OK, everyone knows that heat kills electronic components, right? Never subject any electronic component to heat. Unless that makes the component work, that is?
Confession is good for the soul, they say, but bad for the reputation. So I'll tell the story this way. You see, there was this "friend of mine" whose hard drive failed. I mean, it was working fine the night before when I, er, he shut down his computer. But the next morning he turned it on and all he got was "shicka, shicka, shicka, shicka, shicka," then a pause, then five more attempts, then five more, and so on until the drive finally said "sorry?" and shut itself off. Now this guy hasn't been taking his own advice about backups for a while and — you guessed it — he hadn't backed up his Quicken off drive since, oh, about December of 2008!
The first attempt was to unplug the power and let the hard drive sit and think about running all day long while he was at work. One friend told him, "My drive does that all the time. I just unplug it and plug it back in and it works." Sounds good, he thought. So at the end of the work day, he came back home, plugged it in, held his breath, and powered up. No joy! Five more "shickas" and he powered it back off. Now what?
The next thing, especially when one has theological training, is to have a prayer meeting with one's wife! (Seriously.) He knew it was going to take a miracle at this point to avoid spending an inordinate amount of time and money to get this thing going. After the prayer meeting, I decided? ok, no more pretense — I'm the one that hadn't been practicing what I preach when it comes to backing up? I decided to try the freezer trick I keep hearing about. Hadn't really ever needed it before, but I was getting desperate. So I put the drive in a zip lock with some silica gel, and stuck the drive in the quick freeze section of my freezer for about 30 minutes or so.
Keep in mind, now, my electronics are good. The BIOS recognizes and correctly identifies the drive as a 250 GB Western Digital model Wd2500jb-57gvc0. And remember that I had NO trouble with it up until that morning. I figured it was worth a shot, although I think Scott Moulton prefers freeze spray to icing down the whole drive. This has got to work. Perhaps with a little help from the almighty? I plug it back in, turn on the computer, and — you guessed it — "shicka" some more. So I power down.
Now, I start thinking — which is a very dangerous thing at times. Last night when I shut down — when the drive was working just fine — it was warm. Not cold. Now, I am trying to get it to run but it is cold, not warm. Do you see where this is going?
I set the toaster oven on about 150 degrees, or so — probably a normal running temp for a lot of devices — and let it warm up. Then I took the drive and laid it on the rack with the top down and electronics up. (I didn't want to cook the circuit board from the bottom element!) Then I stood by and opened the oven door every 30 seconds or so, and felt the drive with my hand to make sure it wasn't getting too hot. I know what a running drive feels like, so I figured I should be able to get it to the right temp without burning the casserole, if you know what I mean.
After a few minutes, I determined that it felt just like a warm, running drive. So I pulled it from the oven, took it to the computer, and let it sit for a couple of minutes to equalize. I knew at that point that, while the outside was crisp, the inside was still warm and gooey. After equalization of the heat, I plugged it in, powered up, and it ran PERFECTLY! I was able to use Helix to image the entire 250GB drive over to a new 500GB drive without a single error!
So, here is my theory — If we are working with a drive that:
- Has not given us a problem before
- Its electronics are known to be good
- Was running fine when it was warm and it powered down fine
- Hasn't been backed up since Christmas of last year
- Desperately needs data recovery!
We may try this procedure with the following caveats —
- Preheat the oven
- Use bake, not toast or broil
- Turn the drive upside down when you put it on the rack
- Make certain that it does not get too hot! (Too bad we can't insert a meat thermometer) It should never be hot enough to burn you!
- Let it sit and equalize the heat before you try plugging it in
- DISCLAIMER: Neither the author of this blog, nor anyone the entire GCFA community or at SANS will be responsible if you end up with a burnt "casserole" and render your drive even worse than it was before you started!
- It might work
Please don't tell my GCFA instructor Rob Lee, or SANS instructor Scott Moulton, that I suggested this. I don't want them to think I've totally lost my marbles!!!
By the way, Quicken is alive and well. Oh, and I have 4 copies now of my data files. (Just in case) And, by the other way, what I always told my customers was: a) "If you have done enough work that you would not want to have to do it over, it is time to make a backup," and b) "You will never fully appreciate backups until you have a catastrophic failure." (And that isn't "If" but "When" you have a catastrophe!)
OK, my soul is better now. My reputation is probably back where it belongs. And I have to thank God for the inspiration to even try this. (For those who do not "believe," I have to remind you that there are no atheists in foxholes. At least, that is what I have always heard, although there are differing opinions on the topic. For me, this computer stuff can be a real battle, sometimes. I welcome all the help I can get!)
J. Michael Butler, GCFA Gold #00056 GSEC EnCE CISA, is an Information Security Consultant employed by a fortune 500 application service provider who processes approximately half of the $5 trillion of residential mortgage debt in the US. He is a certified computer forensics specialist. In addition, he authored the enterprise wide security incident management plan and information security policies for his corporation. Butler has authored a number of blogs and white papers. He can be reached at jmbutler_1 at hotmail dot com.
.jpg "1245x705_FREE_DFIR-Summit_(1).jpg")
