5 Reasons Hard Drives Fail

Similar to a vehicle, a hard disk, or a hard drive as it is called, is a mechanical device (not an SSD). Also referred to as a mechanical hard drive, like other parts of your computer, it (hard drives) can sustain damage in multiple ways.

That said, unlike other parts of the computer, a mechanical hard drive is mechanical and electronic, which means it deals with both types of stress. Thus, a problem on either the electrical or mechanical side can lead to issues.

Why Do Hard Drives Commonly Fail?

Since they are mechanical devices, the drives are subject to wear and tear, even if you treat them with care. It is estimated that 60% of hard drives fail because of mechanical failure, and 40% may fail because they are misused. Common reasons for failure include:

• The hard drive is dropped or bumped.
• The motor in the hard drive fails, which leads to the hard drive not spinning up.
• High temperatures damage the electronic circuit board, causing it to fail.
• A sudden and abrupt power failure when the disc is writing can also do damage.

Let’s dive into each one of the most common types of hard drive failures below and what can be done to prevent it, if possible.

Mechanical Hard Drive Failures

Mechanical hard drive failures are a common occurrence. Most times, these result from physical damage to the hard drive. Physical damage usually leads to the hard disk platters that store your data getting scratched, or the read-write head which accesses your data crashing into the platters, leading to what is commonly referred to as a head crash.

The hard drive’s operation relies on the precise rotation of the disk at high speeds, typically 5400 or 7200 revolutions per minute (depending on the one you own). Any issues with the motor that spins the disk can fail, with symptoms such as clicking or grinding noises indicating a potential problem.

Mechanical failure is mainly caused by extensive use. Like almost everything else, repeated use can lead to degradation over time. Even if a drive is treated carefully and kept in ideal conditions, wear and tear can eventually cause mechanical parts to fail. This means older hard drives will most likely fail compared to newer ones.

Electronic Hard Disk Failures

Power surges are notorious for causing severe damage to a drive’s electronic components. A sudden spike or drop in the voltage supplied to the drive can destroy these components, often rendering the hard drive irreparable.

The heart of these electronic parts is the drive’s printed circuit board (PCB), a thin plate on which chips and other electronic components are placed. PCBs control all interactions within the hard drive, and problems within this can lead to a hard drive failing. Thus, even something like a capacitor failing or burning out can mean the hard drive fails entirely. That said, replacing the capacitor or a resistor, in this case, does not necessarily mean that you should then use the operational hard drive for anything beyond copying data to a new drive.

However, in rare cases, compatibility issues with the system’s motherboard can also lead to an electronic failure. If the drive and motherboard do not interact correctly, it can result in problematic drive errors, which usually surface via warning messages or a drive not recognized by the system.

Corrupted Software

Software corruption can pose a significant problem, leading to hard drive failure. A common problem is file system corruption, which can lead to the hard drive failing. This can happen for various reasons, including faulty software, power failures, or abrupt system shutdowns.

Plus, the installation of malicious software can also trigger these issues. Certain types of malware are designed to specifically cause this problem, progressively damaging the hard drive’s file system.

Additionally, errors originating from improper system upgrades can also cause software corruption. Sometimes, an upgrade can go wrong, deleting or corrupting files needed for the hard drive to function correctly. However, most software-related hard drive problems are comparatively easier to address.

Excessive Heat

Excessive heat can also damage a hard drive. Constant high temperatures can degrade the physical and electronic components, especially if the drive is enclosed in a poorly ventilated case.

Modern computer systems use fans and heat sinks to cool down their components. When these components fail or do not perform effectively, the resulting heat can lead to drive malfunctions.

Heating-related issues are usually caused when the computer is placed in a location with high temperatures or if the hard drive is working beyond its capacity. Thus, as part of extending the longevity of your hard drive and computer system in general, it is essential that the system runs in a temperature-controlled environment where it does not get too hot.

Human Errors

Human errors can also lead to hard drive failures. Accidental deletion or formatting of the hard drive is not uncommon and can lead to immense data loss and potential drive failure.

Incorrect modifications of system settings can also result in challenging drive issues. Incorrect BIOS settings or system configuration can lead to conflicts that, if unresolved, can render a drive inoperable.

Physical mishandling or improper installation also falls under human errors. Sometimes, our unawareness or neglect while installing or handling a hard drive can have severe consequences.

Final Word

In essence, understanding these primary causes of failure can equip you with the knowledge needed to prevent hard drive failure. However, it is worth reiterating that you still can’t save a hard drive from mechanical wear and tear. If you’ve been using a mechanical hard drive for a few years, it would be worth ensuring your data is backed up onto another hard drive or the cloud.

If you hear strange clicking sounds or motor winding sounds that were not there prior, make sure that you replace the hard drive right away. If the hard drive failed and you had important data that was not backed up, then send the drive to us at Flashback Data, we are an experienced company specializing in data recovery, and that’s the only sure way to get your data back.

DIY Data Recovery Versus Professionals

DIY data recovery is appealing to most people because it’s inexpensive, fast, and convenient. When your hard drive fails, it’s natural to want an instant fix without waiting or paying for professional help. Many turn first to DIY recovery software, hoping lost files can be rescued right at their desk in minutes.

However, this DIY approach has significant drawbacks. Quality software with any actual data salvaging capability costs much more than people expect or may be willing to pay. DIY tools are limited in how deeply they can scan drives and the file types they can restore.

There’s also a good chance that unskilled actions while attempting DIY data recovery can cause further data loss. Recovery attempts that directly interact with failed drives risk irreversible damage. The convenience of DIY comes at the cost of likely failure and destruction of remaining data. It is worth keeping in mind that no DIY data recovery software guarantees results. In fact, they state that they shouldn’t be held responsible for any irreversible loss of data caused by their software!

That said, DIY data recovery does have its place, and there is a time and use case for it when you need to know when you use data recovery software to try and recover your data and when it is best to hire a professional to do it for you.

In this article, we’ll discuss DIY data recovery and how it measures up against hiring a professional, which will be a slightly more expensive option for many people but worth it.

How Does DIY Data Recovery Work?

DIY data recovery relies on software tools available for purchase by regular consumers. Products like EaseUS, Stellar, and Disk Drill claim to salvage lost files from failed drives and devices. Their accessible interfaces and budget prices of around $100 or less appeal to users eager for a quick, affordable fix.

These DIY programs allow scanning hard drives for recoverable data without special equipment. Once installed, the user selects the problematic drive, and the recovery process begins. The software scans the drive, attempting to identify files that can be rescued based on structure remnants and patterns. Recovered files may be previewed and selectively saved to another healthy drive.

However, several limitations prevent complete recovery success for the average user. For starters, DIY software needs specialised forensic capabilities and advanced algorithms professional labs use to extract data at the byte level.

Commercially available DIY recovery software will scan a drive superficially, which means it is unable to extract data from severely corrupted drives. Certain file types, like photos and encrypted files, prove to be more challenging if file headers are disrupted. Also, even if these files are partially recovered, they can’t be used or even partially seen (in the case of an image file).

Then there is also the risk of DIY tools harming fragile drives during recovery attempts. DIYers lack the read-only hardware needed to access damaged sectors safely. Thus, it isn’t uncommon for untrained users may inadvertently overwrite data remnants during scanning.

While DIY software can resurrect accidentally deleted files if acted upon quickly, it fails when the drive is physically damaged. The superficial scans miss critical corrupted data pros can salvage.

Ultimately, DIY should only be attempted with expendable drives, as it risks worsening data loss. You shouldn’t use any DIY data recovery method or software on a drive that holds valuable data.

Professional Data Recovery Methods

When critical data is lost due to hardware failure or accidental deletion, multiple attempts to try DIY recovery solutions should be avoided. Not only does this often cause more harm than good, but it makes the job of professionals harder.  Valuable or irreplaceable data recovery should only be handled by experts.

Speedy Yet Safe Recovery

Utilising advanced tools and techniques perfected over several years means data recovery pros can retrieve your files quickly yet safely. In most scenarios, professionals can complete data recovery within 24-48 hours. Specialists will recover data using proprietary methods too complex for DIYers. However, rapid turnaround prevents lingering downtime.

Repairing Physical Damage

While DIY options lack the capabilities to recover data from mechanically failed drives, experienced data recovery engineers have astonishing success extracting files even from heavily damaged hardware. Clean room facilities allow professionals to perform delicate internal work to rebuild drive components like read-write heads.

Once drives are stabilised, file scanning targets lower levels to resuscitate data conventional software can’t. These meticulous, manual methods salvage irretrievable data that can’t otherwise be recovered.

Specially Tailored Solutions

Experts determine tailored solutions for each unique case, selecting from various advanced tools. Custom chip adapters may be fabricated to interface with proprietary drive formats. Data forensics incorporating disk assembly imaging helps when a repair is impossible. A personalised approach targets the specific failure points to expand recovery possibilities. DIY software can’t match this degree of customization and thus can’t be used for advanced data recovery.

Higher File Type Success

General recovery apps struggle with multimedia files, databases, and encrypted data. But experts’ advanced scanning rebuilds file headers and structures to restore more file varieties. Custom algorithms are designed to extract every recoverable byte. Years spent specialising solely in data recovery leads to levels of success unattainable by weekend warriors relying on mass-market software.

Competitively Priced

While pricier than DIY initially, professional recovery services offer a value-driven proposition. The expertise and capabilities produce superior results, saving money long-term by recovering data the first time.

Competitive pricing plans avoid overcharging. Most importantly, a no-data, no-pay policy removes all risk for people requiring their valuable data to be recovered. The combination of world-class experts and guaranteed satisfaction ensures you escape the nightmare of data loss quickly and affordably.

Final Word

Don’t jeopardise irreplaceable memories or crucial business data by trying to recover it using DIY software. Leave data recovery to specialists like us who have years of experience and a track record of successfully recovering data using advanced hardware and software tools.

Our cutting-edge capabilities and decades of experience make us the safest bet for resurrecting lost files when disaster strikes.

The Perils of DIY Data Recovery: Understanding the Risks of Opening Hard Drives

In our digitally driven world, hard drives play an instrumental role as the storage hub of our digital lives. They house a treasure trove of priceless information ranging from sentimental personal photos, critical documents to confidential business data. Regrettably, like every piece of hardware, hard drives are susceptible to failure, potentially resulting in data loss. In such instances, data recovery becomes a vital lifeline. As professionals in the field, we are committed to assisting our clients recover their data from failed hard drives, but it’s crucial to understand the dangers of attempting to open a hard drive prior to consulting with a data recovery engineer.

The Temptation of Self-Diagnosis

In the face of a hard drive failure, many individuals are tempted to diagnose and possibly rectify the problem themselves. This does not refer to simply removing the hard drive from its casing, but rather prying open the device to expose its intricate internal mechanisms. The intent behind such an action is often to identify the underlying issue; however, this is fraught with significant risks, with the most significant being the potential exposure of the hard drive’s most important component – the platter.

The Platter: A Delicate Balance

The platter, a spinning disk fashioned from either aluminum or glass and coated with a magnetic material, is the critical element of a hard drive where data is stored. Sealed within the hard drive, the platter is safeguarded from contaminants, but it remains a delicate and easily damaged component. Once exposed to the air, dust and other forms of debris can quickly contaminate the platter, causing severe damage and significantly diminishing the likelihood of successful data recovery.

Misalignment and Mechanical Damage

Exposing a hard drive’s platter to the external environment brings about another serious risk: the potential misalignment of the platter. During the manufacturing process, hard drives are calibrated to ensure an exact alignment between the platter and the read/write head – the mechanism responsible for accessing data. Should the platter become displaced or misaligned, it may lead to a catastrophic collision between the read/write head and the platter. Such physical damage to the platter can render data recovery almost impossible.

The Risks of DIY Data Recovery

Opening a hard drive and exposing the platter outside of a professional clean room environment can be a dangerous and potentially expensive mistake. Without the specialized equipment and expert knowledge required for successful data recovery, any DIY attempt not only risks further damage but can also completely obliterate any possibility of recovering the precious data housed within the drive. Furthermore, the risk of introducing contaminants or causing mechanical damage can be high, even for those with a basic understanding of the internal mechanisms of a hard drive.

Seeking Professional Help

When faced with a failed hard drive, it’s critical to engage the services of a reputable data recovery company. These experts possess the necessary experience, tools, and facilities, such as clean rooms, to ensure your data is retrieved safely and effectively. Rather than risk the potential pitfalls of DIY data recovery, a professional approach offers the highest chances of successfully retrieving your data, saving you from the heartache of permanent data loss.

Conclusion

Although it’s tempting to take matters into your own hands when a hard drive fails, the risks associated with exposing the sensitive internal components, such as the platter, far outweigh any potential benefits. Before attempting any self-repair, remember the valuable and often irreplaceable nature of the data you risk losing. The safest course of action is always to consult with a reputable data recovery service, capable of navigating the delicate process of data recovery while safeguarding the integrity of your data.

Hurricane Ida Data Recovery

What to do if you encounter computer storage equipment that has been damaged by water and severe flooding.

For those of you that may encounter damaged devices due to Hurricane Ida. Here are some quick DO‘s and DON’Ts for the best chances of data recovery on water damaged devices:

• DO leave the device ‘as is’. Don’t try and clean off excess dirt or debris that may have occurred in a flood or disaster. Wiping debris from drives and media can cause greater damage to the electronic components of the device.
• DON’T attempt to dry the water damaged drive. While it’s often your first instinct, doing so will decrease chances of recovery.
• DO put it in a bag and help it retain moisture from water submersion. An unused sponge will help prevent further damage. As the moisture levels decrease corrosion levels and damages increase. (Think dried salt crust from ocean water)
• DON’T power the device on.  If there is water on any of the electrical components or internals of a drive, you can ruin your customers chances of recovery forever.
• DO let us know if your shipment containers items damaged in a natural disaster so that we can take additional precautions prior to opening the package.
• DON’T hesitate to find out if we can help. We have the right tools and equipment to safely evaluate the chances of recovery quickly.

Please feel free to call us or use our web form for more information if any of your devices have come into contact with water.

Weather Emergency Data Recovery

If you’ve been following the news, you’ve probably heard that Texas went through several catastrophic emergencies back to back last week. We had record-breaking freezing temperatures that were sustained for almost a week, which doesn’t happen too often in Texas. This led to power grid failures, undriveable roads, destroyed water systems that left homes flooded or without resources, and a natural gas shortage.

This led to a slew of calls as the weather broke – people experienced power interruptions that messed up their firmware, flooding that blew out their computers, and a host of other issues that led to unexpected data loss (adding insult to injury in a terrible state-wide event).

This event came as a huge surprise to all of us, as in Texas, cold snaps tend to stay above freezing temperatures and only last a couple of days. This time, our whole state was under ice for the week.

There is only so much you can do to prevent data loss in a major emergency like this. Primarily, you’ll want to make sure your power-dependent systems are connected to a reliable backup service like Carbonite or iCloud. That way, at least you will have a relatively recent back-up of your data that won’t add to your list of challenges to overcome, or add to the growing stack of emergency expenses. Making sure that your back-ups are all paid for and connected appropriately should be part of any monthly office or home checklist you have.

Of course, there are times where despite your best efforts, these things won’t come together as planned.

So, what happens when your computer floods, or a power outage causes a system failure in your phone? What do you do?

Power Outage Data Recovery

If you’ve lost your data due to a power failure, such as rolling blackouts in a weather emergency, do not try to power your device further. You could cause further electrical issues and render your data unrecoverable.

1. Identify whether it’s a total failure, or if a charging cable or connector cable could be the culprit. Try swapping your charging or connector cables, and change the device you’re connecting to. Once you’ve ruled out anything like that, do not attempt to power or access they device any further.
2. Locate and assess any further electrical-related damage in the home, while you’re at it. Safety first! Focus on important data centers such as phones and computers, and anything potentially dangerous – like stoves, ovens, etc.
3. Place the data-compromised device in two anti-static bags
4. Contact us.

Water Damage Data Recovery

Water damage is a stranger to no one at this point, but because of that, there are certain myths surrounding what to do when you have a water damage experience – particularly, anything involving rice. Rice is popular because as a super dry ingredient, it will absorb the moisture out of a waterlogged device. What it doesn’t absorb are the sediments and particulates that came in with the water. Once you absorb that water out of the device, those particles are left behind, causing corrosion and damage to the internal components. So, what do you *really* do?

1. Stop attempting to power up your device. This could make everything worse for you.
2. Do NOT put your device in a bag of rice.
3. Instead, put your device in a Ziploc bag with a damp sponge. This keeps the internal components damp instead of drying them out, which will allow a recovery technician to properly clean the particulates out of the device before removing the moisture. This way, no damage will happen from corrosion or cleaning particles off of fragile surfaces.
4. Contact us.

For larger units with electrical-related or water damage, such as a multi-device RAID system, you are still essentially in the same boat. Do not attempt to power up the unit or dry it out, and give us a call as soon as possible. If you are an entrepreneur or work for a business, and your business insurance covers extreme weather events, call them immediately to get that lengthy process started.

As always, please don’t hesitate to reach out if you have any questions. If you have other critical tips you think are worth mentioning, let us know so we can add them!

How to Prevent Mobile Device Data Recovery

At Flashback Data, we get many calls about recovering lost data from mobile devices (phones and tablets). Phones and tablets are two of the most commonly used devices in the world today, and carry an unthinkable amount of our data – from photos and videos, to our private messages and search history. Understandably, these clients are often the most devastated clients when they call us with a significant data loss. Smartphone and tablet memory works very differently than other devices, so it surprises many people to hear that common, everyday practices are what led to their data loss.

We put together this article to detail the do’s and don’ts of mobile device data – some of these may surprise you, but we suspect there are a couple you’ve known all along (and it’s time to get with the program). Follow these tips in order to prevent a catastrophic data loss that could leave your heart or your business sidelined in a major way.

Mobile Device Do’s

1. Sign up with a cloud backup service

This is the most important recommendation on our list. Sign up with a cloud backup service that automatically updates its backup and automatically charges your operating expenses. This ensures that no matter what’s going on with your device, a very recent digital copy of your data is safe and ready to re-download. If you’re an Apple device user, you can easily use their iCloud service. For Android users, a Google backup service would be an easy fit.

We often hear that people are nervous and suspicious of cloud services, usually citing that they don’t want Google or Apple reviewing their private data, or hackers getting into their data and using it. There is a misconception around all of this that we’d like to dissolve. If you’re reading this article, it is extremely unlikely that you are a target for a data breach.

Simply put – we are not that important. Hackers and allegedly malicious employees of cloud services do not waste time on targets without a certainty of the data they’re profiting from. Think of it this way – would a robber risk breaking into a house if there’s no way to know anything of value is inside? Most all of us fall into this category when it comes to our backed up data.

Once you’ve signed up with a cloud service that meets your needs, check it monthly to make sure your bill is paid and your data is being upload properly. That way, if you’ve gotten disconnected from the service, you’ve only lost a few weeks of data at most. If you have any monthly checklists – like going through your bills, conducting expense reports, etc. – checking your backups is a great candidate to add to your monthly responsibilities.

2. Back up before any system updates

One of our most frequent data recovery questions surrounds iPhones and boot loops – a failure called Error 14. This can happen when your iPhone downloads its own system updates, but your phone is overfull with too much data. It crashes your phone, causing it to power up and down in a loop. This is an unrecoverable situation, so if your data isn’t backed up, that’s it – all of your mobile device data is gone.

It’s impossible for you to know how our phone or tablet is going to respond to a system update outside of whether or not you have enough room to download it. Most of the time, everything is fine, and after a few minutes you’re back to using our phone, but plenty of people experience data loss from system updates that were fine for everyone else. Sometimes, unfinished or disastrous system updates are released, and many people lose their data as a result.

If you are someone who takes tons of photos, and regularly has a close-to-full phone, or if you don’t know much about phone technology, we highly recommend turning off your auto-update settings to prevent something like this from happening. This will make the phone or tablet notify you when an update is going to happen in the near future, so you’ll have time to double-check your back-ups and make some space on device.

3. Keep 10 GB available on your phone

For the reasons we listed above, always make sure your mobile device has some space on it. It is often running updates and downloading data in the background that you might be unaware of, all of which runs the risk of corrupting your phone if you don’t have enough free space. Your phone may advertise that it has 128 GB of space, for example, but our techs at Flashback Data would agree that you shouldn’t fill it over 115.

4. Invest in a water and shatter-proof case

Here is an uncomfortable truth: water damage and impact damage are fully avoidable. Yep, you read it here, and we stand by it. We’re not saying we have a running tally of how many times we hear “I know I should have a waterproof case, but, my kid spilled liquid on my tablet and shorted It”… but we certainly could.

Reputable water and shatter preventative cases do run a bit pricier than your typical silicone sleeve, but $50 is nothing when it comes to our minimum mobile device recovery fee ($399) or an uninsured phone replacement (up to over a grand!).

Don’t know where to start? Here are some examples of high quality brands that make fantastic, reliable phone cases.

LifeProof 
Hitcase Shield
Aquavault 
Otterbox

Flashback Data is not affiliated with any of these brands – we’re merely showcasing examples of brands on the market that make the quality of cases you’re looking for. We are not responsible for any manufacturer issues or customer satisfaction on these products.

5. Use high quality charging and connector cables from your device manufacturer, or from a manufacturer-recommended vendor

Low quality connector cables are a huge reason that customers come to us for data recovery. Low quality cables can cause electrical shortages in your phone, rendering it unusable and potentially corrupting your data. These cheap connector cables can also corrupt your data, and they’re easy to break and tear, making a data transfer easy to interrupt (which can often lead to a phone failure). Invest in cables that are directly from your device manufacturer, or are recommended by the manufacturer.

Apple has a program in particular to certify other vendors for use on their products, called the MFI Certification. Through this process vendors can assure their consumers that their products are fully safe to use with Apple products. This sort of certification program doesn’t exist for all mobile devices, but it’s worth reading reviews to make sure your components don’t compromise your data.

Mobile Device Don’ts

1. Fill your device storage

As we mentioned above, there are tons of risks associated with filling up your phone. This doesn’t leave any room for the device to download system or application updates, take photos and videos, or run its own operating system. You may notice that your phone “stutters” – applications lock up during use or take a long time to open, apps and videos close without warning, or you find yourself having to restart your phone on a regular basis. Keeping your mobile device stuffed to its limit with data is practically begging for a memory failure.

We understand that a lot of people want all of their photos and videos in one device, ready to review and reminisce at a moment’s notice. Unfortunately, this is the most common risky behavior we see when it comes to our customers with crashed phones. We highly encourage you to embrace using a cloud service or online photo album service to store all of your picture and video archives. When you want to take a walk down memory lane, they’ll be waiting for you.

2. Put your device in rice

Putting your phone in rice is a popular, but often destructive approach to trying to reverse water damage. While technically, yes, this method will dry out your phone, but it can do so in a very harmful way that make matters worse. The way rice interacts with exposure to electronics can cause more damage than you already have, leading to corruption of your data and damage to your motherboard.

If your device has been exposed to liquid and is damaged as a result, zip it up in a bag with a slightly damp sponge, and take it to a repair shop immediately. This will allow the liquid to be extracted from the device without corroding any of the components through over-drying.

3. Take your device swimming

We’ve seen the commercials. Someone is basking in the ocean with their smartphone or enjoying drinks in a pool, taking underwater photos to commemorate their summer vacations and spring breaks. These people live seemingly worry and risk-free, drinking beer and making funny faces underwater for social media photos.

Don’t be those people.

A recurring call we receive is customers who are upset because they thought their phone was water proof, so they took it in the pool or to the beach, and now it won’t turn on. Your smart phone is never going to be “water proof”. It is water resistant. It is water resistant in clear, clean water with no currents or waves.

Pools and hot tubs are full of chemicals that aren’t meant to be exposed to electronics. The ocean is full of salt and sediments, which ruin electronic components on contact.

There are certainly reputable waterproof cases that will allow you to submerge your phones and tablets in different bodies of water, but as we all know, even the best brands do not carry a 100% success rate. We recommend being safe over sorry – do not bring your devices swimming with you.

4. Use cheap or unsanctioned accessories

Using convenience store charging cables is a sure-fire ticket to losing your data. These cheaply made cables can fray easily, or may have components that aren’t well-fit to your device.

This will lead to data transfer interruptions (which can corrupt your device), electrical shorts, and other disasters that will come at the wrong place at the wrong time.

Invest in high quality accessories to ensure the safety of your data.

5. Try to guess your PIN

If you’ve forgotten your PIN or passcode, do not try to guess it over and over. Find a way to confirm what that PIN is, or get in touch with support to find out what your options are.

Entering a password or PIN repeatedly is the fastest way to lose your data forever. Too many incorrect entries will permanently “brick” your device, making it useless and rendering your data destroyed. This is often referred to as the device being in “Disabled Mode”. It is a security feature implemented in order to make the phone as secure as possible for anyone – from politician to technology executive,

By following these easy suggestions, you’ll be a world apart from most of the customers who come to us with a mobile device data crisis. In the event you do have a crisis and need your phone or tablet data recovered, give us a call at 866.786.5700.

Cyber Security Basics

A common example of a call we receive is, “I need your help. My spouse just identified that someone has hacked into our PayPal account and is withdrawing $1,700 per month. We have contacted our bank, but they are not willing to help. We contacted PayPal, and they indicated that they have ACH number. We are afraid that they have all our other accounts, passwords, and contact information. Can you help?” Cyber security isn’t household talk yet, but people are learning about its possibilities, and the risks they take when operating in the digital world.

Common Types of Cyber Attacks

Individuals and small business owners are becoming increasingly aware of common types of Cyber Attacks, but rarely are they aware of all the different ways they can happen. These attacks can include (but aren’t limited to) locking them out of their business files, defacing their websites, or stealing money. The most common cyber security attacks are:

• Malware – a specific kind of software that’s designed to cause damage, disrupt, or create access to a computer system or network.
• Phishing – when a scam is set up to impersonate a reputable person or company in order to acquire personal / sensitive information directly from a user – such as passwords and credit card numbers.
• Man-in-the-middle attack (MITM) – this is an intrusion that involves a third party that intercepts, monitors, and alters communications between two parties without them knowing. For example, being able to intercept chat messages with a banker.
• Distributed Denial-of-Service (DDoS) – when an attacker overloads a network resource, such as a website, rendering it unusable for its intended users
• SQL injection – A SQL injection is when an attacker accesses a database and alters its code in order to exploit it, such as coding it to extract private customer information from your private business records.
• Zero-day exploit – This type of attack is particularly dangerous, because it happens long before the users in question are aware of the exploited vulnerability. The attack happens the same day the vulnerability is identified by the attacker, before the user is ever made aware of the specific gap in security.
• DNS Tunnelling – It is one of the most damaging DNS attacks. It encodes the data of other programs or protocols in DNS queries and responses. It often includes payloads that can be added to an attacked DNS server and used to control a remote server and applications.
• Business Email Compromise (BEC) – An attacker impersonates a corporate email address, impersonating an individual in order to exploit and/or manipulate the user(s).
• Cryptojacking – When an attacker installs malware on a user’s device in order to mine / steal cryptocurrency without their consent.
• Drive-by Attack – A drive by attack is when a malicious piece of software is downloaded to your device without your consent, and potentially, without your knowledge. You may not know this code ends up in your device at all, or you may think you’re downloading one thing, but you’re actually downloading something harmful.
• Cross-site scripting (XSS) attacks – When malicious code is injected into an otherwise trustworthy website, with the intention of exploiting the users who visit that site.
• Password Attack – A cyber attacker uses a host of possible passwords on a user’s security systems, hoping that one of them works (usually banking on the idea that people often repeat passwords).
• Eavesdropping attack – Similar to a “man in the middle” attack, this involves an attacker “snooping” or “eavesdropping” on communications without the users’ knowledge, in an attempt to acquire sensitive information.
• Al-Powered Attacks – An aggressive and targeted cyber attack that uses artificial intelligence to determine the most vulnerable security points in your system.
• IoT-Based Attacks – Internet of things (IoT) is easily one of the most versatile technologies in existence today. It is the primary force behind the biggest distributed denial of services (DDoS) botnet attacks for some time. Numerous IoT device manufacturers continue to ship products that cannot be properly secured.

Unfortunately, most individuals and small business owners do not carry cybersecurity insurance, or have enough money stowed away to afford a full incident response lifecycle. This typical lifecycle includes preparation, detection & analysis, containment & eradication, and post incident activity.

These attackers usually first analyze their target (reconnaissance), then they initialize an exploitation to intrude the network. Once established, they will then start to dig into your systems. They will try to move across your network quickly, looking for further exploitable data to take advantage of. Once they find the key data to collect, they exfiltrate and exploit the information. Once they have hit this phase, they are usually in and out of your network rather quickly.

How Cyber Security Works

It is unnerving because you don’t know if your system is clean, or if they have placed spyware on your system that watches your every move. The cybersecurity industry processes consist of the following segments:

• Proactive Protection – Hardware and software to keep your systems secure
• Monitoring – Scanning logs to detect intrusions or gaps
• Consulting – Analyze your business in order to receive pointed security recommendations
• Incident Response – Analyze a security breach in order to assess damage and recovery of data or funds
• Recovery – Recover any lost data or business functions that were negatively impacted by the data breach

Cyber Attacks – What To Do

If you are locked out of your business systems, your web site has been defaced, or you have lost money, then you require Incident Response services. Understanding your networked media, passwords, roles within the network, who belongs to which user group, and the privileges each staffer is granted are all required when preparing to deal with an incident. It is important to identify patient zero, so to speak, but most of the time, that’s rather unclear at first. Detecting how the network was compromised is critical to identifying, isolating, and eradicating any harmful factors that have been left behind.

Depending upon the network, this may take several ten-hour days to several weeks. Once the threats have been identified, contained, and eradicated, then you’ll need a follow up, post-incident action recommendation to ensure that this doesn’t happen again.

If an individual or small business is not able to activate an incident response team, then the following steps are your best bet to achieve a resolution and minimize damage:

• Unplug your internet connection
• Find a Password Manager: (Last Pass, One Pass, etc….)
• Change all your passwords
• Authorize 2-Party Verification
• File a Police Report to your local authority
• File an IC3 Report to the FBI
• Run a malware & anti-virus scan
• (Stole money?) Contact your financial institutions

Unfortunately, it will be rare that the individuals causing this havoc will be caught, but following these suggestions and you will be better prepared then most and hackers usually go for the weakest target.

When we get a call like the one we discussed above, we notify them that if a hacker has their ACH number, they would usually get in and get out with as much money as possible in as little time as possible. We might even mention that there could be some sort of payment schedule to a bill they don’t remember.

On this particular example, we received a notification days later explaining that this was exactly the case. It was a loan payment that was forgotten about, but they did implement the suggestions above, and already feel safer and more informed.

If you think you’re a victim of a cyber security attack, don’t hesitate to call us at (866) 786-5700. We will consult with you to see if your suspicions are valid, and then scope out the work accordingly. We’re here for you.

iOS exploits and their impact on digital forensics

Last September, the iOS hacking community got a big surprise when a security researcher named axi0mX released a ‘game changing’ exploit called ‘checkm8’.  What makes checkm8 so unique is that unlike previous exploits, it is a Boot ROM exploit. This means that on affected devices, there is no way for Apple to patch it via software updates.

To be clear, this exploit is not a remote threat, as the physical device must be tethered to a computer. Further, it does not allow someone to bypass your PIN or Touch/FaceID. The exploit is also non-persistent.  Meaning that once the device is rebooted, the exploit is removed.

The affected devices are and iPhone and other iOS models such as iPad running Apple’s A11 chip or earlier.  Which basically means, any iOS device before and including the iPhone X. The iPhone XR, XS, 11, and Pro models are not included in this exploit.

How can this new exploit help us in digital forensics? 

The checkm8 exploit now allows us to obtain an entirely new level of device data extraction which, up to this point, was impossible. Previously, on Phones newer than the iPhone 4, we were essentially only able to get what equates to an iTunes backup of the device. In many cases, this is fine.  However, over the years Apple has made it increasingly difficult to recover deleted information from chat databases and other application data by using a vacuum-like function that cleans up databases more frequently than earlier iOS versions.

Checkm8 allows a forensics examiner to exploit the device, collect the file level decryption keys and then extract the entire active file system of the device including the keychain and other valuable data previously unattainable by earlier extraction methods. Previously, we were only able to get parts of the data which were approved to be included in iTunes backups. The aforementioned non-persistence is great because no user level data is altered, and we no longer even have to boot the device into the native iOS.

For example, below are the results from a test iPhone in our lab on which we performed two separate extractions: Advanced Logical vs Checkm8.   The first screenshot from Cellebrite Physical Analyzer shows what was retrievable via the traditional Advanced Logical extraction, about 8.5 gigabytes of data.

The next screenshot, below, shows the data which resulted from the checkm8 full file system extraction of the exact same iPhone:

The difference in readable data obtained is staggering! The full file system extraction pulled approximately 36 GB of data, vs the 8.5 GB obtained via the advanced logical method. With Chat messages alone we were only able to obtain 251 messages and 9 deleted messages via the old method. With the exploited method we recovered 3228 messages and 75 deleted messages.

Another key area is that the phone stores logs that are usually inaccessible to the users. These logs store massive amounts of data related to how a user interacts with a device as well as tons of extra location data.  There is a treasure trove of information that we are still just discovering.

Think about the implications of this extra data in a criminal investigation or traffic accident cases.