Top five extraordinary data recoveries from 2019

With 2020 now in full swing, we thought we would take a quick look back at some of the most memorable data recovery projects we saw over the course of 2019.

From personal users to the largest corporate organisations, we handled over 50,000 data recoveries in 2019 alone, across a wide variety of data storage devices and data loss scenarios.

While every data recovery is unique and has its own story behind it, here are our top five stories from the past year, across our global data recovery laboratories and cleanrooms.

1. Chicken and hard drive meal for two

A husband and wife were on a voyage on a private yacht for several months. As a lightning storm approached, the couple decided to put all of their electronics into their portable oven, after having read that the metal casing would provide protection from lightning strikes.

A few days later, after removing their electronics the husband set about cooking himself a batch of chicken nuggets, only to find that they’d accidentally left one of their external hard drives inside the oven. The drive got quite melted before they noticed the smell. Luckily, Ontrack engineers were able to achieve a full recovery of the ‘pre-nugget’ data.

2. Time-lapse cut short

One of our customers set their phone up balanced on a balcony railing to capture a time-lapse of a beautiful sunset on holiday. Unfortunately, a sudden gust of wind blew the phone off the balcony and it fell eight floors to its death below. Fortunately for the customer, Ontrack was able to repair the destroyed phone to an extent where we could recover all the data inside, including a video of the fall.

3. Macbook recovery from aircraft crash

Ontrack was approached with a highly sensitive Macbook recovery where the device had been in an aircraft crash. Important company information was needed from the embedded SSD, however, the Macbook itself had suffered severe fire damage, as well as water, smoke and jet fuel contamination.

Due to the complexity of the recovery work and the extent of the damage, Ontrack engineers needed to use specialist tools and build a bespoke fumes exhaust hood to be able to work on the device safely.

After carefully cleaning the motherboard in several stages and replacing parts that were only available from one supplier, Ontrack engineers managed to reconstruct the board and fix the drive to the point that the data could be extracted. All of the sensitive data on the drive was then successfully recovered and sent to the client.

4.   Business break-in leads to bleached drives

A business in Australia was broken into, and the customer had two RAID systems running in the office; a 2x 12TB RAID1 using thin pools and encrypted LUNs, and a 7 x 2TB RAID5 presenting out several virtual LUNs. Two drives were missing from each system, assumed to be stolen in the break-in. Two weeks later the customer found the four removed drives hidden in the office, however, they’d been placed into a bucket and soaked in bleach for the two weeks they were missing. All drives were sent to the Ontrack cleanroom in Brisbane.

The damaged drives were heavily corroded, however, Ontrack’s cleanroom engineers were able to clean up the electronics and return the drives to a state where they could be imaged. Once the failed drives had been imaged successfully, Ontrack lab engineers were then able to rebuild the logical structures and recover the critical customer data. We were able to achieve a 100% recovery of the RAID1 and a 99% recovery of the RAID5.

The below image shows one of the 12TB helium drives before and after cleaning from Ontrack cleanroom engineers.

5. Ransomware attack leaves corporate IT system crippled

A large German company suffered a cyber attack which left 100 servers partially encrypted. The ransom proposed by the hackers was over 400,000€, and federal police could not identify the ransomware type. It was determined that the attack was highly targeted to this customer, and nothing like it had been seen before.

The customer had an IBM SAN with 50 drives and after forensic analysis, it was found that data inside the LUNs were either deleted or overwritten. This affected six LUNs which were 25TB each in size and had different file systems – four ReFS and two with NTFS.

Ontrack engineers in Böblingen, Germany managed to repair the logical damage to the point that the ReFS file system could be recovered 100% file by file. Ontrack’s in house development team then needed to create custom tools in order to piece together the NTFS file system and deduplication database, so that data from a Veeam backup could be extracted and delivered on an ongoing basis to the customer.

That wraps up our review of the top five most memorable data recovery cases that Ontrack saw in 2019.