The main rule is that nothing should be written to an original disk. We will create a “read-only” version of your failed hard drive, and all of our rebuilding occurs from this copy. Here is how the process works to convert a bad (dead) disk back into files and also how we respond to questions about viewing what’s stored on them.
A dying disk gets worse with use, so we take a single read-only image of your drive at the beginning of the recovery process and leave the original untouched. Everything else after that occurs on this copy. That’s why you cannot hurt anything during good recovery efforts.
Work on the copy. Don’t touch the patient.
Regardless of what happened to your data, there is always only one initial step: Take a complete, sector-by-sector, read-only image of the disk onto healthy media using a machine that can read the disk but is physically unable to write to it. At that point, we leave the original alone. Every attempt to recover your lost data occurs on the image created above.
There are two big advantages to doing it this way. For starters, each spin of a dying disk causes some deterioration, so we get one clean read instead of many potentially damaging reads. Additionally, when one method doesn’t produce the results we’re looking for, we can take a new copy of the image and try again without affecting your original data. This is completely different from using repair software directly on the original disk, which writes to what you are trying to save.
Nearly all jobs fall under one of these two categories and both are solved in different ways.
Logical failures mean the hard drive was functioning properly as far as mechanical issues go; however, the data on the drive had become distorted; files were missing/deleted; the drive had been formatted; the file system had become corrupted/lost a partition. Because the problem lies within the file systems’ organisation rather than within the physical drive itself, we create an exact copy (image) of the drive and then recover the original file system. If the file system’s organisational structure has been completely destroyed, we use software that searches for individual files by utilising known signature formats of how a file looks, and carve the files from the raw unorganised disk. Our guides covering recovering deleted files will show you how to do this yourself.
Physical failures mean the hard drive’s hardware has failed; bad read/write heads; a burned-out circuit board; corrupted firmware; fire or water damage. When the hard drive’s hardware fails, the computer cannot read it, thus making it impossible for us to run our software on it. We first have to perform bench work: replace a bad head stack or board with a matched donor part, fix the firmware, etc., simply to get the hard drive up and running well enough to make an image of it. Once the hard drive is capable of being imaged, then we enter the logical phase of recovery. For information on the equipment we utilise in our lab to accomplish this, please see our lab and tools page.
1. Diagnose. The drive is inspected read-only. We look at the health information available on the drive regarding its heads and service area and review its file system to determine what on the drive has failed. This inspection is also called a “free diagnostic” and is used to base your fixed price quote upon.
2. Image. An exact sector-by-sector read-only copy of the drive is created. In creating this copy of the drive, we skip over any bad sectors encountered during the process of creating the image so they are processed last allowing as much good data to be retrieved from the failing drive as possible without further damaging it through excessive wear and tear.
3. Rebuild. On the copy, we rebuild the file system, restore a RAID array from its members, or extract files via their signatures, whatever the failure calls for.
4. Verify. We check your recovered files for validity (checking whether they can be opened, checking how they fit into their own internal structures and comparing the hash/checksums), which means when things come back, what gets returned can actually be opened as opposed to simulating the original damage.
5. Return. Data is delivered back to you on new encrypted media or via secure download, after which the active working copy is removed using a secure wipe. For further information about the entire recovery process, please refer to our process page.
When recovering your files, the process will affect the structural organisation of your files. This, however, means that your actual file contents will remain private.
Honestly? The only way a recovery tool/your engineer would have visibility of the individual folder/file name is due to the fact that this is the exact structure that needs to be repaired. In order to verify the successful recovery of your files, a few test samples will need to be opened to ensure they are complete. Beyond this, your files will not be browsed through: there’s no need to do so and serious labs do not browse through customer content.
What keeps you safe is method not promise: A single engineer will handle each stage of your job, from start to finish; all of the work is performed in-house and never outsourced, nor transferred outside of the UK and we’ll provide you with a Non-Disclosure Agreement (NDA) at no charge. Upon delivery of your data, the working copy used during your recovery will be securely wiped utilising a verified overwrite (as opposed to simply deleting), and no additional copies will be retained. All processes related to your job will occur within UK jurisdiction. Further details regarding our data security may be found on our data security page.
No, as long as it is done properly, and understanding why something was done wrong will tell you what to avoid doing incorrectly.
Recovery, if done properly, will begin with a read-only image. Thus, the original drive cannot end up in a poorer condition; there is no writing occurring to it. On the other hand, doing things the opposite way, i.e., using DIY-type programs for many hours on a failing drive, letting a controller rebuild a RAID which has been degraded, or running a “fix” program that writes over what you want to save: this is how recoverable data turns into lost data.
When looking for someone who performs recovery in this manner, here are some indicators of a recovery lab that functions this way: a legitimate business location which you can physically travel to, a written quote prior to any work being performed, a clear description of the terms similar to our own, which states that in most cases you only pay if we recover your data, and a simple yes/no answer to the question of whether they create a read-only image of your drive. In instances such as your drive clicking, undetected, dropped, or flooded, the best thing to do is stop using the drive right now and obtain an honest diagnosis.
After making a read-only sector-by-sector duplicate of your failed drive (and repairing any physical/firmware problems that prevent reading the drive), the next step involves performing any necessary reconstruction on the copy. This includes re-creating your file system, re-building your RAID array, or carving files based upon their signature. Your recovered files are then tested/verified to ensure they can indeed be opened. Once verified, your recovered files will be returned to you. Your original drive will never be modified/written to.
To build your file system back together means that both the software and the engineer see the directory/file structures and verify that the recovery was complete by checking that a few samples open properly. No one is going through your documents/content. Each job is completed internally by one engineer. We provide a free NDA (Non-Disclosure Agreement). Upon completion of your recovery project, we will secure-wipe the working duplicate.
No, unless it is done improperly. Recovery happens using a read-only image of the drive. Therefore, the original remains unaltered. Overwriting does occur while recovery or repairing tools are used on the drive itself or during a RAID rebuild process since both processes write to the drive. If you want to protect your data, create an image of the drive prior to working on that image.
A professional lab will meet this description. Protection comes through method: drives are imaged in a read-only format to prevent degradation; one engineer performs the job internally (and it is never sent outside) and will sign a non-disclosure agreement free of cost; and your data will remain within the UK and will be removed upon completion of service. Look for a real address; request a written quotation; and look for reasonable terms. With us, in most cases you only pay if we recover your data.
Logically recovering your data means there was a problem with the structure of the files on your healthy drive that prevented access to them (in other words deleted, formatted or corrupted). This issue is resolved by either fixing the logical damage to your file system or carving the files out individually. Physically recovering your data means that there is something wrong physically with your drive (a failing head, bad circuitry or corrupt firmware) and the drive cannot be accessed until the physical problems are resolved by doing bench work and/or repairing the firmware. After these items are repaired, your data can then be imaged.
No. Your recovered data will be provided to you via secure methods (encrypted media or secure download). Our working copy of your data will then be completely erased using a verified over-write (not simply deleting) after returning your data to you. We do not retain any copy of your data once we have returned your data to you.
Simply send the drive in or bring it into our facility. At this point we will diagnose your drive in a read-only fashion and provide you with an honest assessment of how much of your data we believe we can restore. From here, we will provide you with a fixed written quote for restoring your data before any money changes hands.