The most serious mistakes you should avoid during DIY data recovery
Data loss can be a stressful experience, especially for those facing it for the first time. Under such circumstances, even users with solid computer skills may make rash decisions that complicate the matters or lead to a greater disaster on the affected storage device. Thus, before you get the whole process going, it is highly important that you familiarize yourself with the following checklist. Being aware of the common mistakes, you can properly respond to the incident and give yourself the best chance for a successful data recovery procedure.
-
Don’t try to fix any hardware issues without the assistance of professionals.
When a drive is producing unusual noises, it takes too long to access its content or the medium won’t boot at all, there is nothing an average user can do to solve the problem. At least one of the typical symptoms for physical failure of the drive means that you should seek professional help, as long as you want the lost files back. Only a qualified data recovery specialist can examine the damaged storage and choose the most optimal combination of software and equipment for extracting the data with the least intrusive intervention. Do not try opening the drive yourself, replace its components or use any homemade tricks from an Internet forum. The chance is one in a million that this approach will work out, while the possibility of destroying the drive is extremely high.
-
Don’t keep using the drive (partition) once you find out the data is gone.
When files get deleted or other way lost from the drive, the space they occupy is considered “free” by the operating system. Though inaccessible, they still remain there, waiting for the moment when this space will be used for writing other data. Data recovery software is able to locate such files and undelete them for further copying. Yet, adding more data to the drive or installing any software to it (including the data recovery tool) may result in writing over the lost files. This operation is irreversible and leaves no possibilities for restoring the data.
The primary drive of a computer may also be divided into several containers called partitions. In this case, the operating system and program files get isolated from the user’s data. However, a partition which belongs to the OS is susceptible to constant writing operations that occur “behind the scenes”. They are essential to run the system, ensure its functioning and execute other software, but, at the same time, elevate the risk to overwrite the lost files, even when the PC remains idle. For this reason, when the data is to be retrieved from the system partition, it is strongly advisable to shut down the OS and use another computer for the recovery purposes.
-
Don’t save the recovered files to the drivefrom which they were lost.
Saving recovered files to the same drive, like in the previous scenario, can overwrite the space occupied by the lost data and make it irretrievable, even before you will be able to rescue it. Always use a different device for copying the recovered items. Make sure that the storage is intact and has enough available room. The use of another partition on the same drive is not recommended as well, as the sizes of the partitions can change, and a part of the data may get eventually overwritten. If you decide to format the target drive, see to it that any important information on it has been copied to a secure location. After formatting and saving the recovered items, the previous data on it is likely to get wiped once and for all.
-
Don’t reinstall the OS or apply any system repair tools.
Various system repair utilities, like chkdsk or fsck, are intended for correcting errors in the file system and bringing it back to the consistent state – this is not the way things work in data recovery. Their activities involve writing directly to the problem drive and often make the data loss problem far worse. That is why they can be employed after the necessary data was extracted, and not vice versa. A fresh installation of the operating system may also help to get rid of certain logical issues. Yet, if you store any files in the system partition, they may be permanently destroyed, as its content will be overwritten in the process with the data of a new OS.
-
Don’t run data recovery software without administrator rights.
The program needs elevated privileges in order to access any storage device attached to your computer. If you don’t provide them, it won’t be able to detect any physical drives, let alone analyze them for the lost data. For this, log into an administrator account and start the software with the correct user and password. If you are recovering files from a Mac’s system drive (under macOS 10.13 High Sierra and later) and in spite of the precautions, you are not going to remove the storage medium, you will have to disable the default System Integrity Protection of this OS. Also, please note that data recovery is not possible for Macs with custom Apple’s M1 (Apple Silicon) or T2 security chips.
-
Don’t use “indirect” connection for external storage devices.
Various electronic devices, like smartphones or digital cameras, use portable memory cards as their primary storage. In some cases, it is possible to browse or manage its content after the gadget itself is connected to the computer. But the thing is that this kind of access is just a virtual imitation, the real file system remains locked and cannot be approached for data recovery. To let the utility work with the real file system, you will need to take the memory card out of the device and insert it directly into the slot of a PC/laptop or a dedicated USB memory card reader.
-
Don’t try to rebuild RAID or reset your NAS to the factory defaults.
When you are dealing with a complex storage, don’t try to rebuild or reset it, unless you know exactly what you are doing. Improper manipulations with RAID often lead to massive overwriting of the information. The more actions are taken in the aftermath of data loss, the further the problem may spread, and the fewer chances remain to recover the lost files, even in the environment of a professional laboratory.