OK, the external hard drive for data recovery I will be talking about in this one is the Seagate Central 4TB Network Goflex P/N 1EN2P4-500
Apart from the fact that this is an excellently designed case, it does have some challenges when it comes to the internal Seagate drive.
This post is more for the benefit of other data recovery guys but it may be interesting regardless if you are into that sort of thing.
Most external hard drives are straight forward in that you remove the external case to reveal the internal drive and that’s that, however the file system is Linux EXT4 LVM and therefore requires some additional work to recover.
4TB Seagate ST4000DM000
PC3000 View
Once we connect the drive up we can see a Linux EXT4 partition instead of NTFS (PC) or HFS+ (Mac) but PC3K does not support this particular file system variant (yet) and no files/folders can be seen.
When you cannot select or ‘cherry-pick’ the individual files/folders you require, you are forced to clone the full entire drive. In this case (4TB).
Given the size and uncertain condition of the drive you run a high risk of the drive failing at some stage. You are putting unnecessary load on the drive. I call this “imaging blind”.
A way around this is to use software that supports multiple file types in conjunction with the base imaging tool as to be selective on what data we require. (Normally the systems we have support multiple file systems but in this case it does not)
So for this example I am going to use UFS Explorer and Ace Labs PC3K Data Extractor (this trick is well known but not by everyone)
I am going to Image the drive “through” UFS explorer
Connect the drive as normal create a task and Mount task as drive
Select read only and ignore any messages to “format drive” windows will be confused at the drive you just mounted and request to format, obviously don’t do that.
UFS Explorer view of the mounted drive and customer data connected via PC3K
Now that the drive connected thru PC3K can now be seen by UFS Explorer, the files and folders are now visible, we can use UFS to extract the data and this will in turn Image the drive safely using imaging power of PC3K.
Select the data you require Right click and save to a destination location.
You can now watch the files extract and monitor any problem.
The green PC3K map will now move showing that it is actively working
Switch back to PC3K and you can watch it image recovered data in real time on the fly as you previously would.
Disclaimer: This method is mildly risky for larger files (video) as UFS will force PC3K to image regardless of the drive condition. I am planning on doing a Deepspar v PC3k comparison to see how both systems compare running thru UFS. I Believe the deepspar method will be some what safer as it has more options to navigate around bad areas of disk. More about my love for DDI and UFS on my ‘Tools for Data Recovery’ post.
This image shows the latest UFS Explorer version connecting to the 4TB Seagate when hooked up via Deespar 4 on the network. The LVM partition we need can be see bottom left and customer data folder structure on the right, it is now possible to image/extract data from the Seagate drive while taking advantage of the versatility of UFS Explorer
However if you setup data extractor correctly then this should work well enough even if you have to monitor or babysit this job more than others. Another method is to do one folder at a time or ask the customer to prioritize and go after the most important data first.
These are my go-to standard settings for data extractor, a high timeout would not be good for this process (go as low as 200ms when drive contains video) as it could put unnecessary stress on the drive if it ran into problems.
Hope that helps
Andy