Data recovery business

[manubali]

hi all, i have been working as electronics technician for years and now i want to get into data recovery business, but i don't know where to start from and what kind of equipments do i need, is there anyone in same business that can help me get started.

[Halcyon]

Data recovery is a specialised game. If you're doing it for your regular "mum and dad" users, then you can pretty much use any off-the-shelf tools to deal with the bulk of your cases (accidentally deleted data, formatted drives, corrupt file systems, the odd bad sector etc...).

If you're looking to do it professionally, then expect to pay big money for proper equipment. Specialised hardware is required to be able to read faulty disks, damaged platters, corrupt firmware and that gear doesn't come cheap. For your entry level stuff, you're probably looking at around $10,000. If you're going to be pulling drives apart, you at least want a relatively clean environment with a laminar flow cabinet.

On the subject of pulling drives apart, most decent labs will keep a library of donor hard drives (various makes, models, revisions and factory codes). It's pretty much impossible to keep every possible drive, but I guess stick with the common ones.

Then there are SSD's, these are an entirely different story. If you're going to be removing NAND and trying to recover data at a low level, it means even more expensive and specialised gear.

It takes years of training (which also costs money) to become good at it. There is a reason why companies like Payam charges thousands per job.

[shakalnokturn]

You may learn a little from this website:
http://www.acelaboratory.com/

Acelab forum:
http://forum.acelaboratory.com/

HDDguru forum:
http://forum.hddguru.com/

[Red Squirrel]

I had a coworker who used to actually do it right in his basement.  He was rather secretive about the specifics but basically it does require a few specialized tools, but it's doable.  Basically you need a tool to remove heads properly without them touching the platter for when you do head swaps. It's rare you need to remove the actual platters, typically it's the head assembly.   When you need to swap parts you sometimes need to get parts from same batch too.

He said a lot of failures were also a small chip on the head that was glued instead of soldered and it would slowly unglue, think WD drives were bad for that. That was more specific to a certain line of product though, but basically one big thing that helps is experience, after a while you will start to know the various failure modes.  When someone brings you the 100th Seagate 7200.11 drive with the same problem description it will get very routine.

I'd say your best bet is to get in touch with the main drive manufacturers like Seagate and WD as they may be able to help and even provide the tools.

The professional labs will use clean rooms, but my coworker who did it said it's not REALLY needed, you just need to do a quick fix to get the drive going, and then immediately get a full image off it and it only needs to last enough to do that.  It's just that with a clean room you are minimizing chance of issues even more and that's critical if you are recovering many drives for a high tier customer.   If you do want to be serious about it I would personally build out at least a basic clean room though. I'm not sure what kind of setup my coworker had, I imagine he did have at least some method of ensuring there is no dust around.  Maybe crank humidifier before starting a job or something.

[alpher]

flash-extractor is worth looking into as well;

[BradC]

Then there are SSD's, these are an entirely different story. If you're going to be removing NAND and trying to recover data at a low level, it means even more expensive and specialised gear.

It's worse than that now because almost all SSDs encrypt by default. Good from the perspective of a secure erase taking milliseconds to change the encryption key and not worry about the flash contents, but makes it difficult from a data recovery perspective. The best one I read about recently was a matter of transplanting the NAND across into an identical drive, then having Samsung perform some special incantations to sync up the encryption keys so the flash could be read.

I agree with pretty much everything else that has been posted. A DIY laminar flow cabinet is a good idea and there are some companies in Russia that specialize in the tools required to make head/platter swaps easier. I've done head swaps with some home made contraptions for family and friends, but if the data is of any significant value I just redirect people to professionals. Ebay is a pretty good source of donor parts if you are willing to wait and can afford the premium.

The software is the clever part and the majority of instances seem to be things like the service area getting corrupted. That can often be fixed with the right software and the right training/experience, but neither of those things is cheap to acquire.

Just the mention of the Seagate 7200.11 makes me want to puke. I had 10 of those in a RAID, of which over half suffered the hang-up bug and my backups were inadequate. A massive thanks to the guys at the hdd-guru forums for publicizing the fix.

[amyk]

there are some companies in Russia

The Russians seem to be leading in data recovery technology (both sites posted above are hosted by Russians)... I wonder why.

[Halcyon]

It's worse than that now because almost all SSDs encrypt by default. Good from the perspective of a secure erase taking milliseconds to change the encryption key and not worry about the flash contents, but makes it difficult from a data recovery perspective. The best one I read about recently was a matter of transplanting the NAND across into an identical drive, then having Samsung perform some special incantations to sync up the encryption keys so the flash could be read.

My experience is actually the opposite, most SSDs, M.2 and NVMe drives I've come across in the last few years aren't encrypted at a hardware level at all (or, encryption may be supported, but not enabled by default). This is increasing of course, but there is more than one way to access data. To a consumer, encryption needs to be easy to use otherwise most people won't bother. The "I have nothing to hide" or "the contents of my hard drive is boring anyway" is a common argument against encryption.

[BradC]

My experience is actually the opposite, most SSDs, M.2 and NVMe drives I've come across in the last few years aren't encrypted at a hardware level at all (or, encryption may be supported, but not enabled by default). This is increasing of course, but there is more than one way to access data. To a consumer, encryption needs to be easy to use otherwise most people won't bother. The "I have nothing to hide" or "the contents of my hard drive is boring anyway" is a common argument against encryption.

That *is* interesting. Certainly every drive I've looked has a data sheet that states it uses AES encryption at the hardware level by default. The key is generated at the factory and stored on the flash along with the encrypted data. If the user wants to "encrypt" the drive all that happens is the on-drive key gets encrypted with the password. Until that point, it *is* hardware encrypted, but the user would have no idea that it was as for all intents and purposes it's transparent.

You can reset the encryption key without the password, but that renders the data inaccessible. Likewise a secure erase generates a new encryption key, unmaps the flash and lets the garbage collector clean it up.

Now having said that,I've not been anywhere near the bottom of the barrel consumer drives, nor looked at flash sticks.

[Halcyon]

Now having said that, I've not been anywhere near the bottom of the barrel consumer drives, nor looked at flash sticks.

Self-encrypting drives have been around for a while, a lot of your enterprise spinning disks would self-encrypt as well. I guess in an environment where those sorts of high-end drives are in use, losing a disk is really no big deal since it's almost certain there are several levels of redundancy in place and a decent backup solution. In the world of corporate, enterprise and government IT, replacing a disk is fairly routine and even expected.

Data recovery is usually a last resort because backups have either not existed or have failed, there was no redundancy or it's part of a Police/Government agency investigation and the drive has been seized.