Interview for Upgrade IT 3/20007 magazine

We asked George Sluky from the ELSIN spol. s.r.o.company for useful experiences with data recovery

Can you briefly introduce your company and reveal on what types of data recovery you specialize in?

The Czech-Korean company ELSIN spol. s.r.o. is one of the few in the European market deals with technology-intensive repair of LCD screens, LCD products, and data recovery. When recovering data we use the rich and extensive experiences of our foreign partner. We thus have the same skills and equipment as our partner who is the number 1 in the field of data recovery unit in the Korean market and recovers data from more than 1 000 hard disks per month. We use a clean room for the data recovery, which allows us to perform difficult and long operations.

We are able to recover data from media damaged by software, but especially from hardware damaged disks. Thanks to specialized equipment and unique processes we are able to recover data not only from disks that have damaged external or internal electronics or damaged heads, but also from disks with damaged service area. We are able to access the disk in the manufacturer mode and manipulate with the disk’s service information. Among other things, it allows us to unlock password-protected disks, change the serial number of the drive or delete SMART values.
70% of our orders constitute 2.5 '' drives for laptops and we want to continue to be regarded as an expert in data recovery from these media types. Of course we recover data also from standard 3.5 '' disks, USB flash drives, and other memory cards.
Among our great advantages is the large warehouse with more than ten thousand different types of hard disks, whose parts are used in the recovery processes.

Corporate data often contains highly sensitive information and therefore many companies will hesitate to entrust the data to anyone outside of their own company. Do you provide additional guarantees or "special mode for sensitive data" in these cases?

We always operate with our customers‘ data in the way to prevent any leakage of information. We do not provide information about uploaded medium to other people (our obligation is part of the handover protocol) and if this is not technically necessary (most cases) we do not know the contents of the files either. If a customer requires it, a confidentiality agreement is signed. Our backup of the recovered data is deleted immediately after confirmation of receipt from the client.

A lot of data is nowadays present in an encrypted form - either individually or as a whole section – doesn’t such encryption prevent data recovery in some cases?

Yes, it definitely does. Successful recovery is in these cases determined by the way an encryption software can deal with the unreadable part of disk. If the drive is encrypted and some of the sectors is unreadable, it is possible that the encryption software will not be able to recognize data structures and therefore no files can be recovered. In case of non-encrypted disk, almost all of data can be recovered.

Which type of defects fo you encounter most often? And what is their probability of recovery?

One of the most common types of defects encountered is the destruction of disk byovervoltage. Passage of overvoltage destroys the electronic parts of the drive (external and internal electronics). If writing was in action at the time of the accident electronic damage is made also to the service area of the disk (for example SMART values). Thanks to special equipment and unique procedures the chances of data recovery from these disks is very high.

In case of software error or accidental deletion of data, the key recommendations are generally known - do not write additional data, disconnect the medium, etc. – However, what steps should be taken in case of physical damage? Does time in which your receive the medium play a role?

In case of hardware damage, this rule applieseven more heavily. In some cases further switch-on leads to complete destruction of the drive. In special cases (eg. Contamination by a liquid) is the speed of delivery to a data recovery company is critical.

How does the standard procedure (diagnosis and subsequent recovery) at your company look like for a damaged hard disk (assuming the most common type of fault)?

After receiving the disk from the client (personally in our offices or by courier services) the disk is subjected to an entrance analysis which determinesthe type of damage, estimates the chances of recoveryand determines the price. The analysis will in most cases take place on the same day the order was received.The customer is informed of the results of the analysis and confirms the price. This is followed by recovery and submission of data. If the customer does not wish to continue recovery after the analysis, or if the data cannot be recovered, we return the medium back to the client free of charge.

What media are in your opinion the most susceptible to damage and therefore you do not recommend using them for backing up data?

It is not possible to determine which media type or brand is more prone to damage. It depends on many factors. Some typesare more resistant to impact, others to temperature, ambient humidity, dust. It is important to perform backups on a regular basis. As a user with a perspective need of data recoveryI would opt for widely available disks for my data since there is no problem with the availability of spare parts for these disks. Every few years, I would also replace even a functional disk with a newer model.

What about the traditionally used media for archivation - DVD (or CD) and data tapes – what is their life expectancy and rescue prospects?

Currently the market lacks a long-term statistics on the durability of CD / DVD. Some sources indicate that a safe time is just five years. Copying over the data after several years to a new media also brings the advantage of constant updating of registration formats, which vary over time and it may not be easy to gain access to the original format.

Finally, the traditional question of "a funny story from the set": what is the most quaint way you used to recover data from damaged media in your career?

Most of these curious case of damage relate to USB flash drives. People often carry them at all times, so the chances of driving over the flash drives with a car or getting chewed by the neighbor’s dog areincreased. In both cases, data recovery was carried out successfully.