1. Do not make any rash decisions.
- Some of the questions that you should ask before attempting a D.I.Y. data recovery or sending your storage device to an unqualified third party for data recovery:
- Are you willing to play Russian roulette with your data possibly ruining any chance of recovery?
- How much do you (or your customer) stand to lose if the data is not recoverable vs the cost of having the data recovered by a professional data recovery company?
- The value of your (or your customers) data will ultimately determine your next course of action.
- There may only be one chance at recovering data from a failed or failing drive!
Hard drives, SSD's and other storage devices are a lot more complex than what many people think. Hard disk drives, for instance, are a combination of mechanical, magnetic, electronic and electrical components interfacing with the on-board software programming (or firmware) of the drive and the printed circuit board (PCB) - In essence a computer within a computer. Every-one of these components have to be in a working condition in order for a hard drive to function. Potential data loss is caused when one or more of these components fail. Data recovery, in essence, is a reversal (or the repairing) of the failed hardware and/or software components to a point where the lost data can again be accessed.
2. Do not leave the device powered on.
- Hard disk drives - A knocking (or noisy) head-stack will cause (more) physical damage to the platters and/or magnetic field if left knocking possible making the drive unrecoverable or only partially recoverable.
- SSD's - Solid-state drives use a technology called SSD TRIM or trimming whereby deleted data areas first need to be cleared before new data can be written. TRIM is an automatic function, that will erase any previously deleted data areas making recovery impossible with standard data recovery tools, and very difficult and time-consuming (and sometimes impossible) using advanced data recovery methods like chip-off. The longer an SSD is left powered-on the more likely the drive will execute trimming.
- It is possible to recover deleted data from an SSD using factory access mode if trimming has not yet executed.
3. Do not to open the drive.
- Hard drives are manufactured in a as they are extremely sensitive to airborne contamination. Opening a drive outside of a cleanroom environment will contaminate the drive possibly leaving the drive unrecoverable.
4. Do not replace the PCB (printed circuit board).
- There was a time when you could swap the PCB on (between most drives) within a model range. The programming (firmware) on most modern hard drives are however unique for each drive. Changing the PCB may alter the programming on the drive and/or PCB possibly leaving the drive unrecoverable or making recovery extremely difficult.
5. Do not run ANY disk tool or utility.
- D.I.Y. disk tools are designed to test working hard drives and re-allocate bad or suspect sectors. Running some of these tools on a failing drive may cause further damage to the platters and corrupt the firmware programming complicating or hampering data recovery attempts.
6. Do not try to write data to the drive.
- Overwriting a sector on a hard drive is permanent and cannot be reversed. This is especially true when a drive is in a state of failure and you can possibly overwrite valuable data leaving that data unrecoverable.
7. Do not format the drive.
- Formatting a failing hard drive may lead to permanent data loss or make recovery attempts extremely difficult.
8. Do not run a system restore disk.
- Restore disks or system recovery programs are typically designed to overwrite the current data installation. Running a restore or install disk may leave the drive unrecoverable, including your data, or at best partially recoverable especially if run on a failing hard drive.
9. Do not bump, drop or knock the drive.
- There was a time when hard drives used bearings that were prone to seizing. A bump in some cases did solve the bearing problem but you still ended-up with platter damage due to the heads making contact with the platters. Modern drives do not use bearings and the only end result will be platter damage and/or platter alignment issues leaving the drive unrecoverable or at best partially recoverable.
10. Do not put the drive a fridge.
- This is an urban legend that may have worked on some early electronic devices. The idea was to try and overcome “dry joints” or bad solder connections by lowering the temperature causing the joints to contract to make contact again. This may have worked for a short period until the device heated up causing the “dry joints” to expand breaking the connection again.
- Modern PCB manufacturing techniques leave little or no room for “dry joints”. Even if the PCB does suffer from a “dry joint” you will end up with unrecoverable platter damage (permanent data loss) due to the condensation that formed between the head and the platter should you switch on the drive.
- The other problem is that water (condensation) conducts electricity and will, therefore, cause the PCB to short-circuit leading to damaged components. The drive will in most cases be unrecoverable if one of those components happens to be the firmware chip.
Losing data is possibly one of the most traumatic events that you can encounter. Give your, or your customers data, the best possible chance of being recovered by not making any rash decisions. You may only have one chance at recovering the data from a failed or failing drive.
Hard drive failure is typically associated with a clicking or noisy disk drive or the drive is no longer detected or the drive is slow to respond to read and write requests.
Need Help In Recovering Your Data - Contact Us Now!
Updated - Originally published 18 January 2016
- Computer Evidence Computer Forensic Experts Computer Forensics Computer Forensics Lab Computer Forensics Sspecialists Cyber Forensic Investigators Data Forensics Data recovery Digital Evidence And Computer Crime Digital Evidence Forensics Digital Forensic Analysis Digital Forensic Examiners Digital Forensic Investigations Digital Forensic Investigators Digital Forensics Digital Forensics Companies Digital Forensics Lab Digital Private Investigator Forensic Company Forensic Detective Forensic Expert Witness Hard Disk Forensics Hard Disk Recovery Hard Drive Forensics Hard Drive Recovery It Forensic Analyst It Forensics Windows Forensic Analysis
- Data Recovery