Data Recovery Blog - December 2011

Data Clinic and sister company Datlabs add new hard disk data recovery points of presence across the UK

Data Clinic Locations

> Data Clinic - Data Recovery LONDON area: 1 Liverpool Street, City of London, EC2M 7QD
> Data Clinic - Data Recovery MANCHESTER area: The Pavilions, Bridge Hall Lane, Bury, BL9 7NX
> Data Clinic - Data Recovery BURY area :The Pavilions, Bridge Hall Lane, Bury, Gtr Manchester BL9 7NX
> Data Clinic - Data Recovery BIRMINGHAM area: 2nd Floor, Quayside Tower, Broad Street, Birmingham B1 2HF
> Data Clinic - Data Recovery SCOTLAND: 20-23 Woodside Place, Glasgow G3 7QF
> Data Clinic - Data Recovery LEEDS area: Building 3, City West Business Park, Gelderd Road, Leeds LS12 6LN
> Data Clinic - Data Recovery LIVERPOOL area: Horton House, Exchange Flags, Liverpool L2 3PF

Datlabs Locations

> Datlabs - Data Recovery in the London area: The Barley Mow Centre, 10 Barley Mow Passage, London W4 4PH
> Datlabs - Data Recovery in the Manchester area: One Central Park, Northampton Road, Manchester M40 5BP
> Datlabs - Data Recovery in the Birmingham area: 2nd Floor, Quayside Tower, Broad Street, Birmingham B1 2HF
> Datlabs - Data Recovery in Scotland: 20-23 Woodside Place, Glasgow G3 7QF

MBR (Master Boot Record) Data Structure

In a Basic DOS partition, the MBR contains information on the logical structure of the hard drive and instructions on how to boot the system from the hard drive. The MBR is located on the first sector (LBA 0, CHS=cylinder 0; head 0; sector 1) of the hard drive. It is 512 bytes in size and consists of four parts:

• Offset 0 to offset 0x1B7: Boot Code - This occupies 440 bytes. The code may not exist on hard drives not being used as operating system boot devices. When the computer is powered on, the BIOS code will be self-checked. Then the Boot Code is copied into a safe area of memory to prevent it being overwritten by other programs or a virus. This code is then executed and tells the computer how to process the Disk Partition Table (DPT) and locate the file system's boot record.
• Offset 0x1B8 to offset 0x1BD: Windows Hard Disk Drive ID - This is a unique identification code assigned by the Windows OS during the hard drive initialization process. It is an essential parameter of the MBR. Without this ID, the Windows OS will recognize the drive as uninitialized. In reality, Windows will try to assign a new ID to the hard drive if the ID doesn’t exist.
• Offset 0x1BE to 0x1FD: Disk Partition Table (DPT) - This will be covered in a later post.
• Offset 0x1FE: “0x55AA” - This is the MBR signature. The last two bytes of the MBR sector have to be ’0x55AA’. Without these values, the computer will recognize sector 0 as being an illegal MBR sector and report an MBR error.

Data recovery from a 36 disk RAID 6 storage array

One of the largest jobs we've seen at Data Clinic was this 36 disk RAID 6 array which came in from Portugal. Each disk was 2TB in size which gave the array a theoretical storage capacity of 68TB ((36 * 2TB) - (2 * 2TB)). This is huge - the equivalent of a library full of printed books.

The logistics of recovering such a large system require some thought... De-striping the drives to a larger media is not really feasible - at this time it's not possible to get a 4TB hard drive, so what's needed is a way of hooking up all 36 drives so that one system can interrogate the lot of them. Then there are power issues also - how to power so many drives on one system.. Then there are software issues... this was a Linux system using the Reed-Solomon RAID 6 algorithm... Then there are recovery issues... to recover this much data will take weeks.. and how are we going to get so much data back to the customer ?... But it's a nice problem to have...

It took appromiately a week or so to repair the problems, fix the data structures, work out the RAID configuration and gain access to the data.