The first hour after data loss: what to do and what not to

When a drive fails the instinct is always the same: try again. Power cycle it, swap the cable, plug it into another machine, download a recovery tool. Each of those steps can destroy recoverable data permanently.

Why the first hour matters

A deleted file does not leave the disk immediately. The file system marks that area as free, but the data stays there until something is written over it.

The problem: the operating system keeps writing to the disk even when you do nothing. Temporary files, logs, updates. The longer the device stays powered on, the higher the chance of overwriting.

With mechanical failure it is worse. Running a drive that is making noise can physically scratch the platter surface. Past that point nothing can be done.

Do not

• Do not power cycle repeatedly. Every attempt increases mechanical damage.
• Do not download recovery software onto the same disk. The program you download can overwrite the very data you are trying to recover.
• Do not format or create partitions.
• Do not run chkdsk or fsck. These tools try to repair the file system, and in repairing it they can destroy recoverable structures.
• Do not rebuild the RAID array. A rebuild with the wrong disk finishes the data off.
• Do not open the drive. Dust is fatal to platter surfaces.
• Do not put it in a freezer. This piece of internet advice makes things worse through condensation.

Do

• Power the device down and leave it.
• Write down which files are critical. Recovery can be prioritised.
• Note what happened, step by step. Was there a noise, was it dropped, was there a power cut, what were you doing at the time.
• Check whether you have a backup — but do not write to the disk holding it either.
• Talk to someone. A five-minute call is sometimes the difference between recoverable and not.

Extra warnings for business systems

RAID: when one disk drops the array keeps running. Panicking, inserting a spare and starting a rebuild is the common mistake. If a second disk is weak it will fail during the rebuild and the array is gone. Assess before acting.

Virtual machines: before trying to repair a machine that will not start, take a copy of the disk file. Interfering with a snapshot chain can break it permanently.

Ransomware: disconnect from the network first. If encryption is still running, it is running while you read this.

Afterwards

When recovery is finished the real question is: why did this not come back from a backup?

Data recovery is expensive and its outcome uncertain. Backup is cheap and certain. Reviewing the backup design so it does not happen twice costs far less than the recovery invoice.