Blog Archives

New Macs are making it harder to recover your data

Two trends in newer Macs, thinness and privacy, are conspiring to make it harder than ever to recover your data. Apple has a fashion-magazine-like obsession with thinness and a Libertarian devotion to privacy. These two factors, however, are making Macs that are harder and harder to recover data from. If you have a Mac from 2016 or later, make sure you have a backup because if you don’t, data recovery could be quite expensive.

One of the most common reasons customers come to us is because their Mac won’t turn on or fully boot. They may be ready to buy a new Mac but they want their data. Traditionally, we would remove the drive, put it in a working Mac or dock and we could easily and inexpensively transfer the data to a new Mac. But times are changing, especially if you have one of these models:

12-inch MacBooks (2015 or later)

As part of Apple’s relentless pursuit of thin and light, they released the 12-inch MacBook: the thinnest and lightest Mac laptop ever. Unfortunately to achieve this thinness, they removed the removable drive and soldered it to the main logic board of the computer. This means we can’t just remove the drive and put it in another computer. It’s impossible. So if your MacBook 12-inch doesn’t turn on, it has to be sent to a lab which is quite expensive. It starts at $1,000 can be as high as $3000—and that’s just to get your data back.

2016 and 2017 MacBook Pros

The new laptops came in two flavors: non-TouchBar and TouchBar. The non-TouchBar Macs have removable drives. We can move these to working MacBook Pros and get your data. The TouchBar Macs had soldered on drives similar to the 12-inch MacBook. These could have had the same issue as the MacBook but Apple did something highly unusual. They created a special tool to extract the data, even from dead MacBook Pros. As an Apple Authorized Service Provider, we have access to this tool and have used it with great success to inexpensively transfer data when these MacBook Pros move on to a better place. Of course, the tool doesn’t always work and when that happens, it’s off to the lab for a $1,000+ bill to get back your data.

2018 MacBook Pros, Mac minis, Retina MacBook Airs, and iMac Pros

As part of Apple’s ongoing commitment to your data privacy, Apple introduced the T2 chip which encrypts your data and locks it to the CPU of that Mac. So once again, if your Mac doesn’t turn on, this is a lab recovery.

Our mission at Mike’s Tech Shop is to make you happy with your Mac. The most unhappy customers we see are those faced with data-loss. We always want to help. We will either be able to recover your data in-house or help you get your Mac out to a lab and back with minimal hassle. But the best solution of all is to have a backup. So please, get your backup set up today because a $100 drive could save you $1,000 or more.

 

Posted in Data Recovery

Hard Drives in Distress

I had a customer come in recently with a hard drive that was not working. It had all of his wedding videos on it. Before he came to us, he went to the IT guy in his office and the IT guy had tried to fix the drive. When that failed, he came to us. My heart sank. I knew that although his IT guy was trying to help, he may have permanently destroyed the irreplaceable wedding videos.

The most important thing to know about hard drives in distress is: Do not leave them running, do not try to run software to repair them. Hard drives that are experiencing problems will often make themselves worse and even destroy themselves if left running; about 15% of the time you will permanently destroy the drive so that even labs like DriveSavers cannot recover the data.


Here’s why. Spinning hard disk drives perform a variety of routine maintenance functions whenever they have time. They re-write bad sectors to new good sectors, they write logs, they scan themselves for problems. These are all good things when a drive is functioning normally. These are all dangerous things when a drive is in distress. When a drive begins to fail it can start to lose track of where things are on itself. It can begin to make mistakes. When a drive is in distress and it goes to perform its routine maintenance, it can cause even more damage. It may re-write bad sectors onto good sectors thereby destroying the data that was there and possibly breaking links to other data. The logs can be mistakenly written over good data thereby destroying it.

When you run software tools like DiskWarrior, you can cause the same problems. First of all the drive is running and can do the damage outlined above. Beyond that, when you go to fix the drive, if it is badly damaged enough it might write the fix, like a new directory on top of good data, thereby destroying it.

As it turned out, we were able to save the wedding videos. The drive had not been permanently bricked when the IT guy tried to help. This customer was lucky.

When your data is vital the only safe thing to do is to take your drive to a recovery specialist who will disable the drive’s automatic functions, make an exact bit-by-bit replica of every recoverable sector and then repair and extract the data.

Posted in Data Recovery

“I Have A RAID So My Data Is Backed Up!”

I have had too many data recovery customers start our conversation with the title of this post. “I have a RAID so my data is backed up.” It’s a misconception that has cost them thousands of dollars.

RAID or redundant array of independent disks, is a group of drives that act as a single drive. There are a variety of RAID configurations. Some protect against hardware failure, some are even more prone to hardware failure than a regular single drive.

The most common RAID configurations are RAID 0, 1 and 5. There are many others, but I’ve rarely seen them used so I’m only going to talk about these three configurations.

RAID 0
RAID 0 takes multiple drives and stripes them to make one big drive that uses all drives to write faster. RAID 0 is super fast and is great when you need a super fast drive. How is it fast? Take a 2 drive RAID 0. If you’re writing a file with one drive, there’s one drive head to write the data. If you’re striped, there are two heads and it writes half of each file on each drive. This makes it twice as fast as a single drive. Unfortunately, this is the worst RAID from a data protection standpoint. Because all files are written in pieces on each drive, if just one drive fails, then all data could be lost,and it’s a very expensive recovery. RAID 0 means “zero data protection”.

RAID 1
This is often called “mirrored” and it does provide some data protection, but only protection against hardware failure. RAID 1 is made up of two identically sized drives. When you save a file, it writes a copy of the file to each drive so you have two copies. So it’s an automatic, instant backup, right? Not so fast. RAID 1 will protect you if one of your drives experiences a hardware failure. When it does, your other drive in the RAID still has all your data, which is good and saves you a trip to Mike’s. However, there are other failures that can still destroy ALL your data, even with two drives.

Because RAID 1 is mirrored, everything that happens on one drive happens on the other drive, instantly. So if you throw a file, or all your files in the trash, and empty the trash, they are deleted on both drives. Bye, bye, data. Hello, Mike’s data recovery. If your drive experiences a software failure where the drive gets confused and starts writing data over existing files, it does it on both drives. Again, bye, bye, data. RAID 1 protects you from some hardware failures but not software or human failures

RAID 5
This RAID needs at least three drives and provides the most data protection but it is still not a backup. You can still lose all your data. This happened to one of our customers who ran his entire business on a RAID 5 and could have lost it all because he had no backup. I’ll get to that in a moment. RAID 5 requires at least three drives. Let’s use the example of a three drive RAID 5 to explain how it works. RAID 5 writes 2/3 of your data to the first drive and simultaneously writes a 1/3 backup to each of the other 2 drives. The result is a backup of your data to the other drives. This is often used for servers because if one drive fails you can remove it, insert a new drive without turning off the server and the RAID automatically recreates the failed drive from the backup data on the other drives. Really cool.

But although your data is written in two places it suffers from the same risks as RAID 1. If you throw out your data, it’s gone. If the directory gets messed up, it can still overwrite your files in both places. Once again, bye, bye, data.

Now back to the story of that nice customer of ours. He’d been running his business on a RAID 5. He called me one Sunday in a panic. His drive wasn’t showing up. So the first thing I asked him was: “Do you have a backup?” His reply was just what I never want to hear: “I don’t need a backup, it’s a RAID.” My heart sunk. He brought it in and he had big problems. One of his drives had failed earlier and he didn’t notice it. Now a second drive had failed so he had no backup. Then when his drive didn’t show up, he restarted the RAID and the RAID brought up the old drive that had failed a while ago and had old data on it. Now the RAID was really confused and started rebuilding old data on top of new data. Bad. Bad. Bad. We recovered many but not all of the files he needed to run his business, explained RAIDs and how he needed an independent backup.

One final note about RAIDs: they’re complicated. They involve more drives and complex schemes for storing data on those drives. Because of that they’re more expensive to recover. RAID recoveries are often two to five TIMES more expensive than regular single drive recoveries. So instead of a RAID “having” a backup and protecting you, it’s going to cost you even more to recover that data.

So what’s the moral of the story with having a RAID? It’s the same moral as any hard drive: you need an independent backup. You need a copy of your data in a separate place, whether that’s in the cloud or on an external hard drive, or both.

Posted in Data Recovery

A Tragic Tale of Data Loss…Almost

250,000 images: a photo studio’s last ten years of work, nearly lost.

I got the panicked phone call at 11am Sunday, my day off, having brunch with my friends and family. “My RAID array is not working!”

At this point I asked if anything has been done, when he got a few sentences in I told him to stop and bring it into the shop as soon as he can. The more you do at home, the more you can damage your data.

The RAID was homemade with two 4TB RAID 5 sets in a generic enclosure with each RAID set going to an eSATA Port Multiplier. The “raid card”, and I use the term loosely, was just an eSATA card that used software drivers to enable the RAID 5 volume. The data was arranged in a RAID 50 configuration. Each RAID 5 set was then striped to create a single large 8TB volume. When I asked where the backup was he said the RAID was the backup. I responded “Ok, that’s good then you still have the primary data on your other drives or computers” A long pause on the phone was followed by: “No, all the data was on the RAID. It backs up to itself!!”

He told me what happened:

1. The RAID was working and in use copying data. It was shared from a PowerMac G5 tower over Ethernet.
2. In the middle of the copy the shared volume disappeared and the RAID was not accessible.
3. They powered the RAID and server off and on.
4. The raid drive came up with the dialog that it was unreadable and needed to be initialized.
5. The raid monitoring webpage indicated a drive failed four months ago! There were no recent failures to the RAID hardware
6. Figuring the volume is just corrupt they used Disk Warrior to rebuild the directory. When it finished five hours later they previewed the volume and all the data was there. A preview of Disk Warrior is really slow, maybe 11 megabytes per second on a good day on a fast system. The G5 they had was really slow.
7. As the system was not in a good location and the copy would take like 3 days they powered off the RAID and server then moved it to a better location so the long copy could be done.
8. When the RAID and server were powered on the RAID volumes were GONE! No errors, no notifications, nothing. All the drives report as being online and working but no data.
9. They then tried Data Rescue, File Salvage, R-Studio and just about every program they could run and got nothing over a week.
10. Then they called and here we are.

I spent a few hours looking at the RAID and determined that the “bad” drive that failed months ago must have had a bad connection. When the RAID was moved, it came online and the software got confused and added the missing drive to the RAID configuration. This caused the loss of all the profiles of the RAID volume. As this was a ten-drive RAID no amount of guessing or prodding could determine how it was configured. All the ports were not labeled and it was impossible to tell if it was a RAID 5 or a RAID 3 pretending to be RAID 5? It was a mess. At this point I left it alone and made a call.

I asked how important the data was and if it were all lost how bad would it be? Shock and desperation were the next emotions that came over the phone.

We do about 90% of the data recoveries at Mike’s, in house. That helps us keep cost down and get your data back to you faster. Sometimes, however, even the best needs help, and when we do, we call the best lab in the business: Drivesavers.

So I called Drivesavers and got a quote. For a ten-drive RAID with what was really an unknown configuration, standard service was quoted at $7,500 to $35,000. That’s right, if they can even get the data it can cost up to $35,000 to get the information back. So you could have your data rebuilt and saved or purchase a new BMW sedan, nicely optioned.

Our customer had no backup. He could have to spend up to $35,000 to fix that mistake. It’s ten years of his photos; he’s a photographer, he needs those photos.

In the end the data was saved. Over thirty hours of work by a three-person team was required to get the data. The final price was $15,000 and all the data was recovered. The data was only 6TB of information and fit on two 4TB $292 LaCie D2 Drives. Everything in life is obvious in retrospect: $600 or $15,000?

Do you have a backup?
So what lessons can we learn from this near tragedy?

First, always have a backup. A backup is an independent copy of your data on a separate drive.
Second, a RAID is not a backup of itself.
Third, if you think you’re in a situation where you may lose data and that data is valuable to you, don’t try anything. If you cannot make a copy of your data, turn off the computer and bring it to us. Running programs like Disk Warrior can further damage your data, not always, but if you try and fix it yourself, you risk making it worse. Even turning on the computer risks damaging the drive further.
Fourth, if you can make a copy of your data do it immediately. Don’t turn off the computer for any reason just make that copy.
Fifth, if your data is valuable to you, don’t put it on a home-grown RAID that you made because it was cheaper. Homemade RAIDs are not cheaper if they fail more often and cost you a data recovery.

I hope all of you can benefit from this experience without having to pay $15,000.

Do you have a backup?

Posted in Data Recovery