Be prepared to remove the hard drive from a laptop computer

If you are shopping for a laptop computer let me suggest that being able to easily remove the hard drive should be an absolute requirement. Perhaps the best way to check on this is to find the user guide online at the hardware manufacturer's website.

If you just purchased a laptop, try to remove the hard disk as soon as possible. Things can go wrong.

In my consulting business, I occasionally have to replace hard drives. Twice I've been thwarted by laptop screws that were in too tight. I've also had similar screws fail me when trying to add RAM to a laptop.  

The screws are very small and may not be made of the hardest metals. Perhaps a stripped screw can be removed, but who wants to deal with this on top of the situation that prompted the hard disk removal in the first place? Plus, extreme care is needed as the hard disk is right next to the motherboard and may contain important files that haven't been backed up.

Removing the hard drive on a new laptop computer means that, if anything goes wrong, the machine can be returned or fixed under warranty. This is the kind of problem you want to have before there is a serious need to remove the hard drive.

There are two reasons why you may have to remove the hard drive, not to mention just wanting to replace it at some point with something better.  

PHYSICAL PROBLEMS

Failing hard disks have to be replaced, of course. My experience has been that hard disks don't just fall over dead, rather they fail in drips and drabs. Specifically, they develop bad sectors (a sector is the smallest allocatable chunk of hard disk space). A couple bad sectors may be nothing to worry about, hard disks ship with spare sectors and have the intelligence to put a spare into service when a bad sector is detected. But, a hard disk with an increasing number of bad sectors should be replaced.

How do you know?

I check using HD Tune, a free portable Windows application from EFD Software. The "Reallocated Sector Count" in the Health tab, shows how many bad sectors have been taken out of service.  HD Tune can also run an error scan looking for failing sectors.

ROOTKITS

Another reason for removing a hard drive came up recently, on Steve Gibson's Security Now podcast. One of the questions in the April 2, 2009 show brought up the subject of removing rootkit malware.

The problem faced by any anti-malware software is that rootkits hide really well and you can't remove something you don't see.

Gibson pointed out that the best way to clean up an infected computer is to remove the infected hard drive and connect it as a data (non-bootable) drive on another, uninfected, machine. This insures that anti-malware software running on the clean machine can see all the files on the infected hard drive.

To make this task easier, you can buy a cable for under $20 that will connect to a USB port on one end and an internal hard drive, sitting externally, on the other end.

If this seems like overkill, it's not. Rootkits are really good at hiding.

To illustrate this, consider the simple task of listing all the files in a folder. There is a command that programs issue to Windows to list the files in a folder. Any normal program running on a Windows machine, regardless of the programming language employed, issues this API command to the operating system.

Rootkits get into the internal guts of Windows and modify the code that Windows runs in response to an API call. This modification lets the malware modify the results Windows returns.

Thus, any Windows application that tries to see the files in the folders where the malware resides, will never see the malware itself. Windows says, in effect, "This folder is empty, move along now". Good software is lied to by the operating system because the rootkit is telling it what to say.

Anti-malware software can't remove what it can't see.

Yes, there is anti-rootkit software, but the best way around this is not to let the infected operating system run at all. By connecting the infected hard drive as a data drive, a clean copy of Windows will see all the files, none of the API call results are filtered.

If you don't remove the hard drive (and treat it as a data drive), you can never be sure that anti-malware run on the infected computer has cleaned up everything.

NETBOOKS

Removing the hard disk from a desktop computer should be a relatively straightforward task. Likewise, removing it from a full size laptop is likely to be simple (check before buying any laptop). But what about netbooks, the cheap small laptops that have to cut corners, both literally and figuratively?

Brad Linder is editor of Liliputing, a web site covering the netbook industry. He says

Some models, like the Asus Eee PC 1000HE come with easy access panels beneath the unit that you can open by undoing a screw or two and popping out the hard drive. Others, like the MSI Wind U100 require that you remove the entire bottom of the unit to access the RAM, hard drive, and other modules. And on some models, like the HP Mini 1000, you'll have to remove the keyboard to access the hard drive, which can be a rather involved process.

Some netbooks however, ship with solid state drives (SSD) rather than classic spinning platter based hard disks. I've never tried removing the solid state memory.

Be it from a physical problem or malware, they day may come when you have to remove the hard drive from a laptop computer. Thus, it's best to insure that you can remove the hard drive before you need to in an emergency.