What Causes Hard Drives to Fail?

Hard Drive Failure and Data Loss Can Be Divided Into Two Broad Categories: Logical data loss (software-related) and Electro-mechanical failure (hardware-related)

Logical (software-related) data loss:
The device is mechanically working but suffers from a software issue.

The most common causes of logical data loss:

• Formatted device - Formatting alone leaves the data areas (on a sector level) intact despite not being accessible via the operating system.
• Operating system re-installation or reload - Data on the device before reinstalling the operating system and/or applications (with or without formatting) is usually intact (on a sector level).
• Deleted file(s) and/or folder(s) - Accidental or intentionally deleted directories and/or files are usually intact (on a sector level).
• Cut and Paste - Typically due to an interrupted cut and paste operation, e.g., a power failure.
• Deleted or corrupt partition(s) - Deleting a partition alone leaves the data areas (on a sector level) intact despite not being accessible via the operating system.
• Data corruption - This could be due to several factors, including storage device quality, application quality (e.g. lousy programming), memory quality, power stability, incorrectly shutting down devices or applications and incorrect ejection of removable drives.
• Virus-infected or malware - Malicious software applications that can delete, corrupt, exfiltrate or encrypt your data for ransom.
• Hacked - Can originate inside or outside your computer or network.

In most cases, data can be recovered and investigated using specialised data recovery and forensic software unless the data areas have been compromised - overwritten, corrupted, encrypted, or due to SSD trimming. The success rate would depend on the file sizes, file location and fragmentation before the potential data loss scenario, data activity after the incident and type of encryption. The best advice is to stop working when you suspect data loss and not to attempt to access the advice if you wish to have the best chance of recovering or investigating your data loss.

Electro-mechanical (Hardware Related) device failure:
Refers to physical problems with your storage device

The most common symptoms and causes of electro-mechanical failure:

• Dead device. The device is not detected, e.g. the hard drive fails to spin up when power is applied. This is normally due to a damaged PCB (printed circuit board) caused by power fluctuations, surges or spikes from a faulty power source, power failures, lightning and water, or other liquids.
• Noisy hard drive. Clicking, knocking) or scratching noises usually result from broken or damaged read/write heads (commonly referred to as a head crash), platter damage or firmware corruption.
• The drive is not spinning. The drive makes beeping or buzzing noises when power is applied, typically due to spindle motor seizure.
• The drive is spinning but not detected. This could be due to firmware corruption, damaged read/write heads or a faulty PCB.
• The drive spins up and down repeatedly. The drive spins up and down repeatedly when power is applied. This could be caused by faulty read/write heads, firmware failure or a faulty PCB.
• An excessive number of bad sectors. The data on the drive is not accessible, or the drive may struggle to read or write data. Typical indications could be Cyclic Redundancy Checking or CRC errors when reading or writing data or drive repeatedly running a scan (scan disk) at start-up.
• Drive contamination. Hard drives are susceptible to contamination. This is one of the reasons we have a class 100 cleanroom where we can safely open hard drives without the risk of external contamination. Once a drive has been opened in a non-clean environment, the risks for data loss increase substantially. We typically encounter fingerprints on the surface of the platters and/or dust contamination caused by D.I.Y. or other unskilled data recovery attempts.

In most cases, data can be recovered and successfully investigated using specialised data recovery and forensic software, tools and equipment unless the platters or magnetic field have been severely damaged. The most common reasons for electro-mechanical device failure include failed components, rough handling (bumping or dropping), and manufacturing and power source issues. The best advice is to stop working when you suspect data loss and not to attempt to access the advice if you wish to have the best chance of recovering or investigating your data loss.

See Also:

- What You Should Not Do to a Failing or Failed Hard Drive?
- What Is The SSD TRIM Command And Why Is It Important To Know How It Works?