HN user

wayne_h

40 karma

-- Wayne Horner, (949)287-3282 - Alandata Recovery "Cleanroom Data Recovery of RAID, NAS, Linux, Tape, Hard Disk Drive, VMware" www.Alandata.com www.ALANDATARECOVERY.com

Posts0
Comments20
View on HN
No posts found.

Surprisingly the article doesn't mention the biggest benefit of telling the truth....

Truth forces you to confront your own shortcomings - its an opportunity for self-improvement.

If I miss a deadline I could makeup some baloney and lay the blame elsewhere or I can face my own inadequacy and tell the truth.

Its painful to admit I am behind.... but pain is a growth stimulus - it forces me to deal with the shortcoming. Its easier to lie, tell them what they want to hear - but you miss out on the chance for your own self improvement.

Embrace the pain - its growth. What happens when you lift weights? Sore muscles leads to growing bigger muscles. Swing a hammer for a week, leads to blisters leads to growing calluses.

I bet it has to do with the target market.

4tb external drives are something an end-user consumer would shop for based on price.

While a 4tb bare internal is shopped for by techies building systems.

Data recovery guy here...

Failure of external drives has mostly to do with their handling.

They get bumped around while runnning.

People trip over the cords and knock them over.

They stack them like pancakes and they overheat. They block the fans and cause overheating.

Many enclosures are designed to look stylish - but don't cool well.

Heads fly at nanometers over the surface - they dont tolerate bumps well.

The drives we recover from external enclosures appear to be the same as bare drives that we recover.

Data Recovery guy here...

SSDs are fast - but you better back them up. When an SSD fails its usually complete and without warning.

Spinning drives will often give you some warning signs, clicking, slowing down, bad sector errors etc.

Spinning disks can be rebuilt with new heads or platter swapped into a new body.

With SSDs you cant just remove the NAND chips and recover the data either. SSDs use dynamic wear leveling to shuffle pages of blocks around - in other words - block 0 is not at block 0 -it could be anywhere... and if the internal map is lost - good luck.

The data in the NAND chips is also encrypted... they do this to ensure that erased sectors are actually erased. Because of the wear-leveling routine spies could possibly recover data from unused sectors - the encryption makes this impossible.

And for extra fun - intel likes to epoxy the chips to the board - just to be sure they don't fall off....

I compare them to a hover-car, with wheels you can get a flat and still make it off the freeway... but with the hover-car your just a sitting duck...

Oh, I see what your are saying ... that zfs can detect corrupted files, true.

Whats likely to happen in this case is this: The first blocks of the disk contain the superblock, labels-descriptors and other filesystem metadata. Most of which will be sitting in cache. The damaged overwritten area at 0mb won't be noticed for some time - like next time the volume is mounted. The filesystem will eventually notice the damage and go into some recovery mode or halt to protect itself. Zfs has lots of redundancy so the beginning volume labels could be rebuilt.

One benefit of zfs will be that you can tell which recovered files are good or bad.

I don't see how zfs can detect the problem any sooner than any other filesystem.

If the problem is caused by the controller wrapping at 2tb then I wouldn't expect zfs to figure it out until later when it tries to read files back and finds damage.

Lets say zfs writes a file at 2tb but due to wrapping its actually written to 0 tb. Then zfs reads the file at 2tb to verify that is good. But the file appears to be fine because its really reading it again at 0tb. At some point zfs will detect a problem but I don't see how it can catch the problem instantly.

I am currently working on a data recovery caused by 2tb limited bridge controller.

Customer had an external usb/firewire box with a 3tb drive. At 2tb the writes 'wrapped' back to block 0. Its a mac filesystem. Everything worked great until he wrote past 2tb. At that point it overwrote the beginning of the mac volume. The next time he connected the drive the mac thought that it was a new raw drive and told him that he needed to initialize the drive.

This is the second time he did this - the first time he didn't reinitialize it and we got it all back.

Unfortunately this time they initialized the drive. This zeroed out all the metadata, catalogs, maps etc - much bigger mess.

So some bridge controllers cannot handle drives larger than 2tb. 2tb is the last sector that you can address with a 4 byte disk address. So for sectors 0-0xffffffff .....works fine. The next sector is 0x100000000 - 5 bytes, it only sees the lower 4 bytes 0x00000000 and starts overwriting the beginning of the drive.

NTFS filesystems are more recoverable in this situation because their master file table starts 6 million sectors out on the drive so you would have to write alot more data before you start losing all your filenames and folder structures and pointers to the data.

Meanwhile... California is trying to build a 100 billion dollar bullet-train boondogle that will be ready in 20 years. By that point our efficient electric cars will be able to link together in high speed freeway 'trains'. What if that money was invested in developing the autonomous cars?

The public thinks everyone else is going to ride the train and free the highway up for them... what a waste.

This was caused by government unintended consequences....

Some doctors graduated from med school with $100ks in loans. So they immediately filed for bankruptcy and cleared the debt. After a few years of work they were back in the bucks and debt-free.

The loan industry had congress write some new laws (was it 2008 ish?). The package clamped down on debt-collectors calling at all hours. It also eliminated clearing college loans with BK.

The loan industry celebrated - nothing like sure bet! Indentured servitude - Yahoo! They started giving away loans like candy.

Then the schools noticed all the free-flowing money and joined the party.

'Basic income'? Lets start with 'Basic grading'

Currently students earn grades A-F. From now on we should have a 'basic grade', all students will be given a 'D' - a basic passing grade. You get your 'D' even if you don't even go to class. and since don't go to school well we might as well just give them the diplomas too...

I would like to see the idealistic college students and professors apply this concept to their real world and see how it works out...

The idiocy of this becomes obvious in this context.

You could be having the TLER problem. WD green drives can take a long time to do error correction - this causes the raid to drop the drive as failed. This solution is to respond with an error quickly and let the raid fix it with parity.... but at least it doesn't drop the drive. Or buy more expensive drives. Wait isnt that the idea behind RAID: Redundant Array of Inexpensive Disks..

You might want to look at this... http://hardforum.com/showthread.php?t=1285254

btw, I am currently working on recovering an 8 bay drobopro thats in a reboot loop...

I have been doing raid data recovery for many years. A very common scenario is "Two Drives Failed at Once". This is usually not the case. What usually happens is 1 drive fails. The raid then goes into degraded mode and continues to function. Nobody notices the warnings. Some time later... months or years even, a second drive fails, the raid goes down - now they notice. They call in the techs who declare 'two drives failed'. This is when your data is most at risk. People start swapping boards and drives, repower the system, rebuild drives, rebuild parity, force stale drives online etc. I have seen alot of raids that would have been recoverable had they done the proper steps. Then they hand it over and say they found it this way... didn't touch a thing... www.alandata.com

and don't underestimate the manufacturers ability to screw it up. Like when people 'upgrade' the firmware in their Buffalo NAS box and after that they can't see the data anymore. Luckily the data was still there and undamaged but it took data recovery to get it back.

I once did a RAID data recovery on a system with a high-end Intel raid controller. The controller failed and they sent a new one - only the new one couldn't assemble the raid properly. It turns out that there was a flaw in the logic for where parity was stored. Normally parity is spread evenly across all the drives - not on this version. I had to reverse-engineer the crazy raid pattern and write a program to deraid it. It had gone undetected - as long as it was running.

I do RAID data recovery for a living. Customers always think that '2 drives failed at the same time'. Thats not what usually happens. What really happens is that 1 drive fails and the raid does what it supposed to do - it keeps on functioning. Sometimes for months. Then the second drive fails and it stops. They call in the IT guys and it appears that '2 drives failed at the same time'. Not.. Most raid data loss is caused by IT guys trying to fix it - because its a raid and its redundant and it cant be hurt so let me start swapping stuff and rebuilding and destroying...

The government wants to raise taxes. (We are already the highest taxed state.) To soften up the voters they will threaten to cut things that are popular. Beaches, Parks, libraries, police, fire.. release the prisoners etc etc.. I say good go ahead... its scare tactics. Even if they do cut these things then maybe enough people will notice and throw them out. They recently announced cutting funding to animal shelters, so strays will be killed in a 72 hours.

In other news... it was recently revealed that parking lot attendants at the Dept Of Water earn $74,000 per year. LA city has a $1M yacht (they kept hidden). They used $500K in obama 'stimulus money' to install new engines.

Starve the beast. No more money. Wake-up voters - dont be fooled.

Its SEO'ers....

A competitor of the dog training business hires an SEO Search Engine Optimiser to increase his business. To do that they post negative reviews of all the competitors. They post fake positive reviews of their client.

I have tracked this down before. The positive reviews all looked suspiciously similar and over-glowing. I have seen the same review, the same day, by the same guy, in multiple nearby neighborhoods.

This also can happen when an SEO marketer calls and you turn him down. He then spites your site and calls back again later to see if your more agreeable....