Altirium logo

Recover a bit but lose a block

When attempting a data recovery from a Microsoft Exchange email server after a catastrophic failure, and when I say catastrophic I mean, no backup to restore from and file system corruption or file deletion that has rendered the Exchange information store files inaccessible, one of the tools in Altirium’s data recovery arsenal was to trawl the entire disk or RAID volume and identify pages of Exchange data and rebuild the information store from the ashes. However when Microsoft engineers decided to change their page error correction method so that they could correct a single bit error in a page this seemingly minor ‘upgrade’ had dramatic effect in the ability to identify Exchange page data.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 8.0/10 (1 vote cast)

Is a NAS RAID reconfiguration the end of your data?

The popularity of Network Attached Storage (NAS) RAID units has never been higher. For a small outlay a low powered, easy maintenance, storage device of 1TB or higher can be plugged in and used where once an expensive server with disk storage would have been the only option. Whilst RAID5 gives a high degree of reliance against the failure of any one disk in the NAS unit, other problems can result in an apparent total loss of data and a requirement for a NAS Data Recovery.

A NAS storage device  in need of recovery was delivered to us last week. The customer had been using the device and on Friday evening all data was present and correct, but when the customer went to access the device on the Monday morning it was operational but there was no data present. So where had it gone and could a data recovery be achieved?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

TK50 data recovery, look out for media degradation

TK50 was a major player in tape backup on VAX/VMS systems several years ago. Being fundamentally ½” (half inch) tape of the type used in open reel drives, but housed as DLT style cartridge, it suffers from the same long term storage problems as some brands of 1/2″ media. TK50 drives could store 70MB of data, and took quite a long time to fill, so have long since ceased to be a viable backup option even if you can find drives and media. But, there are a surprising number of tapes out there with data on them and recent weeks seem to have brought forth a flurry of requests to get data from them, and in one case to copy some. In a high proportion of these cases the data transfer operation has ended up being a data recovery exercise involving considerable work in the lab.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 7.0/10 (1 vote cast)

eDiscovery and the monster in the vault

Past failure cannot be taken as a signpost for the way things will be in the future, so the inability of the US and UK financial regulatory authorities to spot the credit bubble from 20 paces, or the world’s largest Ponzi scheme even when pointed out to them in neon lighting, should not be taken as a sign that regulation can be ignored.

What is almost certain is that these regulatory paper tigers are about to be forced to become real, and with it will come new zeal for enforcing regulatory compliance leading to an increase in eDiscovery and eDisclosure requests.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 8.0/10 (1 vote cast)

Data Recovery – Don’t take no-fix for an answer

When I first started in the data recovery industry back in 1995 data recovery was very much a specialist area of expertise. There were no ‘off the shelf’ data recovery software tools. We had to develop our own methods and techniques to get the job done. These days however the data recovery market place is flooded with companies offering such services, so how do you know who to choose?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 7.5/10 (2 votes cast)

Computer Forensics – don’t ignore the tapes

Much Computer Forensic work is associated with data recovery from hard disk drives, USB pens and other common data storage media. Even the television drama departments appear to believe that data is stored only on this limited range of media, I don’t have a back catalogue to check against but I am pretty certain that on Spooks there has never been an analysis of a DLT or LTO tape cartridge. So what about tape? Probably the largest volume of data stored in the world is on tape, so is it of any value in forensic investigations and litigation work?

The hard disk drive in a computer system contains the most up-to date information along with other forensically valuable information such as internet history and local temporary files, so why should you bother looking at the backup tapes?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)

Data migration and the curse of multiplexed NetBackup

A bit unfair to single out NetBackup, any format that supports multiplexing can leave similar problems for anyone attempting an archive-wide data migration project. The problem is this, multiplexing involves the interspersing of data from several sources within a backup set. This gives improvements in backup performance but the payback is in potentially degraded restore performance, especially if attempting a complete restoration of data. Why?

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)

Data Migration – whatever happened to optical disk storage?

It is not so many years ago that the world of data storage was buzzing with the development of various optical data storage products from read/write magneto optical disks, ablative WORM and Phase Change optical disk. This was to be the future of high volume, long term archival storage.

So what happened? Back in the 1980’s hard drives were expensive, not much trusted and low capacity. Optical disk offered a far higher capacity, and being a removable media technology, the ability to expand storage by simply using more disks. Tape was then seen as a technology in transition, again not adequate on the capacity front, and there was a perception of reliability issues.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)

Data Recovery when everything fails

Much data recovery work involves the salvage of data from one specific type of storage, a hard drive, RAID array, backup tape or DVD. Occasionally a requirement pops up that transcends this norm.

Having faithfully adhered to a regime of nightly backup of a SUN UNIX system, the failure of the hard drive appeared to be an inconvenience that would soon be overcome for this customer. The hard drive having swiftly been replaced, the backup tape was brought back from storage and the restore process initiated. Five minutes in, however, and the DLT drive made a nasty noise, the cleaning lights came on and ufsrestore became ufs-cannot-restore.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)

RAID5 backup, why bother?

RAID 5 combines capacity and performance with fault-tolerance, a disk can fail and the RAID will keep on going, so does this mean that there is no need for backup? Is RAID 5 data recovery never going to be a requirement?

Some people seem to think so, but have been dangerously mis-informed. The error correction used in a RAID5 array is there to provide a level of protection for what will often be business critical data, but can still only survive the loss of a single hard drive from the array. Even RAID 6 with double error correction can only cope with a failure of two drives.

Read the rest of this entry »

VN:F [1.9.22_1171]
Rating: 0.0/10 (0 votes cast)