Data Recovery

How these faults present

• Files or partitions have disappeared after a power cut or unsafe removal: A logical failure. The storage is usually intact and the filesystem structure is damaged. Filesystem repair and recovery of intact clusters, which is usually straightforward.
• The drive clicks, grinds or reports an error on every access: A physical failure. Heads or platters are damaged and every read attempt is further degrading what remains. The drive needs imaging to stable media by a cleanroom before anything can be recovered. Stop using it immediately.
• The system sees the drive but the data is scrambled or the file names are meaningless: Often encryption or a controller fault rather than damage to the storage itself. Controller-level work or filesystem rebuild, depending on what the drive reports.
• A RAID array has dropped one or more disks and will not mount: Usually a single disk failure in an array that had degraded without anyone noticing. The array must not be initialised or written to. Recover from the surviving disks with knowledge of the controller and stripe size.
• A USB drive or memory card keeps disconnecting or is not detected at all: The controller has usually failed. The flash memory inside is often still intact. Controller-level recovery, which succeeds only on some makes and models. Data recovery from these is genuinely uncertain.

Where this differs by device

• SSDs are harder than hard drives because TRIM means deleted data is often already gone, and because wear levelling hides the physical location of a file behind the controller translation layer. Many SSDs also offer hardware encryption, and encrypted data is unrecoverable without the key.
• RAID arrays need the controller type and stripe size before anyone touches them. Writing to a failed array can destroy what the remaining disks still hold, and RAID 0 has no redundancy at all.
• Flash media in cheap USB drives and memory cards has poor controllers, and controller failure is more common than failure of the memory itself. It is also the least recoverable case.

Where engagements like this go wrong

• Continuing to use a drive that is clicking or grinding, which turns a recoverable partial recovery into an unrecoverable one.
• Running a failed array through an initialise or rebuild command, which overwrites the parity and can destroy the surviving data.
• Assuming a formatted or deleted drive is automatically recoverable, when TRIM on SSDs usually makes it unrecoverable.
• Believing recovery is guaranteed. A proportion of failed drives genuinely cannot be recovered, and a provider who claims otherwise is either not diagnosing or not telling the truth.

What changes the cost

• Whether the failure is logical or physical. Logical recovery is a routine job; physical recovery needs imaging at sector level, and cleanroom work if the heads are involved.
• The media type. SSD, RAID and flash controller recovery each take different tooling and different amounts of time.
• How urgently the data is needed, because an emergency job that has to be done out of sequence carries a different cost to a routine one.
• The volume of data, and whether it is being recovered from several disks or one.