Data loss can broadly be divided into two categories, Logical data loss (software related) and Electro-mechanical failure (hardware related).
Logical (software related) data loss - The device is mechanically working but suffers from a software issue.
The most common causes of logical data loss:
- Formatted device - Formatting alone leaves the data areas (on a sector level) intact despite not being accessible via the operating system.
- Operating system re-installation or reload - Data that was on the device, prior to reinstalling the operating system, and/or applications (with or without formatting) is normally intact (on a sector level).
- Deleted file(s) and/or folder(s) - Accidental or intentionally deleted directories and/or files are normally intact (on a sector level).
- Deleted or corrupt partition(s) - Deleting a partition alone leaves the data areas (on a sector level) intact despite not being accessible via the operating system.
- Data corruption - could be due to number of factors including storage device quality, application quality (e.g. bad programming), memory quality, power stability, incorrectly shutting down devices or applications and incorrect ejection of removable drives.
- Virus-infected or malware - Viruses and malware are malicious software applications that can delete, corrupt or encrypt your data for ransom.
- Hacked - Can originate from inside or outside of your computer or network.
Data can in most cases be recovered and successfully investigated using specialised data recovery and forensic software unless the data areas have been compromised - overwritten, corrupted, encrypted or due to SSD trimming. The success rate would be dependent on the file sizes, file location and fragmentation before the potential data loss scenario, data activity after the incident and type of encryption. The best advice is to stop working, the moment you suspect data loss, and not to attempt to access the advice if you wish to have the best possible chance of recovering or investigation your data loss.
Electro-mechanical (Hardware Related) device failure refers to physical problems with your storage device.
The most common symptoms and causes of electro-mechanical failure:
- Dead device. The device is not detected e.g. the hard drive fails to spin-up when power is applied. This is normally due to a damaged PCB (printed circuit board) caused by power fluctuations, surges or spikes as a result of a faulty power source, power failures, lightning and water, or other liquids.
- Noisy hard drive. Clicking (clacking, knocking) or scratching noises are normally as a result of broken or damaged read/write heads (commonly referred to as a head crash), platter damage or firmware corruption.
- Drive not spinning. The drive is making beeping or buzzing noises and when power is applied typically due to spindle motor seizure.
- Drive spinning but not detected. This could be due to firmware corruption, damaged read/write heads or a faulty PCB.
- Drive spinning up and down repeatedly. The drive spins up and down repeatedly when power is applied. This could be caused by faulty read/write heads, firmware failure or a faulty PCB.
- An excessive number of bad sectors. The data on the drive is not accessible or the drive may struggle to read or write data. Typical indications could be Cyclic Redundancy Checking or CRC errors when reading or writing data or drive repeatedly runs a scan (scan disk) at start-up.
- Drive contamination. Hard drives are extremely sensitive to contamination. This is one of the reasons we have a class 100 cleanroom where we can safely open hard drives without the risk of external contamination. Once a drive has been opened in a non-clean environment the risks for data loss increases substantially. We typical encounter fingerprints on the surface of the platters and/or dust contamination caused by D.I.Y. or other unskilled data recovery attempts.
Data can in most cases be recovered and successfully investigated using specialised data recovery and forensic software, tools and equipment unless the platters or magnetic field have been severely damaged. The most common reasons for electro-mechanical device failure includes failed components, rough handling (bumping or dropping), manufacturing and power source issues. The best advice is to stop working, the moment you suspect data loss, and not to attempt to access the advice if you wish to have the best possible chance of recovering or investigation your data loss.