In summary<\/p>\n
- \n
- The first hour determines the outcome.<\/strong> Most definitely lost data is lost during recovery attempts, not the incident.<\/li>\n
- Switch off the equipment and do not install recovery software<\/strong> on the affected disk.<\/li>\n
- Data recovery is expensive, slow and without guarantee<\/strong> \u2014 therefore it is always the worst option available.<\/li>\n
- A backup that has never been restored<\/strong> it doesn't count as a backup.<\/li>\n<\/ul>\n<\/div>\n
\nIn this article<\/p>\n
- \n
- What to do in the first hour<\/a><\/li>\n
- What never to do<\/a><\/li>\n
- Types of loss and what changes<\/a><\/li>\n
- If it is ransomware<\/a><\/li>\n
- How not to come back here<\/a><\/li>\n<\/ol>\n<\/div>\n
There is an inconvenient statistic in data recovery: a significant proportion of unrecoverable cases arrive that way because of what was done after<\/em> of the incident. The disk had a chance; it was the attempts to resolve the issue that eliminated them.<\/p>\n
This article is about the first few hours \u2014 and what to do to ensure you never need it.<\/p>\n
What to do in the first hour<\/h2>\n
Stop using the equipment.<\/strong> If a drive is failing, every minute it is powered on can worsen the physical damage. If files have been deleted, every new write operation could overwrite the space where they still reside. Switch it off.<\/p>\n
Do not restart repeatedly.<\/strong> It is a natural consequence \u2013 and one of the worst. On a disc with a mechanical fault, every time the drive starts up, the read head is forced to pass over an already damaged surface.<\/p>\n
Isolate the equipment from the network<\/strong> if there is any suspicion of malicious software, to prevent it from spreading to shared drives.<\/p>\n
Check your backups before anything else.<\/strong> It seems obvious, yet it\u2019s often overlooked. If a recent, complete copy exists, the problem is no longer one of recovery but of restoration \u2014 which is quicker, cheaper and guarantees a successful outcome.<\/p>\n
Write down what happened.<\/strong> What noise was heard, what message appeared, what was happening at the time, what steps have already been tried. This information is very useful for anyone who might need to intervene.<\/p>\n
\nIf you hear clicking or repeated mechanical noises, switch it off immediately.<\/strong> It is a sign of physical damage. Any attempt by software in this state tends to turn a recoverable case into permanent loss.<\/p>\n<\/div>\n
![\"3-2-1](\"https:\/\/www.informatica-lisboa.pt\/wp-content\/uploads\/2026\/08\/dataroad-regra-3-2-1-backup-1024x356.png\")
The 3-2-1 rule remains the minimum criterion: three copies, two media types, one off-site.<\/figcaption><\/figure>\n What never to do<\/h2>\n
- \n
- Do not install recovery software on the affected drive.<\/strong> The installation writes data \u2014 potentially overwriting what you want to recover.<\/li>\n
- Do not run check and repair utilities<\/strong> on disks with suspected physical failure. They are made to fix file systems, not to deal with dying hardware, and can consolidate the damage.<\/li>\n
- Do not format or reinstall<\/strong> \u201cto see if it sorts it out.<\/li>\n
- Do not open the disc.<\/strong> Physical recovery is carried out in a cleanroom; opening them in a normal environment irreversibly contaminates the platters.<\/li>\n
- Don\u2019t rely on recipes from the internet.<\/strong> Freezers, knocks and board swaps are stories that have been circulating for twenty years and destroy recoverable cases.<\/li>\n<\/ul>\n
Types of loss and what changes<\/h2>\n
Accidental deletion.<\/strong> The best-case scenario. As long as the space is not reused, the data remains there. The rule is to stop writing to the volume immediately.<\/p>\n
Logical flaw.<\/strong> Corrupted file system structure, missing partition, disk asking to be formatted. The hardware is fine; it's the map that's been lost. It usually has good recovery rates with appropriate tools used by someone who knows what they're doing.<\/p>\n
Physical fault.<\/strong> Noises, unrecognised disc, intermittent operation. Requires a laboratory and a clean room. This is the most expensive scenario and the one most vulnerable to amateur attempts.<\/p>\n
RAID failure.<\/strong> A multi-disk system is not immune \u2014 it is common for one disk to have failed months ago without anyone noticing, and only the failure of the second makes the problem visible. Here, the order of rebuilding matters a great deal, and a poorly executed rebuild destroys the array.<\/p>\n
If it is ransomware<\/h2>\n
Everything changes. It's not a matter of support recovery \u2014 it's incident response.<\/p>\n
Immediately isolate the affected equipment from the network, without disconnecting it from the power supply if there is an intention to investigate. Check whether the backups have been compromised \u2014 backup systems permanently connected to the network are a primary target. Preserve evidence before wiping anything.<\/p>\n
And there is a decision that is not technical: paying doesn't guarantee anything<\/strong> and funds the following activity. It is a conversation to be had with management and, depending on the case, with legal advice and the authorities. If personal data is involved, there are notification obligations with tight deadlines.<\/p>\n
How not to come back here<\/h2>\n
Data recovery is always the worst option available: expensive, time-consuming and with no guarantee of a result. Anything that avoids it is worth more than it is.<\/p>\n
The rule of thumb that continues to work is that of the three copies: the production data, a local copy for quick restoration, and an off-site or air-gapped copy \u2014 the latter being the one that survives ransomware.<\/p>\n
But the part that fails the most isn't having copies. It's test them<\/strong>. A backup that has never been restored is a hypothesis, not a guarantee. The restoration test should be a scheduled event, with a set date, like a fire drill.<\/p>\n
And monitoring: knowing that the backup failed on the day it fails, and not on the day it is needed.<\/p>\n
DataRoad implements and manages backup and recovery solutions for businesses<\/a>, with restoration tests and continuous monitoring, within managed IT services<\/a>.<\/p>\n
\nA chat before making a decision<\/p>\n
Whether you\u2019re tackling a specific problem, planning a move or simply looking for a second opinion, we always start in the same way: by understanding your situation before making any suggestions. No obligation, no jargon and no catalogues.<\/p>\n
- Do not run check and repair utilities<\/strong> on disks with suspected physical failure. They are made to fix file systems, not to deal with dying hardware, and can consolidate the damage.<\/li>\n
- What never to do<\/a><\/li>\n
- Switch off the equipment and do not install recovery software<\/strong> on the affected disk.<\/li>\n