Files can be recovered after Writing Zeros with WD Data Lifeguard


#1

A casual SMART scan pointed out my  WD 1TB drive manufactured in 2009 unfortunately has several uncorrectable sectors. A following SMART Quick Test fails within 10 seconds with the message:

06-Quick Test on drive 3 did not complete! Status code = 07 (Failed read test element), Failure Checkpoint = 97 (Unknown Test) SMART self-test did not complete on drive 3!

Although the drive itself continued to function within exceptions for the time being, that is, reading and writing files, I bought a new drive and backed up the data from the defective one.

Consequently I prepared the defective drive for RMA. Using the WD Data Lifeguard Write Zeros tool, I wrote zeros (Full Erase) to the drive – twice. General consensus specifies a single wipe to be sufficient to make overwritten data irrecoverable. Lo and behold, the partitions were indeed no longer displayed in the OS and the drive marked as uninitialized.

However, much to my surprise, I was able to restore data I assumed was gone from the drive  with an undelete application. With very little effort I must say (less than one minute scanning).

I wonder what is going on. Did the Write Zeros tool not really wipe the drive? Although this problem could be accounted to the fact the drive IS defective, I had no trouble writing to the drive before. Perhaps I should forget about RMA’ing, as I rather not risk sensitive data exposed. That unfortunately also means that I can’t take advantage of warranty, which is valid until somewhere in 2012, one of the reasons I bought the drive to begin with.


#2

How long did the zero fill take?


#3

About 2 hours per run. Both runs completed succesfully.


#4

Have you solved the mystery?


#5

Nope.

I recently formatted the drive and wrote several 100 GBs of data to it. Afterwards I checked the SMART data. To my surprise, the uncorrectable sector count decreased from 8 to 6. But now it’s at 7. 

I wonder why I can write to the drive and retrieve new data correctly, while Data Lifeguard is unable to clean the drive. Seems like it only wipes the MBR and doesn’t actually write zeros.

Something else, Data Lifeguard on Windows 7 reports a cable error for several drives, including non-faulty ones. I reckon it’s a problem with the SB700 chipset on the Gigabyte MA78GM-S2H motherboard. For example, see  http://club.myce.com/f138/western-digital-cable-test-failed-265602/ On Windows XP this doesn’t happen. Only this bad drive causes an early SMART test error.

Dunno, but I’m getting the feeling Data Lifeguard is not terribly reliable.

As I don’t want to return the drive with recoverable sensitive data (server backups containing customer data), I’m considering requesting a certificate of destruction and sending only the cover plate or circuit board. See:  http://www.experts-exchange.com/Storage/Hard_Drives/Q_23357435.html


#6

I’m guessing that the uncorrectable sector count is a rolling average rather than a cumulative lifetime count.

If Data Lifeguard is only touching the MBR, then what is it doing for the next 2 hours ???

If you suspect DLG’s cable errors are a chipset problem, would it be worth temporarily reducing the SATA speed to 1.5Gbps?


#7

Try DBAN or HDDErase:

a 60GB laptop disk on a PentiumM 1.6GHz system with DBAN at SATA1.5Gbps  takes 22 hours

that same 60 GB laptop drive with HDDErase took 4 hours using the internal security erase feature

HDDerase is processor independant and goes as fast as the disk can write
whereas DBAN is very Processor dependant as it generates the random overwrite data
in the processor before overwriting the sector with the random data
and depending on the system level of security erase used can take a few days to complete

if you don’t have either here are the links:

HDDErase
DBAN

I’d expect a full security erase  / zerofill to take a lot longer than 2 hours on a 1TB disk
especially if it’s being done with software


#8

I guess the aforementioned tools write random data to the disk several times. The theory is that writing zeros once doesn’t sufficiently remove the magnetic field. Data would be recoverable by analyzing the residual field. Something like that. While that may have been true 30 years ago, due to the inaccuracy of the write head among other things, nowadays that theory has been debunked. It doesn’t hurt to use those tools though, in the worst case it’s a waste of time and energy.

In the past month I have reformatted the drive and used it for temporary files and cache. A few days ago I bought a replacement drive (another one!) because having a dedicated drive for temp files and cache is pretty neat. Just to check how badly damaged the faulty drive is, I’ve filled it with large files, then copied them to the new drive. One file could not be copied, there was a read error somewhere in the middle. So the 7 unrecoverable sectors wasn’t just a statistical SMART error: there is actual physical damage.

Yesterday I have upgraded WD Data Lifeguard to version 1.21. The bogus Cable Test error in Windows 7 was fixed. Wrote zeros (complete) as before, took about 3.5 hours. Currently I am checking if any files are detected and recoverable with a lowlevel undelete scan. So far so good, no files have been found yet. So it appears the culprit was a bug in WD Data Lifeguard.

Will inspect later with a raw disk editor.

If all goes well I can RMA the drive this week.

Thanks for your assistence thusfar.