Disk recovery service saves Wired writer from losing everything after MacBook Air hack

Mat Honan, a senior writer for Wired magazine, became the poster child for victims of hacking earlier this month when he wrote about how intruders broke into his Google, Twitter, and iCloud accounts. The hackers used the latter to remotely erase all of the data on his iPhone, iPad, and MacBook Air. In a matter of an hour, he said, “My entire digital life was destroyed.”

Honan had been relying on a cloud service to house all of his data, with no secure backup system. But not all was lost. DriveSavers Data Recovery says it was able to salvage Honan’s most precious data through its secure data recovery process.

“It was a big story when he lost it,” said Chris Bross, a data recovery engineer at DriveSavers in Novato, Calif. “I wondered if we were going to get involved.”

Leo LaPorte, a longtime tech writer and broadcaster, and an Apple Store employee referred Honan to DriveSavers. The company focused on the MacBook Air for recovery. The data on the iPhone and iPad was encrypted by default, and so it was not recoverable. When the remote wipe is done on those devices, the relevant encryption key information was lost and so it was unrecoverable.

The MacBook Air has NAND Flash memory instead of a hard disk drive for permanent memory. That device was also remotely wiped, but that only affected 25 percent of the solid state drive (SSD). It did not completely finish the job because it was interrupted, perhaps because Honan disconnected it.

“He interrupted that process from completing and that was super-critical,” Bross said. “That was great timing.”

DriveSavers was able to extract the SSD from the computer and recover the data. At first, the company uses a method to copy the contents of the drive to its own secure disk. They then worked off the copy of the disk. The directory information was lost, so DriveSavers had to decipher the raw digital data on the drive. About 25 percent of the data was a bunch of zeroes. That was gone for good. But then they saw actual numbers coming through on their scan.

Honan said he had recovered all of his tens of thousands of photos.

“I nearly cried,” Honan wrote.

He was able to examine all of the data. Huge video files were intact and perfectly usable. He lost his applications, but he said he will be able to recover those.

Honan, of course, now backs up his data with physical copies.

The fee for the DriveSavers service is based on how large the media is and what data is recovered. It’s zero if DriveSavers fails to get back any of the desired data. Honan said he paid $1,690.

[Photo credit: Wired]

0 comments