In this article
With data loss, the outcome is decided in the first hour: most unrecoverable cases end up that way because of what was done after the incident, not because of the incident itself. The golden rule is to stop using the device and not to install anything on the affected disk. And the underlying lesson is another: data recovery is expensive, slow and comes with no guarantee, so the best recovery is the one that a managed, tested backup makes unnecessary.
Protocol for the first 60 minutes
- Switch off — a failing disk degrades with every minute it stays on; deleted files can be overwritten by any new write.
- Do not keep rebooting — on a disk with a mechanical fault, every start-up drags the read head across damaged surface.
- Isolate from the network — if there is any suspicion of malicious software, so that shared drives are not infected.
- Check the backups first — with a recent, intact copy, the problem becomes a restore rather than a recovery: faster, cheaper and with a guaranteed result.
- Record what happened — noises, messages, what was being done, steps already tried. This information is invaluable to whoever steps in.
- Repeated clicking or noises? Switch off now — it is a physical fault, and any software attempt will make it worse.
Mistakes that turn a recoverable case into permanent loss
- Installing recovery software on the affected disk Installation writes data, possibly over what you are trying to save.
- Running check and repair utilities They were made for file systems, not for dying hardware, and can lock in the damage.
- Formatting or reinstalling “to see if it helps”.
- Opening the disk Physical recovery is carried out in a clean room; outside it, the platters become irreversibly contaminated.
- Following internet recipes The freezer, tapping, swapping the circuit board: twenty-year-old myths that destroy recoverable cases.
Four scenarios, four approaches
| Scenario | What is happening | Prognosis |
|---|---|---|
| Accidental deletion | The data remains on the disk until the space is reused | The best scenario, if writing to the volume stops immediately |
| Logical failure | Corrupted file system, missing partition, disk asking to be formatted | Good recovery rates with the right tools and experienced hands |
| Physical failure | Noises, disk not recognised, intermittent operation | Requires a laboratory and clean room; the most expensive and most sensitive to amateur attempts |
| RAID failure | Often one disk failed months ago without anyone noticing; the second makes it all visible | The rebuild order is critical; a wrong rebuild destroys the array |
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Ransomware: no longer a recovery, but a security incident
Isolate the affected devices from the network without unplugging them from the mains, if there is an intention to investigate. Check whether the backups have been hit — backups permanently connected to the network are a priority target. Preserve evidence before cleaning anything up.
There is also a management decision: paying guarantees nothing and funds the next attack. It is a conversation for the board and, depending on the case, for legal advice and the authorities. If personal data is involved, there are notification obligations with short deadlines.
Prevention: what a managed backup guarantees
- Three copies Production data, a local copy for quick restores and an off-site or offline copy, the one that survives ransomware.
- Tested restores A backup that has never been restored is a hypothesis. The test should be scheduled, like a fire drill.
- Monitoring Knowing the backup failed on the day it fails, not on the day you need it.
DataRoad - IT Services and Consulting implements and manages managed backups and disaster recovery for business, with restore tests and continuous monitoring, integrated into its managed IT services. In 11 years, DataRoad has never suffered a security incident.
If the loss has already happened
See our data recovery for business service: what we resolve in-house, what goes to the laboratory and how to request a diagnosis. We work with companies of more than 10 workstations, under a support contract, with remote, on-site and telephone support.
