We are often asked to salvage files from a computer disk or memory stick that has partially or totally failed, or perhaps working well but a critical file has been accidentally deleted (and the recycle bin emptied).  The good news is that often many files can be recovered.  There is just one golden rule to increase the chances of getting your data back: switch the PC off as soon as possible.  This is because whatever is happening on the computer - even if it is apparently idle, temporary files are being written to enable normal operation, and if these are written over your data, the data is then irretrievably lost.

There are four stages to recovering data; all start with an image backup of the disk if possible so that whatever happens later, the current data is secured.

1. We remove the disk from its normal home and mount it in a recovery rig.  This is essentially another PC type device which is set up to mount whatever file system the disk is structured in, and use that to retrieve files.  This works a lot of the time and is quick and therefore cheap.

2. If step one fails but the disk is mountable, it is time to run programs which aim to reconstitute the disk's files from a directory structure.  The method used depends on the file system the disk was formatted in (e.g. NTFS or FAT).  Typically there will be hidden structures which can be analyzed to identify which block on the disk is the start of each file's header.  If that is not usable, the whole disk can be trawled to reassemble files from header packets.  These files are then recoverable by specifying their block address on the disk.  This is possible even if the file is fragmented, although a little more time is needed.

3. If the disk is not mountable it will either be due to a fault with the recording structures or the printed circuit board (controller card) that controls it.  If another identical disk can be sourced, it is sometimes possible to take a working controller card from it and exchange with the failing device.

4. The final option is taken when the previous steps have failed.  The disk can be sent away to a specialist company with a forensically clean laboratory, where the disk is taken apart and electronically scraped for the data that is still there.  Normally this involves taking the platters and moving them to an otherwise functioning identical disk.  A quotation is provided and the client's authorization is required before the job is started; with some labs, the only commitment until that stage is the cost of postage.

   1ComputerCare has a partnership association with Ontrack, probably the largest and most respected such company.  They are authorized by all main manufacturers to open and reseal a disk without invalidating warranty or insurance.  Click the above button to arrange a quotation yourself or contact 1ComputerCare to have everything taken care of for you. 

Click here for an article on what sometimes causes a clicking sound from a failing disk drive.

See Case Notes: C1 and C3