Blog: SANS Digital Forensics and Incident Response Blog

Blog: SANS Digital Forensics and Incident Response Blog

The Failed Hard Drive, the Toaster Oven, and a Little Faith

OK, everyone knows that heat kills electronic components, right? Never subject any electronic component to heat. Unless that makes the component work, that is...

Confession is good for the soul, they say, but bad for the reputation. So I'll tell the story this way. You see, there was this "friend of mine" whose hard drive failed. I mean, it was working fine the night before when I, er, he shut down his computer. But the next morning he turned it on and all he got was "shicka, shicka, shicka, shicka, shicka," then a pause, then five more attempts, then five more, and so on until the drive finally said "sorry..." and shut itself off. Now this guy hasn't been taking his own advice about backups for a while and — you guessed it — he hadn't backed up his Quicken off drive since, oh, about December of 2008!

The first attempt was to unplug the power and let the hard drive sit and think about running all day long while he was at work. One friend told him, "My drive does that all the time. I just unplug it and plug it back in and it works." Sounds good, he thought. So at the end of the work day, he came back home, plugged it in, held his breath, and powered up. No joy! Five more "shickas" and he powered it back off. Now what?

The next thing, especially when one has theological training, is to have a prayer meeting with one's wife! (Seriously.) He knew it was going to take a miracle at this point to avoid spending an inordinate amount of time and money to get this thing going. After the prayer meeting, I decided... ok, no more pretense — I'm the one that hadn't been practicing what I preach when it comes to backing up... I decided to try the freezer trick I keep hearing about. Hadn't really ever needed it before, but I was getting desperate. So I put the drive in a zip lock with some silica gel, and stuck the drive in the quick freeze section of my freezer for about 30 minutes or so.

Keep in mind, now, my electronics are good. The BIOS recognizes and correctly identifies the drive as a 250 GB Western Digital model Wd2500jb-57gvc0. And remember that I had NO trouble with it up until that morning. I figured it was worth a shot, although I think Scott Moulton prefers freeze spray to icing down the whole drive. This has got to work. Perhaps with a little help from the almighty... I plug it back in, turn on the computer, and — you guessed it — "shicka" some more. So I power down.

Now, I start thinking — which is a very dangerous thing at times. Last night when I shut down — when the drive was working just fine — it was warm. Not cold. Now, I am trying to get it to run but it is cold, not warm. Do you see where this is going?

I set the toaster oven on about 150 degrees, or so — probably a normal running temp for a lot of devices — and let it warm up. Then I took the drive and laid it on the rack with the top down and electronics up. (I didn't want to cook the circuit board from the bottom element!) Then I stood by and opened the oven door every 30 seconds or so, and felt the drive with my hand to make sure it wasn't getting too hot. I know what a running drive feels like, so I figured I should be able to get it to the right temp without burning the casserole, if you know what I mean.

After a few minutes, I determined that it felt just like a warm, running drive. So I pulled it from the oven, took it to the computer, and let it sit for a couple of minutes to equalize. I knew at that point that, while the outside was crisp, the inside was still warm and gooey. After equalization of the heat, I plugged it in, powered up, and it ran PERFECTLY! I was able to use Helix to image the entire 250GB drive over to a new 500GB drive without a single error!

So, here is my theory — If we are working with a drive that:

  • Has not given us a problem before
  • Its electronics are known to be good
  • Was running fine when it was warm and it powered down fine
  • Hasn't been backed up since Christmas of last year
  • Desperately needs data recovery!
We may try this procedure with the following caveats —
  1. Preheat the oven
  2. Use bake, not toast or broil
  3. Turn the drive upside down when you put it on the rack
  4. Make certain that it does not get too hot! (Too bad we can't insert a meat thermometer) It should never be hot enough to burn you!
  5. Let it sit and equalize the heat before you try plugging it in
  6. DISCLAIMER: Neither the author of this blog, nor anyone the entire GCFA community or at SANS will be responsible if you end up with a burnt "casserole" and render your drive even worse than it was before you started!
  7. It might work
Please don't tell my GCFA instructor Rob Lee, or SANS instructor Scott Moulton, that I suggested this. I don't want them to think I've totally lost my marbles!!!

By the way, Quicken is alive and well. Oh, and I have 4 copies now of my data files. (Just in case) And, by the other way, what I always told my customers was: a) "If you have done enough work that you would not want to have to do it over, it is time to make a backup," and b) "You will never fully appreciate backups until you have a catastrophic failure." (And that isn't "If" but "When" you have a catastrophe!)

OK, my soul is better now. My reputation is probably back where it belongs. And I have to thank God for the inspiration to even try this. (For those who do not "believe," I have to remind you that there are no atheists in foxholes. At least, that is what I have always heard, although there are differing opinions on the topic. For me, this computer stuff can be a real battle, sometimes. I welcome all the help I can get!)

J. Michael Butler, GCFA Gold #00056 GSEC EnCE CISA, is an Information Security Consultant employed by a fortune 500 application service provider who processes approximately half of the $5 trillion of residential mortgage debt in the US. He is a certified computer forensics specialist. In addition, he authored the enterprise wide security incident management plan and information security policies for his corporation. Butler has authored a number of blogs and white papers. He can be reached at jmbutler_1 at hotmail dot com.

5 Comments

Posted September 30, 2009 at 2:51 PM | Permalink | Reply

Tremaine Lea

A variant on this trick is to double bag the drive in Ziploc freezer bags, seal both, and then submerge it in near boiling water for a short period. Slightly less risky than a toaster oven - even if you manage to get water inside it'll dry out pretty quickly and you can try again :)

Posted September 30, 2009 at 10:21 PM | Permalink | Reply

Bradley Schatz

I recall seeing a patent for a device for data recovery of hard drives which automatically controlled cooling, heating, pressure, and the power state of a hard drive in a purpose built chamber.

BTW, fthe freezer cooling tactic has worked for me more than once. One extra precaution against condensation within the drive, post removing it from the freezer, is to pre-attach a USB bridge to the drive and have just the cable coming out of the sealed bag.

Posted September 30, 2009 at 11:45 PM | Permalink | Reply

Land

It's funny, I like the story.

Posted March 12, 2012 at 5:18 AM | Permalink | Reply

Dee

I froze my hard disk yesterday..and plugged back in and didn't work.

But now i realised that i powered down while my disk was hot..

Will try the heating tactic...am sure it will hopefully work...

Posted January 14, 2013 at 7:27 PM | Permalink | Reply

ac

The oven trick worked for me the other day, I had 8800 GT GPU doing all sort of red lines blue lines and stuff with garbled corrupt characters. I read about taking the heatsinks off

Post a Comment






* Indicates a required field.