Case Study — Seagate External Hard Drive
Dropped, clicking, and locked by FileVault. Every file came back.
A 1TB Seagate Backup Plus for Mac arrived clicking and beeping after being knocked off a desk. Inside: a stuck head stack, a bent set of heads, and Apple encryption on top. Full recovery, in our own Belfast cleanroom.
The case
A media company's backup drive, silenced by a fall.
Client: a media company in Belfast, Northern Ireland. Drive: a 1TB Seagate Backup Plus for Mac, a portable model also sold as the Seagate Portable, Expansion Plus, and under other names including LaCie, Maxtor and Samsung external drives.
The drive had been knocked off a table. Afterwards it wouldn't mount, and it was making a clicking and buzzing sound whenever it was powered on — the client stopped using it and brought it straight to us rather than trying it again.
Once we opened the enclosure, the mechanism inside turned out to be a Samsung-branded ST1000LM024 Momentus Spinpoint drive — a common find, since Seagate external enclosures don't always contain a Seagate mechanism. It's a solid, robust drive that generally recovers well from a knock, unlike some Seagate mechanisms that can fail for no obvious reason or damage their own magnetic surface.
Diagnosis
Heads stuck to the media, and bent from the fall.
The drive went into our laminar flow cleanroom cabinet for inspection. This isn't a job for a general computer shop or a YouTube tutorial — an untrained attempt to open a hard drive gets it right in perhaps one case in twenty, and the other nineteen times it ends any chance of recovery for good.
Inside, the reading heads had stuck to the media surface and had also picked up a slight bend — exactly what you'd expect from a drive that took an impact while running or shortly after. A specialist tool was used to free the heads from the platter without further scoring the surface, moving them safely back onto the ramp.
The whole head stack was then removed and replaced with a matching set from a suitable donor drive.
Laboratory process
Head swap, full imaging, then decryption.
- 01
Head stack replacement
The damaged, stuck head assembly was swapped for a matching donor set in cleanroom conditions.
- 02
Firmware verification
With the new heads fitted, PC-3000 (ACE Labs) was used to confirm the drive's firmware diagnostics were clean before imaging began.
- 03
Full sector imaging
A DeepSpar DDI4 imager read the drive. Around four hours later, every block had been read with a 100% success rate.
- 04
FileVault decryption
The drive had been secured with Apple FileVault. The client supplied the password, and the recovered image was decrypted on a Mac — without it, no amount of physical recovery would have unlocked the data.
Outcome
100% of the client's data recovered.
Every file on the drive was recovered and handed back to the client. The combination that made this case work was straightforward: the drive was powered off and left alone as soon as it started clicking, and it hadn't been opened or tampered with before it reached us — so the head-stack swap and imaging could proceed on an untouched, if damaged, platter surface.
If a drive has already been opened elsewhere, the tamper-evident seals tell us immediately, and it changes the picture considerably — often for the worse.
Power it off, stop using it, and get a straight assessment of what's recoverable and what it will cost — before anything else touches it.