Data emergency guide
This guide is intended to help you recognize, react appropriately to and resolve a data emergency. It is not a technical support manual for the installation, configuration and upgrading of data storage devices and platforms, nor is it a how- to manual for data backup procedures.
Table of Contents
INTRODUCTION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
WHAT IS DATA LOSS? . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Emergency Information WHAT IS DATA RECOVERY?. . . . . . . . . . . . . . . . . . . . . . . . 7
DATA LOSS PREVENTION . . . . . . . . . . . . . . . . . . . . . . . . . 9
Recognizing a Data Loss Situation RECOGNIZING A DATA LOSS SITUATION. . . . . . . . . . . . . . . 15
What To Do First DATA RECOVERY PROCESS: WHAT TO DO FIRST?. . . . . . . . . . 18
What NOT To Do DATA EMERGENCY WORKSHEET . . . . . . . . . . . . . . . . . . . . 20
ACTIONFRONT’S DATA RECOVERY PROCESS . . . . . . . . . . . . . 25
Data Emergency Worksheet
CASE STUDIES: REAL LIFE DATA RECOVERY STORIES. . . . . . . 28
APPENDIX A: VENDOR HELP REFERENCES . . . . . . . . . . . . . 33
APPENDIX B: RELATED REFERENCES . . . . . . . . . . . . . . . . . 34
APPENDIX C: HANDLING TIPS & ESD PRECAUTIONS . . . . . . . 35
APPENDIX D: BEWARE DIY SOLUTIONS AND PRODUCTS. . . . . 36
APPENDIX E: HOW TO CHOOSE A DATA RECOVERY COMPANY. . 37
OUR PITCH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Copyright 2002
1.800.563.1167 www.actionfront.com 1
Introduction
This guide is intended to help you recognize, react
appropriately to and resolve a data emergency.
It is not a technical support manual for the installation,
configuration and upgrading of data storage devices and
platforms, nor is it a how-to manual for data backup
procedures.
The Data Emergency Guide will be most useful to computer
users and technical support personnel experiencing a sudden
data loss situation involving a previously functioning
computer system or backup, or dealing with the accidental
erasure of data or overwriting of data control structures.
For general technical support and/or consultation on proper
backup systems please consult your data storage vendor or
your local computer systems supplier/integrator.
This guide does include some excellent reference materials
about data storage, backups and data loss prevention, with
links to additional reference materials and links to vendor
technical support.
The Importance of Data Storage
Data Storage is the holding of information in a digital format
on a device or system of devices that are within or attached
to a computer system. Examples of data storage devices range
from those found on personal computers such as a hard drive,
a floppy diskette, or a CD-ROM to those found in sophisticated
corporate data centers such as large multi-hard drive servers
and automated backup libraries. Data storage is an integral
component of all computer systems and modern life, as we
know it, would not exist without it.
The types of information stored can range from simple one-
page documents belonging to an individual, up to and
including huge commercial databases consisting of millions of
records serving thousands of users.
There can be cost savings when replacing paper records with
digital records, however the key benefits of digital data
storage are the efficient change, replication and sharing of the
stored information. For example, a personal user can update
and send a resume in minutes to respond to different
opportunities. A geographically disparate product supply
chain involving multiple companies can collaborate effectively
on a just-in-time inventory requirement.
2 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 3
Of course a business can become totally dependant on the What is Data Loss?
application that uses the data storage in their computer
system. Losing access to that data can have costly and even A data loss situation is usually characterized by one (or more)
catastrophic consequences. A personal user can lose work of the following:
that took days, weeks or longer to produce if they experience • The sudden inability to access any data from a previously
data loss. Sometimes the data cannot even be re-created. functioning computer system or backup.
• The accidental erasing of data or overwriting of data control
Data storage systems can be large, sophisticated installations structures.
of almost overwhelming complexity. Despite redundancy and • Data corruption or inaccessibility due to physical media
backup, they can be fragile and unreliable due to human error, damage or operating system problems.
adverse environmental conditions and occasional device
failure. Even the smartest and most experienced technicians Data loss can be caused by physical damage or “soft” (logical)
working with the best data storage equipment experience data problems. For example:
loss. • A personal user can no longer access the “C:” drive on their
PC or no longer read a floppy disk.
• A corporate data server has crashed and no longer serves
data to the corporate network.
• A set of medical images backed up on a digital tape
cartridge can no longer be restored.
Have you experienced data loss?
If your answer is “yes”, then you are not alone! The majority
of computer users will encounter this situation at some time.
Physical Causes of Data Loss
Approximately 70% of data loss cases processed by
ActionFront were caused by physical problems.
Occasionally manufacturing defects or design flaws can cause
mechanical or electronic failures. Most physical problems can
be traced to other root causes.
Physical problems include mechanical failures due to:
• Shock from device being bumped, dropped or moved while
operating causing a head crash or platter misalignment.
• Device exposed to extreme cold temperatures and/or rapid
temperature change prior to use. For example powering up a
laptop after being in a freezing car overnight.
• Disasters such as flood, fire (including sprinkler-water
secondary damage) and explosion.
• Stiction: The read-write head assembly gets “stuck” on the
disk media due to deterioration of the lubricant or because
it has failed to retract to its rest (parked) position.
Physical problems also include failure of electronic
components on the drive’s controller board due to:
• Electrostatic Discharge (ESD) or heat.
• Power loss or power surge.
4 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 5
Physical problems affecting the computer equipment may also What is Data Recovery?
render data inaccessible even though the media (that it is
stored on) still functions perfectly: It may not be what you think it is!
• Sudden power loss may corrupt open database files. Many people equate data recovery with restoring data from a
tape backup, or use the term “data recovery” interchangeably
• Computer memory glitches may result in bad data being with “disaster recovery” as in recovering from a major disaster
written to sensitive filesystem control areas. such as a flood, fire or bombing attack. These meanings are
“Soft” Causes of Data Loss quite true in the general sense and “data recovery” is usually
one step of the “disaster recovery” process.
“Soft” causes in this context means non-physical causes.
These are also referred to as “logical” causes. Soft problems However, the term ”Data Recovery” has a very specific
can usually be related back to something that someone did or meaning in the computer industry. First, consider one of the
did not do, in other words “human error”. Oops! dictionary’s definitions for “recovery”.
• Accidentally deleting files or reformatting the system. “Recovery” noun.
• A tape containing a good backup was partially overwritten “The act of obtaining usable substances from unusable
because it was inserted out of sequence during a tape sources.”
rotation. Based on this, ActionFront offers the following definition.
• “Failed restore”. Restoring from a backup can be a lengthy “Data Recovery” noun.
and error prone process. This can include tape format or
compression errors. “The act of obtaining usable data from downed computers and
backups.”
• Viruses. The malicious work of a smart sociopath.
• Configuration errors due to the complexity of the system. Data recovery cases can be divided into two broad categories:
Common Recoveries
Involve floppies and hard drives that are usually from single-
user personal computers.
Complex Recoveries
Involve hard drives, RAID arrays, tape and optical media or
corrupted databases and file systems usually from multi-user,
business systems. Data storage at the high-end has become a
very complex field. In the case of these complex situations
data recovery can be seen as “troubleshooting data storage”.
Whether common or complex, each data recovery case is
unique and the process can be very resource intensive and
exceedingly technical.
6 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 7
Data Loss Prevention
Data loss is extremely disruptive to both individuals and
businesses and data recovery can be an expensive process. It
is therefore in your best interest to take the time and invest
the resources needed to prevent data loss. In general:
Back Up Your Systems
Whether you use a single notebook or desktop computer or are
responsible for the corporate server, backing up your data is
fundamental to prevent data loss. Backing up data means
making a copy of critical data onto some other media and
storing the back up separately from the main file set in use.
Practice Restoring from a Backup before you need it.
“My backup worked fine, however the restore did not”. This is
an old joke in the computer industry based on real life
disasters where someone diligently used a backup routine for
months or years with no hint of errors, then were unable to
restore the data when they needed it. No one ever tested the
backup to ensure that if it were ever needed, the restored
data would be usable. Ha Ha indeed!
Never Upgrade without a Verified Backup
Before upgrading any system, perform a complete backup and
restore procedure. Many data recovery cases involve upgrades
gone wrong. Prove that you can quickly restore the status quo
before embarking on an upgrade.
Document Your Systems
• List your applications and ensure that you are regularly
backing up the data from all of them.
• Organize all original software and hardware documentation
and original copies of software.
Practice Preventative Physical Maintenance
• Keep the equipment under favorable environment conditions
regarding temperature and humidity.
• Install protection from power outages and power surges.
• Clean the dust from the inside or your system.
• Cleaning tape and optical drives periodically through the use
of special cleaning disks and tapes.
• Take ESD precautions. (See Appendix C).
Practice Preventative Soft (Logical) Maintenance
• Delete unused/unneeded software and data files.
• Defragment your hard drive. (See Disk Defragmenter in
“Windows Help”).
• Perform file systems checks. (See ScanDisk, CHKDSK, FSCK in
“Windows Help”)
• Deploy and keep up-to-date, anti-virus and firewall software.
8 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 9
Pay Attention to Alarms The more sophisticated users need to document their
• Many hard drives and storage management software specialized backup activities and make sure they can fully
programs provide “self-diagnostic” utilities to warn of restore their system. Again, help from a qualified technician
impending or actual failures while continuing to function. is recommended.
Do not ignore these warnings. For example, a RAID server
may sound an alarm signaling that a drive has failed but Data Loss Prevention for Business Users
will still serve data since built-in redundancy automatically If your business is dependant on its computer system to
takes over. This is intended to keep your system function, then you need to make a “business continuance
functioning while you replace the failing or failed plan”. There are consultants and companies that specialize in
component, not as a permanent solution. this discipline if you have sophisticated needs requiring
Pay Attention to Security outside help. At the core of any such plan is a list of
• Are your systems adequately protected from theft or activities and resources that your business cannot be without
vandalism of the physical kind? in order to function. If you experience an emergency such as
• Are your systems adequately protected from Internet hackers a server crash or a complete disaster, how will you keep
or disgruntled employees? operating? A careful reading of this Data Emergency Guide
Prepare for Physical Disasters will yield many of the ideas you will need in your own
• Take precautions to prevent or mitigate physical disasters business continuance plan.
such as fire, flood or explosions. For example, do not situate Issues that particularly apply to businesses include the use of
your server unprotected in a room underneath a potentially centralized servers to backup individual workstations and the
leaky plumbing pipe! need for archival (long term) storage of frequently changed
• Make a “disaster recovery plan”. Where would you get the data such as accounting records and databases.
necessary equipment to bring your system back up if your Backup
current facilities were destroyed? Unfortunately, some For corporate mission-critical data this means setting up a
catastrophes cannot be foreseen, prevented or mitigated. structured backup procedure whereby a complete copy of all
files (or sometimes just specific data files) is made, usually on
Data Loss Prevention for Personal Users a tape cartridge, and storing it off-site. Some procedures call
All of the general prevention measures listed above can be for “incremental backup” of only the changed files,
used by personal computer users depending on the level of interspersed with periodic complete backups. This procedure
importance they assign to their data. This section calls for a strict rotation of clearly labeled tapes that supports
recommends the simplest level of data loss prevention. a smooth restore procedure should it be necessary. Particular
Backup attention should be given to the type of backup software used
Casual personal users can simply copy important files to a to ensure full compatibility with your operating system and
floppy disk, CD or other removable media, label it applications.
appropriately and store it in case of future need, along with Restore
the original copy of any and all software programs they are Any formal backup routine should be tested by a “trial restore”
using. during the normal course of operations. If you cannot afford
More sophisticated users may want to purchase a specialized to risk any downtime with the system in question, try to
backup device (such as a tape drive) or perhaps use Internet restore the contents of that system onto an alternate or spare
backup services to have “off-site” backup. They may want to system. (If your application is mission-critical as this implies,
get some help from a qualified technician to plan and then you should be maintaining an alternate in any case. See
implement a comprehensive backup routine. “redundancy” below.)
Restore Redundancy
A casual user using an informal backup method such as the When it comes to engineering and computers, redundancy is a
one described above can simply make sure they can read the good thing! When a pilot thinks of a redundant engine, it is
data they have made copies of. in the context that it will provide power to the aircraft,
should the other engine fail.
10 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 11
For the largest corporations with huge financial resources, Effects of Data Loss
redundancy means maintaining an alternate and remote data If they are unlucky or careless, a personal user can lose
center with an up to the minute copy of the corporate countless hours of work or “priceless files” such as photos
application and data. A fail-over process will automatically that have a high sentimental value.
route all data processing activities to the alternate center
For the business user, the costs can be much higher and even
during an emergency.
become a life or death issue for that business. And if a data
If your business is dependant on its computer system to loss situation does not actually kill a business, studies show
function, then you need to make an investment in redundancy that “downtime” costs could be in the thousands or millions
as part of your business continuance plan. For example, a of dollars per hour.
small business will often re-purpose an older server as a
The long-term storage, maintenance and ability to use original
workstation. Can you restore a backup to this computer and
data are formal regulatory requirements or at least a fiduciary
use it as the main server for a short period? A good
or ethical duty in many fields. This is especially true in
contingency plan will identify a work-around or backup for
government, medical and financial environments.
each mission critical part of your business system.
Security
Businesses must consider both internal and external security
threats of both a physical and soft (logical) nature.
Internal and external physical threats should be addressed
through fire and flood proofing, and limiting access to various
facilities with a high level of security surrounding a separate
server room or data center.
External logical threats can be mitigated through the use of
hardware and software utilities such as firewalls and virus
protection.
Internal logical threats should be addressed through a
comprehensive password system that assigns access rights by
function. The system should be rigorously maintained and
tested periodically.
Human Resources
Each organization should designate one or more individuals
with the prime responsibility for data security and business
continuance. This person should:
• Document the business continuance plan and have it
reviewed and approved by senior management.
• Document backup and restore procedures.
• Test the restore procedures.
• Ensure compliance from the rest of the staff.
• Ensure that staff are qualified for these responsibilities and
have adequate time and resources to carry them out.
12 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 13
Recognizing a Data Loss Situation
A data loss situation is usually characterized by the sudden
inability to access data involving a previously functioning
computer system or backup or the accidental erasure of data
or overwriting of data control structures.
This section outlines the major symptoms of data loss. What
to do and what NOT to do when experiencing data loss is
covered under the heading “Data Recovery Process: What to do
first?”
Common Data Loss Situations
Floppies
A floppy disk has become un-readable. The error message says
something like this: “A:\ is not accessible. The device is not
ready. This diskette is not formatted. Would you like to format
now?”
This condition persists after trying to read the problem floppy
disk in a different floppy drive.
Single hard drives from notebooks and desktop PCs
General Symptoms of Computer Problems:
• Intermittent freeze-ups, keyboard or mouse malfunctions,
blank or flickering displays or an inability to access
networked resources may be symptoms of computer problems
that are not data loss situations. A call to your local
technical support person at a computer store or corporate
help desk is recommended as long as they do nothing during
their troubleshooting that will risk hurting your data.
• A simple problem that can stump beginners or casual users
is “no power up”. Check to see if the PC is plugged in and
the wall socket is working or if the internal power supply
inside the computer has failed.
Typical Symptoms/Characteristics of a Common Data Loss
Situation
• Accidental deletion of data.
• Accidental reformatting of partitions.
• Hard disk crash or hard disk component failure.
• Ticking or grinding noises coming from the system unit
where the hard drive is located while powering up or trying
to access files. This symptom almost always indicates a
failing hard drive and is often accompanied by some of the
other symptoms.
Note: Most drives will emit a light mechanical hum that a user may
notice under normal operation. An indication of impending failure
is when the “normal sound” changes to louder ticking or grinding
noises. This symptom may precede actual data access problems as
the drive utilizes spare sectors.
14 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 15
• Computer won’t boot. Blue or black screen after power up. • Accidental reformatting or erasure of tape.
The system will not load Windows (or other O/S). • Tape has become un-spooled inside the cartridge.
• Applications that are unable to run or load data: • Obvious physical damage.
– Trying and failing to start an application such as Excel or – Tape media stretched, snapped or split.
Word. – Visible fire or water damage.
– Trying and failing to load a file while running Excel or • Media surface contamination and damage.
Word. – Tape cannot be read past a worn-out or contaminated
• Opening folders that should be full of files but appear area.
empty. • Tape backup software corruption.
• Inaccessible drives and partitions. Optical Media
• Corrupted data. • Sector read errors preventing access to certain files.
• Visible fire or water damage. • Message: “This disk is not formatted. Would you like to
• Media surface contamination and damage. format now?”
• Corrupted filesystem structures show empty or invalid (e.g.
Complex Data Loss Situations FAT, directories, partition entries).
Note that individual media in servers can suffer from all the Auto-loaders and Jukeboxes
same issues detailed in the preceding section. Include the Both optical and tape media libraries or multi-volumes can be
above list of symptoms while diagnosing complex data loss maintained through automation. To secure an archival copy,
situations. an (offsite) backup copy or for other reasons, rotations are
Servers required by the technicians to cycle the media in and out of
Including single drive, RAID, NAS and JBOD type servers. the autoloaders. As these can be complex systems, any
• Server crash during operation or power up. rotational error can cause data to be over-written or incorrect
• Server will not reboot after “routine” upgrade to operating EOD markers to be written to the tape.
system or applications. Corrupted/Damaged Databases and File Systems
• Server reboots but cannot access or even “see” attached • The database is locked as “suspect”, preventing access and
storage. it cannot be restored to a functional state.
• Boot drive problems regarding losing critical configuration • The file header tables have been “dropped”, deleted or
data. recreated.
• RAID controller failure rendering drives inaccessible. • Backup files not recognizable by database engine.
• Hard drive failed. • Accidentally overwritten database files.
• Failed restore. • Accidentally deleted records.
• RAID alarm ignored. • Corrupted database files or records.
• Server registry configuration lost. • Damaged individual data pages.
• Intermittent drive failure resulting in configuration
corruption.
• Accidental reconfiguration of RAID drives.
• Multiple drive failure.
• Accidental replacement of hard drive.
Tape Media
• Corrupted tape headers:
– Tape appears empty of data (blank) but should be full.
– Tape should be full but has very little data with an early
EOD (End-of-Data) marker.
– Accidental overwriting of headers renders the tape
invisible or inaccessible to the restore program.
16 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 17
Data Recovery Process: What to do first? Resist the Pressure for an Instant Fix
If you have “recognized a data loss situation”, stop and
If you have “recognized a data loss situation”, this section analyze the situation rather than attempt to fix it
will help you prepare for a recovery, avoid some typical immediately. You may be under considerable pressure from co-
mistakes and perhaps help you operate with an interim workers, your boss or even your own deadlines to immediately
solution until the problem is resolved. After reading this resolve the situation. While a quick fix may prove successful,
section and completing the “Data Emergency Checklist” you if it is not, then your attempts may actually increase the
will be well prepared to call a data recovery professional. damage and greatly reduce the prospects of a successful data
(You can of course, call us immediately, or at any time, for recovery.
data emergency advice at 1 (800) 563-1167.)
Beware DIY Solutions and Products
What to do first? There are numerous Internet sites offering advice about data
As in the medical profession, the first principle of data recovery and vendors offering DIY (Do-It-Yourself) software
recovery is: “DO NO HARM”. solutions. Unfortunately the advice is often just plain wrong
If you are facing a data loss situation, and DIY software may complicate your problems and diminish
what NOT to do is very important! the prospects of a successful recovery should these software
recovery attempts fail. Note also that there is no software in
• Never run a program or utility that writes to or alters the the world that can fix storage media with physical defects.
problem media in any way. See Appendix D for more information about this topic.
• Do not power up a device that has obvious physical damage.
• Do not power up a device that has shown symptoms of Set up an Alternate System
physical failure. For example, drives that make “obvious Do not attempt to restore a backup into or onto the original
mechanical fault noises” such as ticking or grinding, should corrupted data set as you may over-write some of the lost
not be repeatedly powered on and tested as it just makes data. Furthermore, if for some reason your restore goes awry,
them worse. you may have created a situation where a potential recovery
• Activate the write-protect switch or tab on any problem from the original media may no longer be a viable option.
removable media such as tape cartridges and floppies. Consult your company’s systems documentation to configure
(Many good backups are overwritten during a crisis.) another computer/server to temporarily replace the problem
If you are having data access problems and your media has no unit. Restore whatever backups are available onto this unit
symptoms of physical failure or damage, try and check some and reconfigure it as necessary to begin productive work.
obvious issues before deciding if you need data recovery: Obviously, the more time that has been spent on the
• Read or briefly review this guide to the end. contingency plan before the data loss, the less time it will
• Are the power and drive cables properly connected? take now to set up an alternate system.
• Is configuration or driver information correct? Disk Drive Handling and ESD (Electrostatic Discharge)
• Try the defective unit with a different adapter/controller Precautions
interface or on a different computer. Before handling your computer and especially before touching
• Is there an experienced technician at a local store or the or handling the media itself, beware of creating static
company help desk that you can consult, if these steps are electrical discharges. (Often just called “static”, this is the
beyond your capabilities? (Make sure whoever is in contact electrical spark you experience while touching a person or
with your data loss situation is fully aware that they should object, especially in a dry environment.) See Appendix C.
do nothing during their troubleshooting that will risk
hurting your data.) Data Emergency Worksheet
The following pages are designed as a workbook to help you
Review, Record and Remain Calm
prepare for a successful recovery from your data emergency.
When facing data loss, stop and review the situation. Distress
You may want to make extra copies before you begin.
and even panic are typical reactions under the circumstances,
so the process of reviewing and writing down a synopsis of the
situation has the dual purpose of preparing for a recovery and
inducing calm.
18 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 19
Data Emergency Worksheet
• How important are your data files? 4c. Backups History: Dates and details of partial backups
• Do you need to preserve your data and be able to restore it (ex: selected data files).
along with your system? _______________________________________________
• If “yes” then proceed with this worksheet and answer all the
questions you can. _______________________________________________
• Do not attempt (or allow a local technician to attempt) to _______________________________________________
restore a backup to a problem drive or server or use any Do-
It-Yourself utility that writes to or alters the problem media, 5. Specific file names and directories that are important to
as you may permanently lose your data. (See Appendix D.) you? (Or, what applications generated or used these
important files?)
1. When was the system last running fine? _______________________________________________
_______________________________________________ _______________________________________________
2a. What happened since then: regarding operator activities? _______________________________________________
_______________________________________________ _______________________________________________
_______________________________________________ 6. Can you remember details of your configuration such as:
_______________________________________________ 6a. Operating system name and version (Windows 98, NT,
Novell etc)?
2b. What happened since then: regarding any symptoms of
problems? _______________________________________________
_______________________________________________ 6b. System set up and partitions, sizes (drive “C: D:” etc)”?
_______________________________________________ _______________________________________________
_______________________________________________ _______________________________________________
_______________________________________________ 6c. Application software packages installed?
3. Are there any specific error messages? Names Versions Original CDs and
_______________________________________________ Documentation Avail.?
_______________________________________________ _______________________________________________
_______________________________________________ _______________________________________________
_______________________________________________ _______________________________________________
_______________________________________________
4a. Backups History: The last “complete backup” of the entire
_______________________________________________
system.
_______________________________________________
_______________________________________________
_______________________________________________
4b. Backups History: Dates and details of “incremental
backups”. 6d. What passwords are required for:
_______________________________________________ Start up?________________________________________
_______________________________________________ Access to the hard drive? __________________________
_______________________________________________ Specific directories?_______________________________
20 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 21
7a. Do you have a contingency plan? Initial Inquiry and Consultation Process
_______________________________________________ A good data recovery consultant (such as the ActionFront CSR
or Customer Service Representative) will follow the medical
7b. What are your resources at hand to implement it? oath “do no harm”, and seek to analyze, preserve and stabilize
the current situation. Keeping the usually distressed customer
_______________________________________________ calm, they will seek answers to the questions listed above, in
_______________________________________________ order to fully grasp the situation at hand. An ActionFront CSR
_______________________________________________ will be able to confirm that you have a data loss situation
that they can help you with.
7c. Can you run your applications on a “spare” computer? Once a data loss situation has been confirmed, you will either
_______________________________________________ ship the problem media to the nearest ActionFront Lab or
arrange for on-site service if required.
7d. Can you attempt to restore the backup you have to the If possible, we recommend removing the media from the
spare unit and leave the problem unit alone for now? computer before shipping. Beware of creating electrostatic
_______________________________________________ discharge (ESD – see Appendix C) while handling your media.
Visit http://www.actionfront.com/us_packaging.asp for more
8. Is there a technician at a local store or the company help information about packaging.
desk that you can consult to analyze the problem or help
implement the contingency plan? Starting the Recovery
After carefully inspecting the problem media and reviewing all
_______________________________________________ the information available about the case, the ActionFront
_______________________________________________ technicians begin a “mirroring” process if the submitted unit
is physically functional, (i.e. they make a special copy of the
9. Is there a technician available to help you remove your media in question). In most cases all subsequent recovery
problem media and prepare it for shipping? activities take place on the mirrored copy. As the media in
_______________________________________________ question may completely fail under repeated use, using this
process increases the chances for a complete recovery and
10. Is there a technician available to assist in the re-install preserves the original media in case further access is required.
and reconfigure process once you have received your Next Recovery Steps
recovered data? Approximately 70% of cases have some sign of physical
_______________________________________________ failure. If this is severe, some hardware fixes may be
necessary before even the mirroring can take place. These
would include
• A “board swap” whereby a defective PCB (printed circuit
With a complete set of notes, and perhaps an board) on the drive is exchanged for a working board.
interim solution in place, you are now ready to call • A “head transplant” whereby a defective read/write head on
a data recovery professional. See Appendix E “How the drive is exchanged for a working head.
to Choose the Right Data Recovery Company” or call • A “platter or motor transplant” for certain models.
1 (800) 563-1167. Logical or software retrieval, working with the mirrored copy,
comes next while the technicians focus on the customer’s
priorities.
A detailed account of the recovery and customer service
process at ActionFront follows in the next section.
22 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 23
ActionFront’s Data Recovery Process
Our web-based, online, proprietary “JobTrack” system forms
the “central nervous system” of the ActionFront process.
JobTrack records and publishes timeline and other
commitments to our customers because keeping promises is
integral to the ActionFront business model.
Our staff members also use JobTrack to document and manage
our workflow process. It is maintained by ActionFront staff
across all our locations and is a primary tool to enforce ISO
9001:2000 compliance and provide extraordinary customer
service levels. It is an integrated system serving all
departments in all locations, while maximizing the efficient
use of resources.
Customers use their case number and an issued password to
gain access to the JobTrack system via the ActionFront
website and can self-track the step-by-step process involving
their media’s recovery and review related quotes and invoices.
ActionFront provides two distinct service levels: Priority and
Critical Response.
Priority Service
• In-lab service.
• Free evaluation.
• No files = no charge.
• Data guarantee: “If an accepted recovery is not as promised,
ActionFront Data Recovery Labs will do everything possible
to rectify the recovery or refund all or part of the recovery
fees paid.”
Priority service means that ActionFront CSRs (Customer Service
Representatives) and lab personnel devote an extraordinary
focus to each job that begins with the first phone call from
the (usually) distressed customer.
Both common and complex recoveries are performed under our
Priority Service.
• We track in-bound cases to make sure they arrive on time.
• Upon receipt of the customers’ media, the ActionFront CSR
immediately informs the customer of their case number and
password, and that their job has arrived and that we have
already begun our evaluation process.
• The method of communication, based on customer
preference can take place via phone, email, fax and of
course our web-based online “JobTrack” system available on
a 24/7 basis.
• Initial evaluation results are communicated as soon as they
are available, often within a few hours of receipt.
24 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 25
• All customers are contacted about their job status within 10 Critical Response Service
business hours. The Critical Response Service is available 24 hours a day, 7
• Our customer service process involves intense days a week. The ActionFront Critical Response Team is
communication between the lab, the CSR and the customer comprised of the best of the best data recovery technicians
and is based on years of successfully retrieving lost data. who take turns being on rotational standby, ready to travel
• Each case is unique and sometimes requires several cycles of anywhere at a moments notice.
questions and answers (Q&A) before we present the
customer with a quote. Our Critical Response Service addresses complex recoveries.
• After the customer has approved the quote, the lab proceeds The team is called for all kinds of complex recoveries including
to the next stage and produces a list of the files that can be combinations of network servers, RAID, NAS, SAN, tape
found, the “estimated condition” of the files and any other autoloaders and optical jukeboxes, and corrupted file sets in
pertinent information. The CSR then confirms with the software platforms such as SQL, Oracle and Exchange Server.
customer that we have indeed found the data they need and
are willing to pay for. With this confirmation in hand we On-site service is available for emergency situations where
proceed with the final stages of the recovery. immediate shipping to one of our labs is not feasible or
• We present a summary of the outcome to the customer, and security procedures prevent the media from leaving the data
then secure payment prior to shipping the data back to the center.
customer on the return media of their choice. Whether the case is handled in the lab or on-site, we work
• Whether the Priority Service can be completed within one around the clock to restore mission critical operations. Our
day, a few days or more depends on the availability of the first step is always to analyze then stabilize the situation
customer for the Q&A process and the complexity of the before we attempt the recovery.
recovery job.
• CSRs are available six days per week Monday-Friday from 8 Pricing for Critical Response Service
a.m. through 7 p.m., and Saturday 9 a.m. through 5 p.m. • Starts at $5000.
(EST). Website and voice mail support is available 24/7 and
customers with extremely urgent needs can use these to
access our emergency Critical Response Service that operates
on a 24/7 basis.
• Keeping promises is fundamental to the entire process.
Pricing for Priority Service
(As of print date)
• Minimum charge is normally $500.
• “No fault” recoveries that can be completed during the
evaluation process are performed at a nominal cost to cover
shipping and return media.
• Common recoveries average about $1200 but can be as high
as $5000 in some specific cases.
• Complex cases involving servers (RAID/NAS/SAN etc) or tape
media typically start at about $5000 and range up from this
point depending on the amount of time and resources which
must be devoted to each unique case.
26 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 27
Case Studies: Real Life Data Recovery Stories document I was working on was the Emergency Department
(ED) protocol for cases of sexual assault/abuse. I had been
Common Recoveries working on it for months and yes; I was stupid enough to not
Client Database Missing from Desktop System save it on my hard drive. The documents were saved on a
• A consultant used a Sales Contact Database program to floppy disc, which I carried everywhere since I was working on it
manage her customer information and account activities. all the time.
• She was suddenly unable to load the application and local I had incorporated feedback from the director of the ED,
technical support reported finding “empty” files. director of nursing from the ED, different ED staff and my
• ActionFront found and overcame physical problems by director. (Yes, you can say it, how stupid can I be not to save
opening the drive in clean room conditions. it somewhere else). Anyway, if I did not receive those
• The consultant purchased a new drive at cost from documents I would have to confront a lot of people with a lot
ActionFront, which was loaded with a usable version of her of embarrassment and would have lost all credibility. Sexual
completely restored database. assault is already a crime that is not taken so seriously and my
• Here is what the customer said in response to our standard credibility in the institution is crucial. Losing this file would
follow-up request for feedback: have meant to start all over again and I was not able to sleep
“I have to say that I was extremely impressed with ActionFront for a few days.
Data Recovery. The customer service representative took the I initially spoke to Brent and he calmed me down. He was
time to explain and translate my hardware/data situation and extremely nice and patient with me (I was about to have a
was very helpful in offering me options and potential solutions nervous breakdown). He did not promise anything, but said
to my data problem. they would try to do everything possible to retrieve the data.
On the technical side your website was very useful and kept me Finally, Tuesday night I got the call from Sam and I wished I
up to date on the status of my recovery. It was very well could fly to Toronto and give him a hug. He then gave me
presented and your commitment to customer service was more good news because I would not be charged for the service.
apparent. I almost wanted to cry. Our program is a non-profit
organization and we are funded by private donations and
Losing my data meant losing many of my clients’ files and a
state/federal grants. I would have had to pay for it out of my
year+ worth of work on my part. Recovery, though a very large
own pocket and if you didn’t know, counselors don’t get paid
hit to my pocketbook, meant I didn’t have to go and explain to
much.
my clients that I had lost the data and the work that they were
paying me to do!! On a positive note it’s a tax write off!! ;) Anyway, I know that you probably deal with much bigger
problems and more important information, but I wanted you to
Thank you ActionFront and good work!”
know how grateful I am for the service that was provided. I
MS Word files cannot be read on a Floppy Disk found out about you, through the Internet. I went into
• This case history is copied directly from an email sent to google.com and typed “data recovery new york city” and there
ActionFront. you were. The reason I chose you was because it said “free
• This recovery was a technically simple one, and provided evaluations”, so I had nothing to loose except the money spent
“pro bono” under the ActionFront complimentary recovery on shipping it to you. I called and spoke to Brent and the rest
policy. you have read already.
• The name of the customer’s employer and a few details have Thanks again for your wonderful service!!!!!!!!! I will keep your
been changed for confidentiality reasons, otherwise this is number in a very valuable spot.”
in the customer’s own words. (Note: Brent is an ActionFront
CSR and Sam is the VP of Customer Service.) Photos on a Damaged Microdrive
• Tiny media damaged in a fall.
“Here’s my feedback. Sam was a lifesaver and Brent was a • Family event photos of high sentimental value.
tremendous help through the beginning stages of this process. • Difficult recovery working with very small components.
• Complete recovery of photos returned on CD.
I work for a Rape Crisis Program. We work with survivors of
rape, domestic violence, incest and sexual assault. The
28 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 29
Julia loved her present, a digital camera with an IBM Microdrive RAID software had never let them down, and the
that held loads of photos. She immediately began taking photos documentation offered them a “transparent” upgrade process.
of her grandchildren exuberantly enjoying the magic of Too transparent as it turned out! After physically installing the
Christmas. After capturing scene after heart-warming scene two drives and rebuilding the RAID 5 array for the new
including Christmas dinner with the extended family, one of her configuration, all appeared normal.
twin grandchildren knocked the tripod over, smashing the camera Late that Friday afternoon, the technician rebooted and
on the hard tile floor and particularly jarring the Microdrive. discovered to his amazement that he had lost all access to the
Julia was devastated as she tried to access the photos, first in data stored on the RAID 5 server. The tech-savvy group
her camera, then on her notebook computer. Returning to the recognized a data loss situation, knew they needed a
office glum and empty-handed, Julia shared her tale of woe specialized service called “data recovery,” and soon located
while her co-workers shared their holiday snaps. Eventually ActionFront, by searching the web.
someone mentioned data recovery. Although it was the first Nick Majors, President of ActionFront, states, “Our Critical
time Julia had heard of data recovery, she now knew she needed Response Teams are on call to resolve technical crises that
it and asked a contact at IBM for help. He pointed her to stump even the most qualified vendor technical support
ActionFront Data Recovery Labs, a specialized service company personnel. Our specialists will travel to any data center at a
that had impressed IBM with its ability to recover data from moments notice, and restore a failed server or rectify a failed
damaged Microdrives. restore operation.”
Julia called the toll-free phone number and was impressed by Within 3 hours of speaking with a customer service
the confident and knowledgeable professional customer service representative, the ActionFront Critical Response Team was
representative and by the ActionFront customer-friendly policies preparing the server for a step-by-step proprietary process
of free evaluation, fair pricing, “no files = no charge” and the proven to yield the best results possible in such situations.
data guarantee. Julia sent the Microdrive to ActionFront where ActionFront technicians (both local and remote) worked around
it was carefully analyzed and disassembled in order to read and the clock to overcome the various unique obstacles inherent in
recover the data. each of these complex recoveries. By 5:00 a.m. Sunday
Julia soon received several CDs that contained all her missing morning, (and just 36 hours after the crash) the upgraded,
and treasured photos, and was soon showing them around the expanded and well functioning data was restored and their
water cooler and around the country by email! server was back in place and ready for the marketing launch.
Complex Recoveries Database Corruption
• An Internet based financial services company maintained all
460GB RAID5 Crash at California Technology Company
transaction records in a large SQL database on their
• Urgently needed for a product launch.
corporate server.
• Friday evening crash; recovery underway within 3 hours
• A routine software maintenance program was run periodically
• On-site and remote technicians worked around the clock.
without problems until the operator made an error while
• Complete turnaround in 36 hours!
launching the program.
ActionFront Data Recovery Labs launched its Critical Response • A number of the database tables were “dropped”, then
Service in November 2001 to address complex data recovery recreated and re-populated with data thereby over-writing
situations of an urgent nature. The team had already some of the data and damaging the file structures causing
completed a number of successful recoveries when they were the main application to crash.
called upon to restore a failed RAID server at a well-known • A recent backup was not available.
California-based technology company. • Without this mission critical data and associated application,
This California-based technology company was about to launch this business was doomed to face imminent extinction.
a new product and an upgraded web service for their large • ActionFront analyzed the server and a majority of the missing
installed base, to support a major marketing initiative. A large data was identified as recoverable. No physical problems
RAID 5 server needed expansion from 6 drives to 8 to increase were found, confirming this case as a complex soft (logical)
capacity in anticipation of the enlarged user volumes. The recovery.
30 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 31
• The customer identified the most critical of the missing tables Appendix A: Vendor Help References
and in order to contain costs, ActionFront was directed to
focus their efforts on these tables. Dell Corporation
• The critical tables were recovered and returned to the http://support.dell.com/us/en/kb/document.asp?DN=FA1022457
customer who was soon back in business. Fujitsu
Lost Diagnostic Images on DLT Cartridges http://www.fcpa.com/warranty/wa_warranty_frame.html
• Regulatory requirement and obligation to patients for original Fujitsu Canada
data. http://www.fujitsu.ca/support/hdd/data_recovery.html
• Rotation errors causing erroneous EOD (End-of-Data) markers. IBM
• IT vendor stumped or lacking resources. http://www.storage.ibm.com/warranty/arma24.htm
• Proprietary expertise required.
• Time intensive recovery due to the nature of tape problems. Maxtor
Home Page with links to support pages
A large urban hospital in the US North East was generating http://www.maxtor.com/Maxtorhome.htm
approximately 90,000 medical images per day in their various
Microsoft
clinics, requiring about 25GB of digital data storage. In order
http://support.microsoft.com/default.aspx?scid=kb;en-
to control costs and improve efficiency, the hospital had
us;Q306204
implemented an automated, digital-tape library system for
management and primary storage of the images. The system Novell Canada
worked flawlessly serving both the clinical users as well as the http://www.novell.com/offices/americas/canada/services_and
related administrative staff until one day, several of the tapes _support.html
appeared to be missing data or almost “empty” of data entirely. Seagate
The problem was quickly traced to an inexperienced operator General Support
and did not re-occur. However the hospital had a regulatory http://www.seagate.com/support/index.html
and professional responsibility to provide integral patient care Before you return a drive checklist
supported by the, now-lost, original images. http://www.seagate.com/support/npf/index.html#Reasons
The tapes in question were sent to the vendor who tried Western Digital
repeatedly to read past the erroneous EOD markers and find the http://www.wdc.com/support/partners/recovery.asp
lost data. The technical support people who were well qualified
to support the day-to-day issues driving customer support, did
not have the right skill set and experience to solve the problem
of lost data and were unable to solve the problem. Finally, a
determined manager did some research and discovered a
specialized industry segment known as “data recovery”. Once
she knew what to look for, she searched the web and quickly
found ActionFront Data Recovery Labs. The specialists at
ActionFront instantly recognized her problem, as their labs had
successfully handled similar cases and had developed expertise
to access these tapes when regular methods fail. ActionFront
offered to review the media and quote the job under the free
evaluation policy. This made it an easy decision to send the
problem tape cartridges to ActionFront.
The recoveries took many hours of lab time and the cost was
accordingly high, however the value of the data was even
higher. The hospital was delighted to regain access to the lost
images and be able to provide the high standard of health care
their staff and patients demanded.
32 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 33
Appendix B: Related References Appendix C: Handling Tips & ESD Precautions
An excellent introduction to the field of data storage can be Mishandling is a leading cause of hard disk drive failure.
found at: Hard Disk Drive Do’s
http://www.usbyte.com/common/HDD.htm#Introduction • Handle a hard disk drive as you would handle an egg.
• Always use ESD* precautions.
SNIA - Storage Networking Industry Association • Handle drives one at a time.
http://www.snia.org • Handle drives only by the sides.
• Pad all hard disk drive work surfaces.
http://www.storagesearch.com/ • Handle failed hard disk drives with the same care as new
drives.
http://searchstorage.techtarget.com/ • Wait 10 seconds after power down before moving to assure
the drive has stopped spinning.
CERT: Computer Emergency Response Team • Eliminate movement of unprotected drives: Use ESD
http://www.cert.org/ packaging (anti-static bag) while moving and minimize the
number of handling steps.
CanCERT: Canadian Computer Emergency Response Team
http://www.cancert.ca/Home/Default.php Hard Disk Drive Don’ts
• Never drop drives.
DRI: Disaster Recovery Institute • Never allow drives to come in contact with hard surfaces.
http://www.dr.org/ • Never stack drives, even in the ESD protective bag.
• Never contact the PCBA with tools or without ESD
DRIE: Disaster Recovery Information Exchange Canada protection.
http://www.drie.org • Never stand drives on end.
Disk Drive Components Susceptible to Handling Damage
Backup and Business Continuity Planning • Heads - Broken, chipped, degraded.
Business continuity planning can be researched and done in- • Disks - Scratched media, head slaps.
house or outsourced from a variety of vendors. There are many • PCB - ESD damage, bent connector pins, broken
backup solutions comprised of various combinations of components.
software and hardware. ActionFront does not recommend one
*ESD (Electrostatic Discharge)
over another.
A familiar form of Electrostatic Discharge, often called “static
We do recommend that you consult your preferred computer electricity”, is the shock we receive after walking across a
consultant or reseller and that you do your own research on carpet. In a technical environment, ESD can be very costly by
the web or elsewhere. harming devices or components. ESD may cause a
For example try some of the following phrases on your favorite catastrophic failure that appears immediately or a latent
search site: failure in which gradual degradation occurs during use,
• “Backup Software” resulting in eventual failure.
• “Business Continuity Plan” ESD Precautions
• “Backup over the Internet” • Computer professionals should purchase ESD wrist straps,
• “Server Backup” floor mats and educate themselves on the ESD precautions.
• “Tape Backup” • A personal user should discharge the static on themselves by
Be sure to seek out references that have backed up and touching a metal object before touching a computer, hard
successfully restored their systems. drive or other component.
• People in very cold or dry areas should be aware that humid
air helps to dissipate electrostatic charges.
34 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 35
Appendix D: • Advice to physically manipulate a problem drive such as
“twisting it quickly”.
Beware DIY Solutions and Products • Misleading information about Windows utilities and
Beware DIY Software! partitions.
DIY (Do-It-Yourself) data recovery software may complicate your The first, basic question of dealing with any media problem is
problems and diminish the prospects of a successful recovery. “What would happen if I lost access to the data forever?”
The object of many DIY fix/doctor/repair programs is to try to While following free advice may resolve the situation, it may
make the drive, file-system or volume usable - not to recover severely compound the problem. Can you afford to take that
existing data. Do not run any program or utility that writes to risk?
the affected media or changes it in any way, if you need your If you are experiencing data loss please read this guide and
data back. consult an expert!
The programs that do recover data are limited to addressing
assumed scenarios, not necessarily your data loss situation with Appendix E:
its unique aspects. In contrast, ActionFront technicians have How to Choose a Data Recovery Company
knowledgeable colleagues with 13 years of expertise to call Find out whom you are dealing with:
upon, as well as proprietary software, a full range of legacy and • Who are the principals of the company?
leading edge hardware and clean rooms available. • What are the backgrounds of key technical staff?
Approximately 70% of single hard drive cases sent to • What is the company’s history?
ActionFront have some form of physical problem; hence the • Can they offer any references?
foundation of the ActionFront recovery process is making a If you are going to trust them with your valuable data, don’t
“mirror” or copy of the media in question and performing all deal with un-named individuals hiding behind an anonymous
subsequent recovery activities on the mirrored copy. As the web site.
media in question may completely fail under repeated use, using
this process increases the chances for a complete recovery and Start out being skeptical! Even if the sales rep sounds
preserves the original media in case further access is required. convincing, that doesn’t mean that their engineers know how
to handle recoveries.
(You may of course purchase an additional drive and some
mirroring software and attempt this process on your own if you Don’t be impressed by unsubstantiated claims of expertise.
have sufficient configuration expertise and can manage the Some competitors falsely claim that the drive manufacturers
stress in the meantime. The time and money invested in “recommend” or “authorize” their services. Call the
mirroring is a prelude to purchasing and running some DIY manufacturers directly or check the manufacturers’ websites.
recovery software.) (See Appendix A).
Free Advice May Prove Costly! Don’t be fooled by exaggerated “success rates”. Any company
There are numerous Internet sites offering advice about data claiming a 90% or 95% success rate is simply lying. Data
recovery and unfortunately, the advice is often just plain wrong! recovery can be a complicated process with inherent physical
Much of the advice pertains to configuration and installation and logistical limitations that determine what can actually be
issues, missing the point that most data loss situations involve done.
the sudden inability to access data involving a previously If you have an unusual hardware or software platform, find out
functioning computer system or backup or the accidental if this company actually has the facilities and expertise “in-
erasure of data or over-writing of data control structures. house” to handle your problem. Just because it’s mentioned in
Installation advice is irrelevant or harmful in these cases. Other their ad doesn’t guarantee anything. Some services handle the
typical errors include: simplest recoveries themselves while out-sourcing most jobs to
• No warning about handling and ESD issues. a larger facility. Once again, ask for references!
• No guidance regarding what sort of noises are acceptable As with any emerging field, let the buyer beware! If your data
versus noises that indicate device failure. Drives that make is important enough to send to a recovery service, make sure
“obvious mechanical fault noises” should not be repeatedly you send it to the right one.
powered on and tested: it just makes them worse.
36 ActionFront Data Recovery Labs 1.800.563.1167 www.actionfront.com 37
