We all know why we need backups. Hard drives fail, files get corrupted or deleted yadda yadda yadda.
And whilst (most!) people these days understand this and have implemented some sort of backup, how many of you have an offsite backup of your data.
I’ll give Apple this, their iCloud service is a great no-thought-required solution, if your entire data set is inside the Apple eco-system (laptop/phone/tablet). But if you either aren’t paying for an upgraded plan, or if you have a mixed-OS environment, then at least some of your data is not being backed up.
Even when you have a comprehensive backup solution in place, if all the data is being stored in the one place, then your backup solution has a fatal flaw.
Exhibit A
These were a good friends backup drives, containing priceless and irreplaceable photos, as well as a variety of documents spanning many years. After a house fire that gutted the entire place, they asked me if there was any chance of getting any data back. Basic data recovery I can handle, but this was on another level. So I conferred with some of my industry colleagues and after triaging the drives, it was determined that the damage was indeed fatal. I had one organisation indicate that they would be willing to give it a go, but the bill would likely be in the multiple-tens of thousands of dollars range with absolutely no guarantee of being able to retrieve any data. After delivering the bad news to my friend, I asked them if I could use them for an instructional and they were happy for me to do so. So here it is: what a does a hard drive look like after it’s been through a house fire.
Out of the stack of drives, I chose the one that looked in the best shape from the outside.
As you can see, the label of this drive is still visible and whilst there is some discolouration of the case, it doesn’t look all that bad. The circuit board and SATA connector were melted to a slag but the integrity of the metal housing appeared to be good. Removing the screws wasn’t too much of an issue, but that was when things got a bit worrying. The glue which holds the top on had failed entirely: it had become a slightly sticky brown goo which didn’t have a lot of hold power.
Taking the top off, things went downhill very quickly. As you can see, it is a mess. For those that don’t know how a hard drive works, here is a basic guide introduction: the data is stored on discs called platters (the big circular bit in the image). In a 3.5″ hard drive like this one, which you usually find in a desktop computer, there are typically between 4 and 6 platters. The platters are double-sided, meaning data is stored on both sides of the platter. The data is written to and read from the platters by a “head” which is moved across the surface of the platter by an actuator arm (the shiny wedge shaped thing to the right of the platters in the image). So for a hard drive to work, at a minimum you need the platters to be free from dust and debris, the surface to be intact, the heads to be functional, and the actuator arm to be able to move the heads across the platters.
As you may have guessed, none of those things are present in the above image. There is a lot of debris, including a big glob of melted plastic, obvious discolouration on the platter, and the actuator arm is stuck (because of said big glob of melted plastic).
One of the most common ways a hard drive fails is the heads or the actuator arm fails and as such, the data cannot be read from the drive. If that happens though, it is possible FOR PEOPLE WITH THE RIGHT TRAINING AND EQUIPMENT to transplant the platters from the drive to another one with working heads and actuator arm and read the data off the platter. Don’t try this if you don’t have the requisite training and at least an ISO Class 100 clean room to work in. If you don’t know what that is, don’t attempt this. Even the smallest pieces of dust can render the data on a platter unreadable – this is not something that can be done at home.
Anyway, back to our drive. Let’s see if we could potentially transplant these platters into another drive and read the data off them. First things first, let’s get rid of the big glob of melted plastic (BGOMP).
I’m not actually sure what this plastic was in it’s previous life, or what purpose it served. Whatever it was, it is no more.
Right BGOMP gone, let’s take a closer look at that platter.
As you can see, the BGOMP has left some residue on the platter, and there is some significant discolouration around the edge. This doesn’t look good. Let’s take a look at the heads and actuator arm.
Erm, yeah, that doesn’t look like it’s going anywhere. The plastic of the electrical interface is melted in a bad way. What’s interesting is the ribbon cable which transmits data to and from the heads (the brown cable at the bottom of the image) appears to be in ok shape.
Whilst this photo isn’t the best, you can see more of the melted electrical interface, and you can see the obvious damage to the heads (at the tip of the actuator arm). This drive isn’t reading or writing any more data. Let’s have a look at the actuator itself. 
Taking the cover off the actuator assembly we find that the heat has delaminated the coating on the metal of the actuator assembly components. You can see that coating flaking off, which is obviously one of the sources of the debris throughout the interior of the drive.
Turning it over, you can see how the coating peeling off, right down to bare metal.
This is the copper coil for the actuator which is used to move and control the actuator arm. It’s usually a nice shiny copper colour. Not so much anymore. Right, back to those platters.
The platters are held in place with a central spindle. You can see there is a buildup of an ash-like substance here. Six screws and some gentle persuasion and the top platter is free.
And there is even more discolouration on the bottom of the platter. You can also see that there is a buildup of debris on the surface as well.
After a good scrub with a wetwipe and some isopropyl alcohol, there are still areas with physical debris on the surface, as well as major discolouration of the platter surface, both of which are fatal to the data that was written onto the platter.
One of the types of debris is this gooey black stuff. Even with a bit of gumption and isopropyl it really didn’t want to come off. I’m sure there is a better cleaning solution for it, maybe some of the citrus-based goo removers, but I didn’t have any on hand when I was conducting this examination. Needless to say, using such cleaning solutions on the platters will probably render any data under them at least partially corrupt, if not entirely unreadable. I’m sure the experts at data recovery have the right solutions and tools, but I don’t. Now let’s see how the other platters have fared, further away from the heat of the fire.
Here’s platter two in all it’s glory and whilst it’s in better shape and platter one, it’s still in a bad way. Lots of discolouration, lots of physical debris, and the same gooey stuff on the edges.
Here’s the back of platter two, which appears to have more discolouration but less physical debris on it, save for the one big patch in the top right corner.
Here’s the top after it was cleaned and yeah, you’re not getting any data off this platter.
Platter three shows more of the same. It’s interesting to note that it started to get difficult to get the platters off at this point. The ash around the central spindle meant the platters, which are usually pretty snuggly fit anyway, really struggled to come up, which meant that I had to use a lot more force on the platters. This would also create problems with the platter surface and make any recovery more difficult. Whilst I’ve no doubt if this were being done by a professional they would have the right tools and techniques to make this easier and use less force, it’s obviously still a risk.
You can see that there is still significant discolouration on this platter, so being away from the outside of the case hasn’t protected the platter much. It’s in better condition than platter one no doubt, but this platter has still obviously seen some serious heat.
The back of platter three shows just as much discolouration and physical debris as the previous two platters.
Platter four is the last in this particular drive so it’s essentially the “outside” platter on the bottom of the drive. And boy does it show it. Similar levels of damage as platter one, with heavy discolouration and physical debris. The section on the bottom right is more of that black gooey stuff.
There is actually a bubble effect on the surface of this platter and it wasn’t any foreign material, it’s something that was “in” the surface of the platter.
And there you have it. You can see there is still plenty of physical debris in the drive housing after the platters are removed. All in all, the drive was in a state which was not unexpected from having been inside a house fire. The other drives which were in even worse shape externally are likely to be in the same if not worse condition. One thing I was surprised by was that there didn’t appear to be any moisture in the drives. Given that the fire was put out by the the local fire department which dumped who knows how much water on to the place, I would have thought that there might be some water penetration into the drive, but I didn’t see any real evidence of it having occurred. I should note though that the fire was a couple of years ago now, and the drives have been sitting in offices being examined so any water that may have been inside the drives may have dissipated, but even so, there are no obvious signs of water damage which, given the amount of ash and other blackened debris, would normally be pretty obvious.
So there you have it, a look inside a hard drive that has been through a fire. If you have any thoughts or comments, please leave them below. Thanks for reading!
Thanks