Data Emergency GuideIT Professional edition

RecoveryErasureMigrationForensicseDiscovery

Dat

a R

ecov

ery

Table of ContentsIntroduction 3Examples of Data Emergencies 3Server Data Loss Scenarios 4Situation1:FailureofasingledriveinaRAID5server 4/5Situation2:FailureofRAID5server 5Situation3:Serverupgradegoeswrong 6Situation4:IntermittentcomponentfailureinaRAID5server 6Situation5:SQL,Oracle,DB2databasecorruption 7Situation6:“Crisisinprogress”7/8Recognising a Data Loss Situation 9 “How important is your data?” 11Data Recovery Process: What to do first? 12WhatNOTtodo 12Whattodo12/13Our Data Recovery Process 16Initialinquiryandconsultationprocess 16Therecoveryprocessstartswithafreeevaluation 16Fixingphysicalproblems 16Obtainingamirrorimage(makingacopyofthedata) 16Fixinglogicalproblems:corruptedfilesorfilesystems 17Trackingthecase 17Costsvs.value 17Economyservicefeatures 18Priorityservicefeatures 18Priorityservicestep-by-stepworkflow18/19Criticalresponseservice 19Appendix A: What is Data Recovery? 20Appendix B: What to ask before calling in a Data Recovery Service?21/22Appendix C: Case Studies on Mission-Critical Recoveries23/24Appendix D: Handling Tips & ESD Precautions 25KeybenefitsofSeagateRecoveryServices 26Whattodonext? 27

Copyright©2007.SeagateTechnologyLCC.Allrightsreserved.PrintedintheNetherlands.

Seagate,SeagateTechnologyandtheWavelogoareregisteredtrademarksofSeagateTechnologyLCC.Otherproduct

namesareeithertrademarksorregisteredtrademarksoftheirowners.

Seagatereservestherighttochange,withoutnotice,productofferingsorspecifications.May2007.

3

IntroductionThisguideisintendedtohelpyourecognise,react

appropriatelytoandresolvedatalossemergencies

involvingservers,backupsand/oranymission-critical

computersystemorITfacility.

TheData Emergency Guide:ITProfessionaledition

willbeofmostusetotechnicalsupportpersonnel,

ITmanagersandtoanyonewhoexperiencessudden

datalossfromacomputersystemorbackupwhich

hadbeenworkingupuntilthatpointorhastotake

actionafterdataisaccidentallydeletedordatacontrol

structuresareoverwritten.

Examples of data emergencies• Amulti-driveRAIDservercrashesasaresultofwhichdata

isnolongerbeingsenttothecorporatenetwork(NAS,DAS

orSANarchitectures).

• Asetofmedicalimagesstoredonadigitaltapecartridge

cannolongerberestoredtoothermedia.

• Ahardware,O/Sorapplicationsoftwareupgradefails.

• Restorefails:anattempttorecoverlostdatanotonlyfails

butrenderstheentiresystemunusable.

Adataemergencyusuallystartswithoneofthe

followingsituations:

• Itsuddenlybecomesimpossibletoaccessanydatafrom

acomputersystemorbackupwhichhadbeenworkingup

untilthatpoint.

• Dataisaccidentallydeletedordatacontrolstructures

areoverwritten.

• Databecomescorruptedorinaccessibleasaresultofdamage

tophysicalmediaoroperatingsystemproblems.

4

Server data loss scenariosDatastoragesystemswhicharemaintainedproperlyaregenerally

reliable,fault-tolerantandwell-managedbyexperienced

operatorswhocarryouttheirroutinetasksefficiently.When

thesesystemsdofail,itisarareoccurrenceandoftenthe

firsttimethattheoperatorisfacedwiththesecircumstances.

Understandably,takingthenecessaryactionmaybebeyond

thetrainingandexperienceofmostofthetechnicalcommunity,

letalonetheowner/operatorordepartmentmanagerwhohas

todoubleasthesystemsadministrator.Bothmanagersand

technicians,especiallythosewithnumerousresponsibilities,may

makemistakeswheninunfamiliarterritory.Ourprofessionaldata

recoveryspecialistsdealwiththesesituationsonadailybasis

andaresuitablyqualifiedtoaddresssuchproblems.

Aproperdiagnosisoftheproblemsisthekeytosuccessful

managementofdatalossemergencies.Whoisqualifiedto

diagnoseyoursituation?Didyouinstallthesystemanddo

youpossesstheknowledgeandexperiencetodiagnosethe

problem?Ifsomeoneelsesetupthesystem,isitbettertocall

themorotheroutsideexperts?Aproperdiagnosiswillthen

dictatewhetherornotyoushould:

• Callinourdatarecoveryspecialistsor

• Initiateaself-fix(assumingthatanadequatebackupfacility

isavailable).

Shouldyouexperienceadataemergencyinthefuture,youmay

wellrecogniseyoursituationasbeingsimilartooneofthese

scenarios.Properdiagnosisandfollow-upcansaveyourdata

andperhapsmuchmore.

Situation 1: Failure of a single drive in a RAID 5 server• ThefailureofasingledrivehasbeendetectedinaRAID5server

buttheserverisstilloperatingandsendingdatatousers.

• Theservermayormaynothaveotherproblemsbesides

asinglefaileddrive.Theoperatorisunabletocarryouta

completediagnosis.

• Relyingonthe“hotfix”capabilitiesthoughttobeinherentin

thesystem,itistemptingfortheoperatortoreplacethefailed

drive“onthefly”thussparingusersanydowntime.

• Yieldingtothetemptation,theoperatorattemptsthehotfix.

-Ifsuccessful,theoperatorwillnotberegardedasaheroas

userswillnothavebeenaffectedbytheproblem.

- Ifunsuccessful,theoperatormaybecometheveryvisible

villainratherthantheinvisibleheroandheldresponsiblefor

aprolongedperiodofserverdowntimeandalltherelated

problems.

5

• Inthissituation,thefollowingstepsshouldbetaken:

1. Intakingthepropercourseofaction,theveryfirstthing

whichshouldbedoneistoestablishwhetherornota

completeintegralbackupofthecurrentdataisviable,

evenifthiswouldinvolveinconveniencingusers.Atthis

point,acompletebackupwouldbeidealalthoughan

incrementalbackupmaysufficeifatriedandtested

restoreprocedureisinplacebasedonaseriesof

completeandincrementalbackups.

2. Secondly,restorethebackuptothealternate

“contingency”serverandmakesurethatitisoperational

incaseitisneeded.

3. Onceconfidentthatthecontingencyinfrastructureisready

foruseifneeded,theoperatorcanattempttocarryouta

hotfixorotherproceduresinordertoaddressthesituation.

Situation 2: Failure of RAID 5 server• Thefailureofmultipledrivesoracontrollerhasoccurredina

RAID5serverwhichhasrenderedtheserverinaccessible.

• Noalternativeserverisavailableornoadequatebackupis

availabletobeloadedonthealternativeserver.

• Asaresult,youarefacedwithafully-fledgeddataemergency.

• Manyoperatorsfacedwiththissituationwillattempttocarry

outaquickfixbytryingsomecombinationinvolvingreplacing

thefailedcomponentsandreconfiguringthesysteminorder

torebuildthefailedarray.Undertheseconditions,thereare

twopossibleoutcomes:

- Afunctioningserveronwhichallormostofitsdatais

missing.Atthispoint,mostofthedataandfilestructures

arelikelytohavebeenoverwritten,makingrecoveryvery

difficultorimpossible.

- Anon-functioningserveranddimmerprospectsfor

recovery.Atthispoint,mostofthedataandfilestructures

arelikelytohavebeenoverwritten,makingrecoveryvery

difficultorimpossible.

• Theappropriatethingtodowhenfacedwithsuchconditions

istocallinprofessionaldatarecoveryspecialists.

• Aprofessionaldatarecoveryspecialistwillstartbymaking

amirrorimageofthedataoneachdiscretetypeofmedia

involved,includinganyfaileddrives,whichmayrequirethe

performanceofhighlyspecialiseddatarecoverytechniquesin

alabfacility.Then,workingfromcopiesandusingproprietary

programsandmethods,thisspecialistwillrebuildthedataset

tothepointwhereitcanbetransferredtoaworkingserver.

6

Situation 3: Server upgrade goes wrong• Installingnewapplicationsoftware,anewoperatingsystem

oradditionalornewhardwareisoftenreferredtoasa

serverupgrade.

• Thisisnotaneverydayeventandtheoperatormaylack

experienceinperformingtheprocess,notunderstanding,

forexample,thatmanyupgradesrequiredatatobereinitialised

-aprocesswhichbynaturedestroystheexistingdataor

filesystem.

• Duringtheseupgrades,a“dialoguebox”willappearcontaining

aseriesofquestionswhichtheoperatormayanswerwithout

fullyrealisingthepotentialimpactofthestepsinvolved.

Forexample,theoperatormaystartthedatareinitialisation

processafterawarninghasbeenmisunderstoodorignored.

Theseandotherproblemscanoccurduringupgradesand

rendertheserverinaccessible.

• Needtoupgradeyourserver?

-Neverinitiateanupgradewithoutfirstmakingsurethatyou

haveacompleteusablebackup.Thebestwaytodothisisto

restoreyourbackuptoanalternativeserversothatyouhave

afullyfunctionalredundantserverpopulatedwithcurrentdata.

Situation 4: Intermittent component failure in a RAID 5 server• Theelectricalandmechanicalproblemswhichaffectmedia

andtheirelectroniccomponentscanbeintermittent.While

thiscancomplicatediagnosis,itmayalsoprovidean

opportunitytocreateaneffectivebackupduringaninterval

whiletheserverisfunctioningproperly.

• Operatorsmaycarryouta“falsefix”byreplacinga

functioningcomponentinsteadofafailedcomponentafter

misinterpretingwarningsgeneratedbytheserver.

• Someserversareconfiguredtoself-initiatearebuildunder

certaincircumstances,potentiallyoverwritingotherwise

validmedia.

• Beforeaddressingasituationinwhichintermittentfailureis

involved,wewouldurgeyouonceagainto:

- Makesureyouhaveaneffectivebackup.

- Checkanddouble-checkyourdiagnosis.

7

Situation 5: SQL, Oracle, DB2 database corruption • AservercrashesorexperiencesO/Sproblems.

• Tableshavebeendroppedorcorruptionhasoccurredwithin

theactualdatabase.

• TheDBA(DatabaseAdministrator)hasahighlevelofexpertise

regardingdatabasesandknowssomedatabase-specific

recoverytechniquesbutmaylackdetailedknowledgeof

datastorageplatforms.

• Theymaytrytoreinitialisethedatabase,makingthe

applicationfunctionalbutlosingalltheirdataintheprocess.

• Anotherfixwhichmaybeattemptedistousethetransaction

logsto“rollback”thedatabasetoa“knowngoodstate”.

• Thiscanbeagoodwaytosolvetheproblemif:

- thetransactionlogshavebeenexaminedanddeemed

tobegood;

- theoperationisattemptedonanalternativeserverusinga

copyoftheproblemdata.

• Thepreferredmethodisoftentotrytheroll-backonthe

primaryserverinordertosavetimesincerestoringtoan

alternativeservercanbeaverylengthyprocess.

• Ifthecorruptionisaresultofphysicaldriveproblemswhich

havenotbeenaddressed,thenaroll-backontheproblem

serverwillonlycompoundtheproblemresultinginthe

furtherdegradationofthesystemandamorecostlydata

recoveryoperation.

Situation 6: “Crisis in progress” SeagateRecoveryServicesisoftencontactedbyorganisations

whichareinthemidstofacrisis.Situationswillhavesomeorall

ofthefollowingcharacteristics:

• Theserverhaslostdataorbecomeinaccessibletousers.

• Documentationisoutofdate,sketchyandwrongorsimply

doesnotexistandusershavealowlevelofknowledgeand

apoorunderstandingofthesystem.

• Backupsareavailablebuttheprocessofrestoringthemis

misunderstoodor,whatisevenworse,backupsareoutof

dateordonotexist.

• Thedepartmentmanagerorin-housetechnicalteamshave

triedtocarryoutfixes.

• 3rdpartytechnicians(fromthemaintenanceservice-provider

orthevendor)havebeencalledinandhavetriedtorectifythe

situationbyperformingadditionaloperationsandattemptingto

carryoutfixes.

• Thevariousfixesattemptedtypicallyinvolvereplacing

suspectcomponentsand/orrestoringbackupstotheoriginal

(corrupted)media.

• Theserverhasnotbeenfixedandmayhavebeenfurther

degradedsincethesituationstarted.

8

Whilethedetailsofindividualsituationsmaydiffer,theywillall

havethefollowingincommon:

• Lackofadequatebackupand/ornotriedandtested

restoreprocedure.

• Lackofdocumentationorknowledgeofthesystem

configurationandallthevarioushardware,softwareand

O/Slayersandhowtheyworktogether.

Professionaldatarecoveryspecialistswillstartanyrecovery

bymirroringeachdiscretemediainvolved.Knowingthatthey

canalwaysrevertbacktothesamestartingpoint,thelack

ofdocumentationcanthenbesafelyovercomebymeansof

analysisandexperimentationbasedonstrongknowledge

andexperienceofdatastorage.

9

Recognising a data loss situationAdatalosssituationisusuallycharacterisedbythesudden

inabilitytoaccessdatafromacomputersystemorbackup

whichhadbeenworkingupuntilthatpointortheneedtotake

actionafterdataisaccidentallydeletedordatacontrolstructures

areoverwritten.Thissectionoutlinesthemajorsymptomsof

dataloss.

Server data loss symptoms/issues • Symptomsrelatingtophysicalproblems

- Aserversuddenlycrashesduringoperationorwhen

bootingup.

- Tickingorgrindingnoisescomingfromoneofthehard

driveswhenbootinguportryingtoaccessfiles.

Thissymptommaybefollowedbyactualdataaccess

problemsasthedriveutilisessparesectors.

- Failureofasingleharddrive.

- Failureofmultipledrives.

- RAIDcontrolleralarmflashing.

- FailureoftheRAIDcontrollerrenderingdrivesinaccessible.

- Intermittentdrivefailureresultinginconfigurationcorruption.

- Visiblefireorwaterdamage.

• Symptomsrelatingtosoft(logical)problems

- Serverwillnotrebootaftera“routine”upgradetooperating

systemorapplications.

- Bootdrivefilesystemproblemsinvolvingthelossofcritical

configurationdata.

- Serverstoragesystemsregistryconfigurationlost/overwritten.

- Accidentaldeletionofdata.

- Accidentalreformattingofpartitions.

- AccidentalreconfigurationofRAIDdrives.

- Accidentalreplacementofharddrive.

• Soft(logical)orphysicalsymptoms(botharepossible)

- Serverrebootsbutcannotaccessoreven“see”

attachedstorage.

- Restoreprocessfailsorisprematurelyaborted.

- Applicationsareunabletorunorloaddata.

- Extremedegradationofapplicationperformance.

- Folderswhichshouldbefulloffilesopenbutappearempty.

- Inaccessibledrivesandpartitions.

- Corrupteddata.

10

Tape media data loss symptoms/issues• Corruptedtapeheaders:

- Tapeappearsemptyofdata(blank)butshouldbefull.

- Tapeshouldbefullbutcontainsverylittledata.

- Thetapeisinvisibleorinaccessibletotherestoreprogram.

• Accidentalreformattingorerasureoftape.

• Tapehasbecomeunspooledinsidethecartridge.

• Obviousphysicaldamage.

- Tapemediastretched,snappedorsplit.

- Visiblefireorwaterdamage.

• Mediasurfacecontaminationanddamage.

- Tapecannotbereadpastaworn-outorcontaminatedarea.

• Problemswithtapebackupsoftwareinvolvingcorrupt

catalogueinformationorcorruptdatacontrolstructures.

Optical media • Sectorreaderrorspreventingaccess.

• Corruptedfilesystemstructuresappearemptyorinvalid

(e.g.FAT,directories,partitionentries).

• Auto-loadersandjukeboxes.

Bothopticalandtapemedialibrariesormulti-volumescan

bemaintainedbymeansofautomation.Inordertosecurean

archivecopy,abackupcopytobekeptoffsiteorforother

reasons,techniciansneedtocarryoutrotationsinorderto

cyclethemediainandoutoftheautoloaders.Asthesecan

becomplexsystems,anyerrorduringrotationcancausedata

tobeoverwritten.

Tapemediacanoccasionallysufferphysicaldamagedueto

mechanicalproblemsaffectingtapedrives.Thedamagecan

beincreasedbyautomation:arobottryingtoremovesuch

atapefromadrivewillnotrecognisetheproblemwhereas

ahumanoperatorhasabetterchanceofremovingthetape

withoutcausingfurtherdamage.

Corrupted/damaged databases • Thedatabaseismarkedas“suspect”,preventingaccess,

andcannotberestoredtoafunctionalstate.

• Tableshavebeen“dropped”orrecreated.

• Backupfilesarenotrecognisedbythedatabaseengine.

• Databasefileshavebeenaccidentallyoverwritten.

• Recordshavebeenaccidentallydeleted.

• Databasefilesorrecordshavebeencorrupted.

• Individualdatapageshavebeendamaged.

11

Experiencingadataemergency?Themostimportantquestion

toaskyourselforyourusersis:

“How important is your data?”Theanswertothisquestionwillhelpyouchooseanappropriate

courseofaction.

1. Mydataisbusiness-critical:tomostpeopleexperiencing

adatalossemergency,restoringapplicationdataisjustas

importantasmakingthesystemoperationalagain,i.e.the

systemandthedatatogetherdefinean“operationalsystem”.

Ifdataisimportant,thenfollowthefirstprincipleofdata

recoveryto“DONOHARM”whenyouaddressyour

situationandrememberthatyoucancallindatarecovery

specialiststohelp.

2.MydataisNOTbusiness-critical:insomecircumstances,

theprioritywillbetogetsystemsoperationalagainregardless

ofthestatusoftheapplicationdata.Ifthisisthecase,youare

notexperiencingatruedataemergency.Youwillprobably

beabletotreatthesituationasabrandnewinstallationand

usethesamehumanandITresourceswhoinitiallysetup

andconfiguredtheinstallation.

12

Data recovery process: What to do first?What NOT to do:Ifyouarefacedwithadatalosssituation,whatNOTtodois

veryimportant!

• Neverrunaprogramorutilitywhichwritestooraltersthe

problemmediainanyway.Ifthesystemshowssymptomsofa

physicallydamageddeviceorsymptomsofdatacorruption:

- Neverrestoreabackup.

- NeverreinstallsoftwareoranO/S.

- Donotreinitialisethemediaordatabase.

- Donotattempttorollbackthedatabasetoaknown

goodstate.

• Donotallowanyoneelsetowritetooralterproblemmedia

includingcompaniesoffering“remoterecoveryservices”.If

forsomereasonyourrestoredoesnotwork,youmayhave

createdasituationwherepotentialrecoveryfromtheoriginal

mediamaynolongerbeaviableoption.

• Donotbootupadevicewhichhasobviousphysicaldamage.

• Donotbootupadevicewhichhasshownsymptomsof

physicalfailure.Forexample,drivesobviouslymakingnoises

duetoamechanicalfault,suchastickingorgrinding,should

notberepeatedlybootedupandtestedasitwilljustmake

themworse.

• Activatethewrite-protectswitchortabonanyremovable

mediasuchastapecartridgesandfloppydisks.(Alotofgood

backupsareoverwrittenduringacrisis).

• Donotattempttoremoveadamagedorunspooledtape

fromadriveunlessyouhavethespecialistknowledgeand

equipmenttodoso.

What to do:

Review, record and stay calmWhenfacedwithdataloss,stopandreviewthesituation.Distress

andevenpanicaretypicalreactionsunderthecircumstances

sotheprocessofreviewingandwritingdownasynopsisofthe

situationhasthedualpurposeofpreparingforrecoveryand

inducingcalm.

Resist the pressure to carry out an instant fixIfyouhave“recognisedadatalosssituation”,stopandanalyse

thesituationratherthanattempttofixitimmediately.Youmaybe

underconsiderablepressuretoimmediatelyresolvethesituation

fromco-workers,yourbossorevenyourowndeadlines.While

aquickfixmayprovesuccessful,ifitisnot,thenyourattempts

mayactuallyincreasethedamageandgreatlyreducethe

prospectsofsuccessfuldatarecovery.

13

Beware of DIY solutions and products and remote recovery servicesTherearenumerouswebsitesofferingadviceondatarecovery

andvendorsofferingDIY(Do-It-Yourself)softwaresolutions.

Unfortunately,theadviceisoftenjustcompletelywrongand

DIYsoftwareorremoterecoveryservicesmaycomplicateyour

problemsanddiminishtheprospectsofsuccessfulrecovery

shouldthesesoftwarerecoveryattemptsfail.Youshouldalso

notethatthereisnosoftwareintheworldwhichcanfixstorage

mediawithphysicaldefects.

Set up an alternative systemConsultyourcompany’ssystemsdocumentationinorderto

configureanothercomputer/servertotemporarilyreplacethe

problemunit.Restorewhateverbackupsareavailableontothis

unitandreconfigureitasnecessaryinordertoenableproductive

worktocontinue.Ofcourse,themoretimethathasbeenspent

oncontingencyplanningbeforethedataloss,thelesstimeitwill

nowtaketosetupanalternativesystem.

Disk drive handling and ESD (Electrostatic Discharge) precautionsBeforehandlingyourcomputerandespeciallybeforetouching

orhandlingthemediaitself,bewareofcreatingstaticelectrical

discharges.(SeeappendixC).

Call Seagate Recovery Services data recovery labs Ourdatarecoveryconsultantswillanswerallyourquestionsand

helpyoutodeterminehowtoaddressyoursituation.Ifdataloss

isconfirmed,youwillbegivenadviceonhowtosendinyour

media,aguaranteedturn-aroundtimeforthefreeevaluation,

whatyoucanexpecttobechargedandwhatfactorsmayaffect

thespeedwithwhichwewillbeabletorecoveryourdata.

14

Data Emergency WorksheetThefollowingpageshavebeendesignedasaworkbooktohelp

youpreparefortheactiontobetakentoensuresuccessful

recoveryafteradataemergency.

1. When was the system last running properly?

2 a) What operator activities have been carried out since then?

2 b) What symptoms of problems have arisen since then?

3. Are there any specific error messages?

4 a) Backup history: when was the last “complete system backup” carried out?

4 b) Backup history: provide dates and details of “incremental backups”.

4 c) Backup history: provide dates and details of partial backups (ex: selected data files).

5. Are there any specific databases and directories which are important to you?

15

6. List the details of your configuration such as:

6a) Operating system name and version (Windows NT, Novell, Unix version, etc).

6 b) Provide details of the system set-up, partitions and storage configuration, if any.

6c) Have you installed any application software packages?

Names Versions

Are the original CDs and

documentation available?

6d) What login passwords are required?

7a) Do you have a contingency plan?

7b) What resources are available to you for implementing this plan?

7c) Can you run your applications on a “spare” server?

7d) Can you attempt to restore your backup to the spare server and leave the problem unit alone for now?

8) Are you or your technicians qualified to make a proper diagnosis of the problem?

16

Our data recovery processInitial inquiry and consultation processTheSeagateRecoveryServicesCSR(CustomerService

Representative)willfollowthemedicaloathto“donoharm”and

willendeavourtoanalyse,preserveandstabilisethecurrent

situation.Keepingtheusuallydistressedcustomercalm,theywill

seekanswerstothequestionslistedaboveinordertofullygrasp

thesituationathand.ASeagateRecoveryServicesCSRwillbe

abletoconfirmthatyouhaveadatalosssituationwhichtheycan

helpyouwith.

Onceadatalosssituationhasbeenconfirmed,youwilleither

sendtheproblemmediatothenearestSeagateRecovery

Serviceslaborarrangeforonsite(criticalresponse)serviceif

required.

Ifpossible,werecommendremovingthemediafromthecomputer

beforesendingit.Bewareofcreatinganelectrostaticdischarge

(ESD-seeAppendixC)whilehandlingyourmedia.Visitthe

SeagateRecoveryServiceswebsite(services.seagate.com)for

moreinformationonpackaging.

The recovery process starts with a free evaluationAftercarefullyinspectingtheproblemmediaandreviewingallthe

informationavailableonthecase,theSeagateRecoveryServices

technicianswillprovidetheCSRwithafulldiagnosticreport.The

CSRwillthenprovidethecustomerwithadefinitivequote.The

diagnosiswillbecarriedoutandthequoteprovidedatnocostto

thecustomer.

Fixing physical problemsApproximately70%ofcaseshavesomesignofphysicalfailure.If

thisissevere,some(temporary)hardwarefixesmayneedtobe

carriedoutevenbeforethediagnosiscanbecompleted.These

wouldinclude:

• A“boardswap”wherebyadefectivePCB(printedcircuitboard)

onthedrivewillbereplacedwithonewhichworks.

• A“headtransplant”wherebyadefectiveread/writeheadonthe

drivewillbereplacedwithonewhichworks.

• A“platterormotortransplant”forcertainmodels.

Obtaining a mirror image (making a copy of the data)Astheproblemmediamayfailcompletelyafterrepeateduse,a

“mirroring”process(i.e.makingaspecialcopyofthedatafromthe

problemmedia)isthefirstpriorityduringthediagnosticphase.In

mostcases,allsubsequentrecoveryactivitieswillbecarriedout

onthemirroredcopy.

17

Fixing logical problems: corrupted files or file systemsThenextstepisthelogicalretrievalofdata.Ourprogrammers

workwiththemirroredcopyofthedataanduseproprietary

softwareprogramstofixcorruptedfilesandfilesystemsand

putcorruptedfilesbacktogetherwhilefocussingonthe

customer’spriorities.

Tracking the caseOurweb-based,online,proprietary“JobTrack”systemforms

the“centralnervoussystem”oftheSeagateRecoveryServices

process.JobTrackrecordsandpublishestimelineandother

commitmentstoourcustomersbecausekeepingpromisesisan

integralpartoftheSeagateRecoveryServicesbusinessmodel.

Customersusetheircasenumberandaprivatepasswordtogain

accesstotheJobTracksystemviatheSeagateRecoveryServices

websiteandcantrackthestep-by-stepprocesstorecovertheir

mediaandreviewrelatedquotesandinvoicesthemselves.

OurstaffmembersalsouseJobTracktodocumentandmanage

ourworkflowprocess.ItismaintainedbySeagateRecovery

Servicesstaffatallourlocationsandisaprimarytoolwhich

isusedtoenforceISO9001:2000complianceandprovide

extraordinarylevelsofcustomerservice.Itisanintegrated

systemservingalldepartmentsatalllocationswhilemaximising

theefficientuseofresources.

Costs vs. value• SeagateRecoveryServicescandeterminethecostofrecovery.

SeagateRecoveryServices’ratesfordatarecoveryarebased

onanumberoffactors:

- thecomplexityoftheproblem;

- theamountoflabourinvolved;

- theamountoflabtimeandotherresourcesrequired;

- theavailability(orscarcity)ofparts.

• Onlythe“owner”ofthedatareallyknowsthevalueofthedata.

• SeagateRecoveryServiceswillprovideafirmquotedetailing

theexpectedtimeframeandoutcomeoftherecovery.Withthis

tohand,thecustomercandecide:

- whetherornotthevalueofthedataisgreaterthanthe

costofrecovery;

- whetherornotthecostofrecoveryismorethanthecostof

inputting/recreatingthedatamanually.

• SeagateRecoveryServicescustomershavethefinalsayon

whetherornottherecoverywassuccessful.

18

SeagateRecoveryServicesprovidesthreedistinctlevelsof

service:Economy,PriorityandCriticalResponse.

Economy service features• Thislevelofservicemeetsnormalrequirementsandfits

thebudgetavailabletomostcustomersofSeagate

RecoveryServices.

• In-labservice.

• Freeevaluation.

• Fastturn-aroundofevaluationsandrecoveries.

• Nofiles=nocharge.

• Dataguarantee:“Ifanacceptedrecoveryisnotcarriedoutas

promised,SeagateRecoveryServicesdatarecoverylabswill,

atitsoption,attempttorectifytherecoveryorrefundallorpart

oftherecoveryfeespaid.”

Priority service features• Thislevelofservicemeetstherequirementforurgencyand

fitsthebudgetavailabletomostcustomersofSeagate

RecoveryServices.

• In-labservice.

• Freeevaluation.

• Fastturn-aroundofevaluationsandrecoveries.

• Nofiles=nocharge.

• Dataguarantee:“Ifanacceptedrecoveryisnotcarriedoutas

promised,SeagateRecoveryServicesdatarecoverylabswill,

atitsoption,attempttorectifytherecoveryorrefundallorpart

oftherecoveryfeespaid.”

Priority service step-by-step workflow• PriorityservicemeansthatSeagateRecoveryServicesCSRs

andlabpersonnelwilldevotetheirfullattentiontoeachjobright

fromthefirstphonecallfromthe(usually)distressedcustomer.

• Wetrackincomingcasestomakesurethattheyarriveontime.

• Uponreceiptofthecustomer’smedia,theSeagateRecovery

ServicesCSRwillimmediatelyinformthecustomeroftheircase

numberandpasswordandconfirmthattheirjobhasarrivedand

thatworkhasalreadybegunaspartofourevaluationprocess.

• Themethodofcommunicationused,basedoncustomer

preference,maybebytelephone,e-mail,faxor,ofcourse,our

web-basedonline“JobTrack”systemwhichisavailable24hours

aday,7daysaweek.

• Theresultsoftheinitialevaluationwillbecommunicatedassoon

astheyareavailable,oftenwithinafewhoursofreceipt.

• Allcustomerswillbecontactedregardingthestatusoftheirjob

within10workinghours.

• Ourcustomerserviceprocessinvolvesintensecommunication

betweenthelab,theCSRandthecustomerandisbasedon

yearsofsuccessfulretrievaloflostdata.

19

• Eachcaseisuniqueandwillsometimesrequireseveralcyclesof

questionsandanswers(Q&A)beforeweareabletopresentthe

customerwithaquote.

• Afterthecustomerhasapprovedthequote,thelabwillproceed

tothenextstage.Thiswillinvolveproducingalistofthefilesthat

canbefound,theconditionofthefilesandanyotherpertinent

information.TheCSRwillthenconfirmtothecustomerthatwe

haveindeedfoundthedatatheyneedandarewillingtopayfor.

Withthisconfirmationtohand,wewillthenproceedwiththe

finalstagesoftherecovery.

• Wewillpresentasummaryoftheoutcometothecustomer

andthensecurepaymentpriortoshippingthedatabacktothe

customeronthereturnmediaoftheirchoice.

• WhetherthePriorityservicecanbecompletedwithinoneday,

afewdaysormorewilldependontheavailabilityofthe

customertocompletetheQ&Aprocessandthecomplexity

oftherecoveryjob.

• CustomersgetaccesstoouremergencyCriticalResponse

servicewhichoperates24hoursaday,7daysaweek.

• Keepingpromisesisfundamentaltotheentireprocess.

Critical Response serviceTheCriticalResponseserviceisdesignedfortheselectfewclients

whoneedaspeciallevelofround-the-clockserviceandhave

sufficientbudgetresourcesavailable.Thisserviceisavailable

24hoursaday,7daysaweek.TheSeagateRecoveryServices

CriticalResponseteamismadeupofthebestofthebestdata

recoverytechnicianswhotaketurnsbeingonstandbyandare

readytotravelanywhereatamoment’snotice.

Theteamiscalledintocarryoutallkindsofmission-critical

recoveriesincludingcombinationsofnetworkservers,RAID,NAS,

SAN,tapeauto-loadersandopticaljukeboxesandcorrupted

filesetsinsoftwareplatformssuchasSQL,Oracleand

Exchangeserver.

Onsiteserviceisavailableforemergencysituationswhere

immediateshippingtooneofourlabsisnotfeasibleorsecurity

procedurespreventthemediafromleavingthedatacentre.

Whetherthecaseishandledinthelaboronsite,weworkround

theclocktorestoremission-criticaloperations.Ourfirststepis

alwaystoanalysethenstabilisethesituationbeforeweattempt

recovery.

UnlikethefreeevaluationprovidedunderourPriorityservice,

thereisanon-refundablefeeof€5,000forcallingintheSeagate

RecoveryServicesCriticalResponseteam.Pricingfortheentire

projectwillthenbenegotiatedduringtheinitialengagementphase.

20

Appendix A: What is data recovery?

It may not be what you think it is! Manypeopleequatedatarecoverywithrestoringdatafroma

tapebackuporusetheterm“datarecovery”interchangeably

with“disasterrecovery”asinrecoveringfromamajordisaster

suchasaflood,fireorbombingattack.Thesemeaningsare

quitetrueinthegeneralsenseand“datarecovery”isusually

onestepwithinthe“disasterrecovery”process.

However,theterm“datarecovery”hasaveryspecificmeaning

withinthecomputerindustry.First,consideroneofthedictionary

definitionsof‘recovery’:

‘Recovery’(noun)

“Theactofobtainingusablesubstancesfromunusablesources”.

Basedonthis,SeagateRecoveryServicesoffersthe

followingdefinition:

‘Datarecovery’(noun)

“Theactofobtainingusabledatafromdownedcomputersand

backupsandcorruptedfilesets”.

Datarecoverycasescanbedividedintotwobroadcategories:

Common recoveries

Theseinvolvefloppydisksandharddriveswhichareusuallyfrom

single-userPCs.

Complex recoveries

Theseinvolveharddrives,RAIDarrays,tapeandopticalmedia

orcorrupteddatabasesandfilesystemsusuallyfrommulti-user,

businesssystems.Datastorageatthehigh-endhasbecomea

verycomplexfield.Inthecaseofthesecomplexsituations,

datarecoverycanbeseenas“troubleshootingdatastorage”.

Whethercommonorcomplex,eachdatarecoverycaseis

uniqueandtheprocesscanbeveryresource-intensiveand

exceedinglytechnical.

21

Appendix B: What to ask before calling in a data recovery service1. What is your data recovery success rate?Statisticscanberatherdeceptiveastheycanbedoctoredto

appearbetterthantheyreallyare.Successratesaredeliberately

mentionedinonlineadvertising-designedtocapitaliseonthe

knowledgethatyourdataisinvaluabletoyouandthatyouneed

aguaranteethatyouwillgetitback.Theyknowthisandwilltell

youexactlywhatyouwanttohearabouttheirrecoverysuccess

rates.AtSeagate,weknowthatifyourdataisrecoverable,there

isnodoubtthatweWILLgetitback.Howeverifwedeemyour

dataUNRECOVERABLE,willbeupfrontaboutit.Astheworld’s

leadingdigitalstorageprovider,youareguaranteedthatwehave

thebesttechnologyonearthforgettingyourdataback.

IfSeagatecan’tgetitback,no-onecan.

2. What do I get for the price I am paying?WhenmakingtheBIGdecisiontobuydatarecoveryservices,

askyourself“WhodoItrustmosttorecovermyimportantdata?”

Ifthepriceistoocheap,thendouble-checkwhatyou’repaying

for.Mostdatarecoveryserviceswhichofferyouapriceof€500

torecoveryourdatahavelimitedsuccessrates.Thisisoften

becausetheyarerestrictedtocertaintypesofrecoveryoptions

suchasPCBdamaged,partitiontables,bootrecordcorruption

andMFTrecordsrestorations.Eventhefilestructurestheywork

withmayberestrictedtoNTFSfilesystemsonly.Itisalwaysa

goodideatocheckiftheyarecommittingtorecoverdeletedfiles

only.Seagatebelievesinvalueformoney.Ifyouarelookingfor

acost-effectivedatarecoverysolutionwithoutriskofanyfurther

damagetoyourmedia,tryourFileRecoveryforWindowsfirst.If

Seagate’sDIYsoftwaresolutioncannotrecoveryourdata,you

willneedaprofessionaldatarecoverylabservicetogetyour

databack.

3. Will I only get my data back?Don’tbeafraidtoaskwhatyouwillgetforthepriceyouare

paying.Afterall,itisyourdata,yourmoneyandyoudeservethe

verybestservice!Alwayscompareservice-providersintermsof

whatyouarebeingpromisedforthemoneyyouarespending.

Ifyourmoneyonlybuysyourdataback,youarenotgettinga

gooddeal.Asanabsoluteminimum,yourdatarecoveryservice-

providershouldofferyou:

• Noevaluationfees

• Acleartimeframeforgettingyourdataback

• Complimentaryshippingtoandfromtheirfacilities

• AFREEdiskdrivecoveredbyawarranty

22

• Telephone-basedpersonalsupport24hoursaday,

7daysaweek

• Onlinecasestatusreporting24hoursaday,7daysaweek

• Adedicatedcasemanager

Anddon’tforgetthatthereshouldbeaclearNoData-No

Chargeguarantee.Iftheycannotgetyourdataback,whyshould

youbechargedfortheservice?

4. What are the quote and payment agreements?Paymentoptions,includingwhenandforwhatyouarebeing

charged,shouldbeclearlyexplained.Andalwaysupfront!

Allcommitmentsandpromisesshouldalwaysbeconfirmedup

frontandmustbemetatthetimeofinvoicing.Datarecoveryis

nodifferentfromanyotherserviceyoupurchase-youshould

knowinadvanceexactlywhatyouaregettingfortheprice

youpay.SeagateRecoveryServicescommitstoprovidinga

firmquotebeforeworkcommences.Thepricequotedisthe

priceyoupay.Therearenoextracharges,hiddenshippingor

evaluationfees.EverySeagatedatarecoverycaseisdelivered

withinthecontextofafirmserviceandpricecommitmentset

outinthetermsoftheagreement.

5. How will my data be returned to me?Obtainaclearcommitmentastohowthedatawillbereturned

toyou.Asanabsoluteminimum,yourdatashouldbereturned

onmediawhichyoucaneasilyaccessandintegrateintoyour

existingsystem.AtSeagate,wewillreturnyourdataona

Seagatediskdrivecoveredbya2-yearwarrantyatnoadditional

chargeifyouchooseourPriorityservice.Forremovablemedia

(flashdrives,memorysticks,USBmemory,etc.)wereturn

yourdataonaSeagatepocketdrive.Theendgoalisalways

toensurethatyourdataiseasilyaccessibleandusablethe

momentitisreturned.

6. What about my warranty?Attemptingtorecoverdatamayvoidthewarrantyagreement

youhavewiththemanufacturer.Honouringathirdparty/drive

manufacturerwarrantymaycausedelaysinrecoveringdata,e.g.

bywaitingforconfirmationthatthewarrantywillbehonoured.

Askyourservice-providerhowtheywillhonouryourmedia’s

warranty.Iftheydon’tprovideyouwithaclearwarranty

statement,youmayhavetopurchaseanewharddriveafteryour

datahasbeenrecovered.Seagatehonoursallmanufacturers’

warrantiesbyreplacingthemediawithcomparableSeagate

media.ShouldSeagateRecoveryServicesvoidanon-Seagate

and/ornon-Maxtorproductwarranty,SeagateRecovery

Serviceswillreplacethecompetitivedrivewithanequivalent

Seagatedrivefreeofcharge.TheSeagatedrivewillbecovered

byanew2-yearwarranty.

23

Appendix C: Case studies on mission-critical recoveries

460GB RAID 5 crash at a technology company• RAIDupgradefrom6drivesto8appearedsuccessful.

• Subsequentrebootprecipitatedlossofallaccesstothedata

storedontheRAID5server.

• Serverurgentlyneededforaproductlaunch.

• ServercrashedonFridayevening;SeagateRecovery

ServicesCriticalResponseteamhadtherecoveryunder

waywithin3hours.

• Onsiteandremotetechniciansworkedroundtheclock.

• Completeturnaroundin36hours!Productlaunchwas

successfulsupportedbythefullyfunctional8-driveserver.

Database corruption• AnInternet-basedfinancialservicescompanymaintained

alltransactionrecordsinalargeSQLdatabaseonits

corporateserver.

• Aroutinesoftwaremaintenanceprogramwasrunperiodically

withoutanyproblemsuntiltheoperatormadeanerrorwhile

launchingtheprogram.

• Anumberofthedatabasetableswere“dropped”then

recreatedandre-populatedwithdata.Asaresult,someof

thedatawasoverwrittenandfilestructuresweredamaged

causingthemainapplicationtocrash.

• Arecentbackupwasnotavailable.

• Withoutthismission-criticaldataandassociatedapplication,

thisbusinesswasdoomedtofaceimminentruin.

• SeagateRecoveryServicesanalysedtheserverand

themajorityofthemissingdatawasidentifiedasbeing

recoverable.Nophysicalproblemswerefound,confirming

thiscaseasacomplexlogicalrecovery.

• Thecustomeridentifiedthemostcriticalofthemissingtables

andinordertocontaincosts,SeagateRecoveryServices

focussedtheireffortsonthesetables.

• Thecriticaltableswererecoveredandreturnedtothe

customerwhowassoonbackinbusiness.

24

Lost diagnostic images on DLT cartridges• Alargeurbanhospitalinthenorth-eastUSwasgenerating

approximately90,000medicalimagesperdayrequiringabout

25GBofdigitaldatastorage.

• Theyhadaregulatoryrequirementandanobligationto

patientstoprovidetheoriginalimages.

• TaperotationerrorscausederroneousEOD

(End-of-Data)markers.

• ITvendorstumpedorlackedresourcestoresolvetheproblem.

• Proprietaryexpertiserequired.

• Time-intensiverecoveryduetothenatureoftapeproblems.

• Thehospitalregainedaccesstothelostimagesandwas

abletoprovidethehighstandardofhealthcaretheirstaff

andpatientsdemanded.

25

Appendix D: Handling tips & ESD precautions Mishandlingisaleadingcauseofharddiskdrivefailure.

Hard disk drive Do’s• Handleaharddiskdrivethesamewayyouwouldhandleanegg.

• AlwayscarryoutESD*precautions.

• Handledrivesoneatatime.

• Whenhandlingdrives,onlytouchthesides.

• Padallharddiskdriveworksurfaces.

• Handlefailedharddiskdriveswiththesamecareas

newdrives.

• Wait10secondsbeforemovingafterswitchingoffinorderto

makesurethatthedrivehasstoppedspinning.

• Preventunprotecteddrivesfrommoving:useESDpackaging

(anti-staticbag)whenmovingdrivesandkeeptheamountof

handlingtoaminimum.

Hard disk drive Don’ts • Neverdropdrives.

• Neverallowdrivestocomeintocontactwithhardsurfaces.

• Neverstackdrives,evenintheESDprotectivebag.

• NeverallowtoolstocomeintocontactwiththePCBAorallow

contactwithoutESDprotection.

• Neverstanddrivesonend.

Disk drive components susceptible to handling damage• Heads-broken,chipped,degraded.

• Disks-scratchedmedia,headslaps.

• PCB-ESDdamage,bentconnectorpins,brokencomponents.

*ESD (Electrostatic Discharge)Afamiliarformofelectrostaticdischarge,oftenreferredtoas

“staticelectricity”,istheshockwereceiveafterwalkingacrossa

carpet.Inatechnicalenvironment,ESDcanproveverycostlyby

harmingdevicesorcomponents.ESDmaycauseacatastrophic

failurewhichisimmediatelyapparentoralatentfailureinwhich

gradualdegradationoccursduringuse,resultingineventualfailure.

ESD precautions• ComputerprofessionalsshouldpurchaseESDwriststraps,

floormatsandeducatethemselvesregardingESDprecautions.

• Personalusersshoulddischargethestaticonthemselvesby

touchingametalobjectbeforetouchingacomputer,harddrive

orothercomponent.

• Peopleinverycoldordryareasshouldbeawarethathumidair

helpstodissipateelectrostaticcharges.

26

Our pitch

Customers with a data emergency need• Urgentservice.

• Intensecommunication.

• Theabilitytocontrolprocesses.

• Pricingintegrity.

• UsabledatatobereturnedASAP.

Seagate Recovery Services delivers• Afastturnaroundforin-labevaluationsandin-labrecoveries.

• Freeevaluations.

• Nofiles=nocharge.

• Dataguarantee.

• CSRsusethetelephone,e-mail,fax,JobTrackorwhatever

meansnecessarytokeepthecustomerinformedregarding

thestatusoftheircase.Thisensuresthatwefocusonthe

customer’sprioritiesandseekongoingapprovaltocontinue

therecoveryprocessontheirbehalf.

• Toolsandprocessestokeepthecustomerincontrolof

theprocess.

• CriticalResponseteamgoesonsiteand/orworks

round-the-clocktorestoremission-criticaloperations.

• Customersatisfaction,usabledata.

Strengths of Seagate Recovery Services• ISO9001:2000certification.

• Manufacturers’support.Wearepermittedtoopenvirtually

anyharddrivewithoutvoidingthewarrantyandenjoyreferrals

frommanymanufacturersincludingMaxtor,IBM,Quantum,

WesternDigital,SeagateandDell.

• Allharddiskdrives&floppydisks.

• O/S:allversionsofWindows,MacandUnix.

• Complexrecoveries.

• Servers:RAID,NASandSAN.

• Magnetictapeandopticalstorage.

• Auto-loaders,librariesandjukeboxes.

• File“repair”:SQL,Oracle,Exchangeserver.

Key benefits of Seagate Recovery Services• Recoveryteam:CSRs+lab+customer-orientated

worldwidepresence.

• Urgentattentionispaidtoeachcase.

• Old,newandcomplextechnology.

• Unrivalledexpertisegainedacrossawidevarietyofhardware/

softwarecombinationsanddatalosssituations.

• Extensiveinvestmentsinthelatesttechnology,continuous

improvementinmethodologiesandskilledpeople.

• Experienceservingthemostdemandingcustomers.

• Usabledatareturnedtocustomer.

27

What to do next?• Backup, restore and maintain your systems.

• Visit and bookmark:

Seagate Recovery Services.com

• Spread the word on data recovery.

Data emergency?When in doubt, contact a professional data recovery

expert at:services.seagate.com

Oursuccessisbasedonprovidingfreeevaluations,fastturn-

aroundtimes,excellentcustomercareandsolutionswhich

guaranteethereturnofusabledata.