating days of considering Drobo ‘Beyond RAID’ ‘Beyond Recovery’ are somewhat gone, you should still take on some preventative methods to make sure your data is protected to the maximum degree. Always read the manual and familiarize yourself with the system’s various features to ensure that you set it up for your needs prior to initializing or configuring it. You then need to do some regular “maintenance” and ensure that you promptly replace any drive that the Drobo gives a warning for and that you always use high quality drives in the system (suggested for any RAID). The main thing to remember is that Drobo, like any other RAID system, is not a backup by itself! Having the same data saved in at least two different locations IS, therefore, always recommended.

Is There a Foolproof Backup Solution or Strategy to Avoid a Data Loss?

Backup SolutionThis is the #1 question posed to us following the majority of our data recoveries. When you are suddenly without your “can’t lose” data, it is something you never want to experience again. The main problem is that most of us do not make backups reliably, if ever. As important as it is, backing up our data tends to fall to the bottom of our “to-do-lists”. Our intentions are good and we know it is important, but we tend to procrastinate. Every day, so many clients admit to having already purchased their backup systems, but just never found the time to get around to it.

Unfortunately, all hard drives will die; it’s just a matter of time. There is no magic solution to preventing data loss, but that does not mean it is hopeless.

Decide what you need to back up.

Start with your answer to, “what CAN’T I afford to lose”? For most people it is by far their family photos, but databases, tax returns, school projects, and music collection are normally important too.

Once this has been determined, your next step is to decide WHERE. We all have varying amounts and types of data, budgets, and needs.

There are numerous options available to you to minimize the possibility of a serious data loss. An external drive, USB stick, RAID, NAS, online services (i.e. Windows Live, Google Plus etc.) are all at your disposal.

With a physical device (external drive, USB flash drive, RAID, etc.) you are simply creating a second copy. Contrary to popular belief, if it is your only copy, an external drive on its own is not equivalent to a backup system. Remember, these are physical devices, so be aware of any slowness in performance, strange noises, SMART error, etc. It should also be noted that regular hard drive maintenance is not be neglected (i.e. clean fan, temperature controlled etc.) to optimize its performance, reliability, and lifespan. If using flash drives, make sure to always safely eject them.  For those who would like to be extra cautious, a secondary physical storage location is most effective in case of fire, flood, or theft.

With online storage (Windows Live, Google Plus, Drop Box, etc.), you are uploading and saving your data to an off-site storage system maintained by a third party. Access to your data is made through their remote server. Unlike storage devices, there is nothing to carry with you. Once you upload your data, an internet connection is all that is required. Options such as Windows Live and Google Plus are free of charge although, generally, the amount you can store is significantly less than that of paid cloud services. In either case, the data is not physically in your possession, so you should always explore the company’s confidentiality, privacy, and security terms before making your decision on which one to use or spend your money on.

Irreplaceable data comes in many forms. Everyone has some data they just cannot lose. We are in an era when essentially everything is documented digitally, so taking precaution to avoid or minimize the possibility of losing your data is vital. Now, our backup options are plentiful. It is just a matter of establishing your needs, budget, and comfort level with having a third party store your most important data. Happy backing up!


Image courtesy of Stuart Miles at


Understanding Data Recovery Pricing

Making your first call to a data recovery company can seem overwhelming as pricing can be different than you had expected. The reason being that it’s a niche service that is extremely specialized. As with any service, who to hire for your data recovery need is a consumer decision, so shop wisely! When trying to understand data recovery pricing you have to take a few things into account.

Data Recovery PricingRecovery Complexity Should Matter

Companies that offer flat rate recoveries without physically examining your failed media probably aren’t being candid about the limited recovery work they are willing to do for the low advertised price, or about the final cost of the recovery. For example, have you ever gotten into a car accident and called your mechanic and at the end of your call you received a flat rate? Us either. It doesn’t happen with cars and it shouldn’t happen with your hard drive.

Be Wary of Hidden Costs

Be aware of hidden fees for “lab work”, “parts”, “high capacity hard dives”, “Mac/Unix”, etc. These will all dramatically increase the final cost of your recovery. In these situations, a minimal amount of work will be performed for the quoted price, unless the failure is extremely simple. When you consider the frequent need for expensive parts and the required hands-on time for the recovery, you can see that truly successful data recovery is generally not possible for the very low prices that are being advertised.

Quantity vs. Quality

Many companies operate by bringing in as many recovery cases as possible, advertising a ridiculously low starting price ($99-$350), or offer a flat-rate for all (regardless of the type of recovery work needed), which will never apply to your specific situation. They will inevitably only recover the simplest cases while declaring the more complicated ones unrecoverable. Sadly, many of these so-called “unrecoverable” cases are actually quite recoverable, provided the company has the tools, expertise, and dedication to successfully recover each and every failed media they receive. With many of these low-cost companies, the quantity of cases trumps the quality of their recoveries. The first attempt at recovery always has the best chance for success, so this service model spells disaster for many data recovery clients.

Result Driven Company

In addition to the above, using performance-based methods for acquiring services should always be encouraged as it ensures the service provider is highly motivated to deliver. These service providers will always go the extra mile to ensure that the recovery results are as good as they can get as, otherwise, they will see no rewards for their efforts. Always look for data recovery companies that are transparent about their No Data No Charge policy and be cautious if companies ask for upfront fees or for your credit card information prior to delivering results.


When shopping around for a data recovery service, look beyond sticker prices and walk away from unrealistically low prices or upfront fees. Be cautious of hidden charges or a complete flat rate pricing model. Always ask questions to make sure you completely understand the company’s recovery procedures and pricing policy to avoid any potential costly surprises. Looking for a results based company is always advisable, and ensuring that the company you are considering is reputable is obviously always important. It is the combination of all these key points that should guide you in choosing a company that deserves to earn your business as after all, the first recovery attempts always have the highest chance for success.

Protecting Your Computer Against Power Surges to Avoid Data Loss

Avoid data lossPower surges (or electrical spikes) happen when an increased voltage flows through your electrical lines. They most commonly occur during blackouts or lightning storms, and can hit in more than one interval. In North America, the standard voltage is 120V, so any increase of voltage above this, even for a limited time, can cause serious damage to your computer electronic equipment (i.e. hard drives, RAIDs, Drobo, flash based media, etc.), which may potentially result in permanent data loss.

Whereas mild electrical failures only cause problems to the PCB (Printed Circuit Board), severe electrical failure can easily go beyond the PCB and damage the hard drive’s read/write heads. When this happens, recovery is much more complex, requiring the replacement of the failed Head Disk Assembly with a working one.

Equip Your Computer with a Good Surge Protector and/or a UPS

With the winter season embarking on us, it is crucial to prepare for Mother Nature’s worst. To protect your hard drive data, a surge protector provides simple and effective protection. Although they vary in price and function, even the most basic power surge protector can protect against some voltage spikes—though naturally, the better the quality of the power surge the more reliable protection your computer will get. However, to protect against powerful power surge situations (such as lightening or electrical storms) we strongly advise that you disconnect all sensitive electronic devices, as the average surge protector is likely too weak to protect them. Computers are especially vulnerable to electrical spikes, and any device connected to your computer (i.e. external hard drive) will likely be affected as well.

A UPS (Uninterruptible Power Supply) is another extremely useful device to protect your computer in times when extra or no voltage flows through your electrical system. In addition to acting as a power surge protector, a UPS has the added benefit of a built-in battery, which allows your computer to continue running, so you can safely save your data before shutting down your computer properly. Some high-end UPS units can even safely shut down your computer automatically. Whatever your need or budget, there is a power surge protection solution out there for you.

If you choose not to add power surge protection to your computer, your best defense against potential data loss is a consistent and ongoing backup system.

Image courtesy of Evgeni Dinev’s images at

Clicking Hard Drive

Clicking Hard Drive - BlogClick…click…click…the sound of a clicking hard drive is something a computer user hopes to never hear. If you hear the infamous “click of death” coming from your drive, you are essentially hearing the read/write head as it fails to track the disk surface correctly, returning to its home position and trying track the surface again. This common-yet-serious problem can be repaired by replacing the Head Disk Assembly with a working one.

However, it is important to note that a clicking hard drive is not always the result of a failed read/write head—it can also be caused by a failed PCB (Printed Circuit Board), or on occasion, bad sectors. In other words, the read/write head causes the clicking noise in all “click of death” situations, but it is not always the source of the problem itself. If left untreated, a clicking hard drive may permanently destroy your data as the read/write head eventually comes in direct physical contact with the platters, thus physically destroying your data. This is also known as a Head Crash.

Listen to Your Hard Drive

It is important to continuously monitor your hard drives to make sure you notice any unusual sound, as typically the sooner you identify a drive problem, the lower your chance of jeopardizing your data. This is especially true when handling data servers, RAID and Drobo systems, as they are often placed in a server room, where those unusual clicking sound may go unnoticed. Because these sophisticated units are designed to continue to work even with a failed drive (or drives), you may not be aware of the hard drive failure when it first occurs. It is then only a matter of time until the next drive fails and puts your data at risk.

Leave a Clicking Hard Drive to the Professionals

If the clicking sound originates in the read/write heads, the drive must only be opened and worked on within a class 100 clean room environment, by a highly trained data recovery specialist. NEVER open the drive yourself, even just to take a peek or curiously check out where the sounds are coming from. Doing so will likely cause irreversible damage to the sensitive components within the drive (i.e. platter dust contamination, platter misalignment, etc.). It is a shame to potentially lose precious data that could be fully recovered if handled by specialists. Leaving the work to the professionals will result in the highest chance of a successful recovery.

Preventative Care to Avoid Data Loss

Preventing Data LossEvery hard drive will eventually fail – that’s a fact. But that doesn’t mean you have to lose your data! As the saying goes, the best defense is a good offense. Don’t let your computer maintenance get out of hand. If you take good care of your computer and hard drive now, your chances of avoiding catastrophic data loss are greatly increased.

Some good regular steps that Mac, PC, and Linux users can take to keep their computers in top condition include:

  • Use antivirus software (yes, even if you have a Mac!) – By running comprehensive scans on a regular and ongoing basis, you will keep your computer free of malware and other harmful viruses that can cause your system to crash, data to become corrupted or deleted, put your identity at risk, and more. Keep your system free of viruses.
  • Schedule regular defragmentation (or defrag) of your hard drive – During normal use, files are stored on your drive in segmented pieces, which means your computer has to search for the files in order to use them. This slows down your computer performance, and can increase the amount of wear and tear. By defragmenting your drive, your files are moved next to each other making the read and search time much faster.
  • Establish a regular backup schedule for your data – There are countless computer programs and hardware that can help you do this effortlessly, so you are assured your data is always there when you need it.
  • Backup up your data with cloud storage offsite – This is a service where your data is maintained, managed and backed up remotely and made available to users over the Internet. There are many companies that offer this service.

These tips should help your computer and data stay in top shape for as long as you need it. However, if your computer or laptop is making any sort of clicking, grinding, or beeping noises, or giving you error messages, immediately turn off the computer and call a professional data recovery company. Any further use of the drive (even to attempt a backup or virus scan) can permanently damage your drive and make your data impossible to recover.

Image courtesy of David Castillo Dominici at