Archive for April, 2007

What Is Data Entropy?

Saturday, April 28th, 2007

The concept of Data Entropy is greatly used in RAID Reconstructor. Invented by Claude Shannon in 1948, it provides a way to measure the average number of bits needed to encode a string of symbols.

When looking through an unknown set of raw data on a drive, we calculate the number of bytes needed to encode the content of any given sector. Since a sector contains 512 bytes, this is a number between 0 and 512. If we divide this by 512 we are dealing with a number between 0 and 1. A sector containing only ‘a’s has an entropy near 0. A highly compressed JPEG has entropy near 1.

Have a look at popular compression utilities such as Winzip or Winrar. If these programs compress a file with 1,000,000 bytes to 1000 bytes the entropy is around 1000/1,000,000 which is 0.001. A 1,000,000 bytes file compressed to 900,000 bytes has entropy of 0.9. Shannon’s formula enables us to calculate the entropy without actually performing the compression.

But how does this help us to reconstruct broken RAID’s? Most files have consistent entropy that does not vary much between sectors. For example, the entropy of the English language averages 1.3 bit per character. This means you need 666 bits (=83 bytes) to encode a sentence with 512 characters (stored in one sector). Our entropy of this sector containing English text would be 83/512 which is 0.16. You can assume that sectors with similar entropies belong together. This is how RAID Reconstructor decides what the drive order and the block size are for drives that previously belonged to a RAID. It also explains why sometimes RAID Reconstructor’s analysis fails. If the probed areas on the drives contain a huge amount of all the same kind of data, there is nothing RAID Reconstructor can “see”.

Next week I will have a look at RAID Reconstructor’s Entropy Test.

Uwe

Scanning the image from RAID Reconstructor

Thursday, April 19th, 2007

Now we will look at how to scan that image that was made using RAID Reconstructor in the previous post. An image is just a file copy of a physical drive. There is no difference in scanning a physical drive over scanning an image, they contain exactly the same data.

Start GetDataBack for NTFS and from the Welcome screen, choose what type of recovery you want to do and click next. You will now be presented with the available drives to scan for recovery. Under the physical drives and logical drives, you will see the option that says Image Files (load more…). You can click on Load More and you will be presented with a select file box. You can then browse to your image and select it to open that image as the drive to scan. Once you have done this, click next in the bottom right hand corner to scan the image in the exact same way as a physical drive.

Please watch the tutorial for more information and detail on how to do this exactly. If you have any questions, feel free to email us at support@runtime.org

Watch the tutorial

Recovering from a broken RAID 0

Thursday, April 12th, 2007

The first thing to know about RAID 0 is that it is not a replacement for a RAID 5. This seems to be the biggest misunderstanding about RAID 0′s. People have a drive physically die and then think, “Well next time I will build a RAID 0 and not have this happen ever again.”, then they call us asking why it failed.

RAID 0 arrays will suffer the same issues as a single drive, if the drive physically dies, the only thing you can do is send it to a hardware recovery company. You will have the same issues with creating a RAID 0 that has more then two drives, if one dies, then the entire array will go down. This would be like having an airplanes with six engines and if one of them fails, the plane crashes. If you have more than two drives, make a RAID 5.

This is where RAID Reconstructor comes in. If your array is broken because of controller issues or you do not have the orignal computer you created the array in, RAID Reconstructor can help you. It will allow you to take a two drive RAID 0 and de-stripe it into a single image or back to a drive. If you make the image, then you can scan that image in GetDataBack for NTFS. If you write the data back to a single drive, the file system and partition table of the array must be intact, otherwise you will end up with an empty drive that you will need to also run GetDataBack for NTFS on to recover the data.

If you run RAID Reconstructor with the default settings on a RAID 0, you will not get the recommended entry as most RAID 0 arrays do not start at sector zero. Watch our video tutorial to see exactly what must be done to get a recommended entry.

Watch the tutorial

How Long Will A New Hard Drive Work?

Wednesday, April 4th, 2007

Hard drives not only can fail, they definitely will fail sooner or later. Drive manufacturers express the reliability of a drive as the MTBF (mean time between failures). A modern hard drive, such as a Western Digital Caviar WD400EB, is given the impressive MTBF value of 500,000 hours. This is more than 57 years.

Does this mean you can run the drive for 57 years on average? No. The MTBF figures are only valid during the Component Design Life or Service Life, e.g. five years for the Western Digital above. If you bought 1000 drives you could expect one drive failure every 500 hours (21 days). If you operate 100 drives you will have a failure every 5000 hours (208 days).

Since the MTBF specification is only applicable within the service life you cannot predict how long the drive will run thereafter. A drive rated with an MTBF of 1,000,000 hours will not run twice as long as a drive rated 500,000, it might even have a shorter life. The first drive will fail half as often in the first five years. If you want to realize the total running time of 57 years you would have to buy 12 drives and operate them successively, replacing one drive every five years.

It is important to understand that MTBF and Service Life are theoretical and estimated figures. A drive manufacturer does not test a new drive for five years before releasing it. He will use historical data from similar drives and failure rates of the components of the new drive to calculate its MTBF. It is probably a more realistic picture to use the Warranty length as the Service Life, because that is what will cost the manufacturer money.

MTBF and Service Life are meant to be average figures when operating the drive within its environmental specifications. Administrators who operate a hard drive in a dusty industrial surrounding can tell that they often fail within a year.

A typical temperature rating is 5 C to 55 C. You must not use the drive at freezing temperatures. The high end of the scale is easily reached if the drive is mounted in a case without sufficient cooling. Overheating can destroy the electronic board on the drive or damage the platters inside.

The altitude rating (e.g. -1000 feet to 10000 feet) is important because the heads ride on a cushion of air. The altitude determines the thickness of the air cushion. 10000 feet is the upper limit. This is a vital restriction to remember when traveling by airplane. The cabin pressure of an airplane is usually maintained at the equivalent of 5000 to 8000 feet. In case of a catastrophic decompression the cabin altitude can increase to the actual airplane altitude of up to 40000 feet before the pilot descends to a lower altitude.

A drive’s read/write heads have direct contact with the platter when the drive is not spinning. As soon as the rotation speed reaches the operating speed the heads ride on a cushion of air. During acceleration from a stop and deceleration from full speed spinning the heads will be abraded by the special platter area they are riding on. Hard drives are designed for a limited number of these start/stop cycles only. A typical drive is rated 40000 start/stop cycles. This value is meant to be the minimum of cycles the drive can endure before failure.

At the end, a defective electronic board, abraded read/write heads, scraped platters or misaligned platter stacks, can cause the failure. Normally, the drive still spins but you will hear a clacking and rattling noise. At this point, the only thing you can do is sending the drive to a data recovery lab.

Fortunately, hard disk failures do usually not appear sudden. They develop over time and an attentive user can catch the warning signs soon enough to save the data. The most telling signs of a disk that soon will fail are abrupt recalibrations (clicking and moving of the heads) and the development of bad sectors. You should try to backup your data immediately. If the file system’s logical structure is already damaged, you can recover your files with GetDataBack. It is always a good idea to create a sector-by-sector image of a failing drive. Thus you reduce the stress for the drive and can do the data recovery with GetDataBack from this image.

Uwe
Runtime Software

DriveImage XML

Tuesday, April 3rd, 2007

Because DriveImage is free, we do not offer support for it, however there are plenty of places to find the information you need. Here are a few of them:

http://www.runtime.org/dixml.chm

http://www.runtime.org/driveimage_faq.htm
http://www.habibbijan.com/articles/ghost-windows-xp-for-free/ (a user’s tutorial)
http://frozenpixels.wordpress.com/backups-part-1/(another user’s tutorial)

You can also watch our video tutorial here:

Watch…