|
Apr 24
2009
|
Recovering files from a failed hard drivePosted by: Eusebio Echevarria on Apr 24, 2009 |
|
I received a phone call from a friend who uses a Macbook and they asked me if it is bad when you turn the Mac on if nothing appears on the screen except a folder showing a question mark. After a few minutes of research and a few probing questions I found that the hard drive was making the dreaded clicking noise. It was apparent that the hard drive in the Macbook had died!
In this particular model Macbook the hard drive was accessible by removing the battery then unscrewing a metal bracket and simply pulling the drive out. Once I had the drive out I attached it to my laptop using a SATA to USB adaptor and booted with Knoppix to see if the drive was accessible at all. The drive was not recognised at first so I tried a full SATA connection in my main computer. I could now see the drive in Vista under Storage Manager but it would not mount at all and it just clicked loudly. Usually this means that the heads are stuck or damaged and at worse they have started to scratch the platter.
I investigated the clicking noise by opening the drive; after removing six screws around the outside and one hidden under a sticker the metal case opened and I plugged the drive into the power. The heads were indeed jammed and just danced around the metallic platter; thankfully they were not scratching it at all so I decided the best course of action would be to replace the drive heads. The best way to do this is to find a drive which has the same model number, similar date of manufacture and serial number, then pillage parts from there.
To recover the data and have a fully working Macbook again I would need to get two new drives, one as similar as possible to the damaged drive and another of similar size preferably with Leopard or Tiger pre-installed as it would be folly to use the repaired drive again as the main system drive. The second of these was easy to find on Ebay for under £40, the first I just got really lucky and found on Ebay as well. I have pictured two drives below, the one on the left is the original damaged drive and the one on the right is the drive purchased for spares. If you look closely at the photos you can see the drives are similar in date of manufacture and serial numbers.

My original plan of action was to swap the read/write heads over between the drives but as these drives only use one platter and the read/write heads sit off the platters in a plastic resting spot I decided to swap the platters over, this required the least amount of unscrewing and fiddly work. To do this bit you will need a small Phillips screwdriver to open the drive then a T6x65mn screwdriver to unscrew the platter.

The platter overlapped the plastic resting spot a bit so this needed to be unscrewed and moved a tiny bit being careful that the read/write heads remain in their resting location. Once this was done I unscrewed the platter construction by using the torx screwdriver in the middle and a standard screwdriver to sit in one of the holes to stop the platter spinning whilst unscrewing. Once loose I lifted it out being careful not to scratch the surface or mark it in any way. Working quickly was the key here so that the surface was exposed to the air for a minimal amount of time. I had already removed the platter in the new drive so it was ready for the old platter to be dropped in and tightened into place.

Now for the true test, before plugging the drive back into the PC I powered it up and had a listen.....no clicking noise! So it is either completely dead or working. I plugged the drive back into my main computer and refreshed my devices in device manager and to my delight a Fujitsu drive appeared. I already had a program called MacDrive installed, which is handy if you want to read data from EFS partitions in XP/Vista, and this popped up asking if I wished to explore the volume. The next window showed me the standard OSX folder structure for a few seconds before my first blue screen of death! Well at least the data was there.
After my machine reloaded I tried viewing the drive in explorer again to be greeted by another BSOD. After a cup of tea I returned to a freshly booted machine and was using an ISO burning application to burn some imaging software to read the drive at bit level and recover that way when through curiosity I tried browsing the recovered drive through the program's built in file explorer and was able to drill down through all the OSX folder structure seeing all the individual files. Vista it seems was either trying to display thumbnails or doing some indexing which hit a bad sector and blue screened the computer, the 3rd party file explorer did no such thing. I launched xplorer2 and was able to browse the drive there also. I tried just dragging the entire user folder from the OSX partition to a backup location on my computer but after a gig or so had copied my computer blue screened again.
I gradually went through the Music, Documents and Pictures folders copying full folders at first then drilling down further when certain areas would cause my computer to crash. Sometimes it was necessary to just move a few files at a time out of a directory and make notes as to what had been moved to determine which files were causing the crash. After 30-40 crashes and around ten hours I managed to recover about 20GB of information which was pretty much everything of use. As this was OSX the photos were stored via iPhoto so I only recovered the "Original" folder as the modified and thumbnail folders were no use without the indexing.
I put the new 80GB drive into the computer and loaded up Leopard entering all the user information, within 15 minutes the Macbook was up and running and I was copying the old information back across. I ran updates and then added all the recovered music back into the iTunes folder. The photos I left for my friend to sort out who was very happy with the results considering they had resigned themselves to having lost several years of data. I gave a gentle reminder about backups as well.
So there you have it, data recovery on a shoe-string budget. As long as the person already thinks they have lost everything and the drive doesn't have multi-platters (they get very complicated as the platters are delicately machine balanced) then you can more than likely recover the data yourself and save £1500 for a holiday. The above process would be identical for PC based hardware as it was for the Apple hardware. If the data is very important, like your company's accounts for the last 20 years, then I would suggest a professional data recovery company.
EE






