First aid

First aid after data loss

The first few minutes decide more about a data recovery than everything that happens in the lab afterwards. Not because there is any rush — but because almost every well-meant reflex makes the damage worse.

The one rule that always applies

Cut the power. Immediately, and then leave it that way. A faulty storage device does not repair itself while running — it deteriorates. With mechanical damage, every further revolution drags the damaged head across the magnetic platter. With a short circuit, every start attempt pushes current through a component that can no longer take it. With a logical error, the operating system keeps writing in the background even if you do nothing at all.

That sounds trivial, but it is the most common reason why a recoverable case ends up beyond recovery: there are often a dozen start attempts between the first failure and the call to the lab.

What you should never do

  • chkdsk, “repair drive”, fsck

    These tools write. They rebuild the table of contents on the basis of already damaged information and in doing so overwrite exactly those references from which the files could otherwise still have been reconstructed. On a healthy drive with a small logical error this is a sensible tool. On a faulty one it is the opposite.

  • Recovery software on faulty hardware

    Programs that scan the drive from within the operating system read block by block from start to finish and keep the hardware under full load for hours. For a deleted folder on a working drive that is the right approach. For a drive that clicks, gets hot or disappears midway it is the fastest route to permanent loss.

  • Formatting or initialising

    “You need to format the disk before you can use it” does not mean the data is gone. It means the table of contents is unreadable. Confirming creates a new one — on top of the old one.

  • Opening the enclosure

    The read/write head of a hard drive floats a few nanometres above the magnetic platter. A speck of dust is many times that size. A drive opened in room air is afterwards almost always harder to recover than before.

  • Swapping the circuit board for an identical one

    A widespread piece of forum advice that has not worked for a good fifteen years. Modern hard drives store individual calibration values in a chip on their own board. Without transferring those values the drive does not become readable — and in the worst case the attempt damages the firmware area as well.

  • Rice, hairdryer, oven, freezer

    With water damage the problem is not the moisture but the corrosion it sets in motion — and that continues underneath components and shielding cans, where neither rice nor warm air ever reaches. Cold produces additional condensation inside the device as it thaws.

  • With RAID or NAS: starting a rebuild

    The most dangerous reflex of all. A rebuild reads all remaining drives in one go for days and overwrites the existing redundancy in the process. More on this in its own article.

  • On a smartphone: factory reset or reflashing the firmware

    Current devices encrypt every file individually. A reset destroys the key material. Afterwards the data is still physically present and nevertheless unreadable forever.

What you should do

  • Write down what happened

    Drop height, contact with water, power failure, since when the noises have occurred, which software has already run. That determines the route through diagnosis — and above all what is not attempted in the first place.

  • With several drives, label the order

    In a RAID array or NAS the position in the enclosure determines the order within the array. Stick the bay number on every drive before you remove it.

  • Look for a backup

    Cloud recycle bin, an old backup drive, the same photos on a second device, that email attachment from back then. The best data recovery is the one that turns out to be unnecessary.

  • Have a diagnosis made before anything is attempted

    A diagnosis tells you whether the case is logical, electronic, mechanical or hopeless. Only then can you decide whether the effort makes sense.

One sentence that can save you a lot of money

If a storage device is still under manufacturer warranty: recover the data first, then have it replaced. A warranty replacement gives you a new device — your data stays in the old one and is therefore gone.
Common questions

Answered briefly.

My hard drive is clicking. May I connect it once more to quickly copy something?

No. Clicking means the head can no longer find its track. Every start attempt drags it across the magnetic platter again. That is exactly how head damage turns into surface damage — and that is the most demanding form of data recovery there is.

I have already run recovery software. Is everything lost now?

Not necessarily. With a logical error on healthy hardware a read scan usually does no harm. It becomes critical if the software wrote to the drive or if the hardware was already faulty. In any case, tell us what has been run — that is part of the diagnosis.

How long may I wait?

As long as the device is switched off there is no clock running for most fault patterns. One exception is water damage: there the corrosion keeps working, and every day counts.

A specific case?

We will take a look at your storage device.

The Economy diagnosis is free of charge. You find out what is possible before anything costs money — and what it would cost is put in writing beforehand.

Wasserweg 8–10 · 60594 Frankfurt am Main