The first 10 minutes after data loss: what to do and what not to do
Every attempt you make can turn recoverable data into data that can no longer be recovered.
The first thing to do when you notice data loss is to stop using the device. If the disk is making noises, switch it off. Do not write new data to a disk whose files were deleted or that was formatted, and do not install recovery software on the same disk. The right route depends on the symptom you are seeing; you can find your situation in the table below. Even a single attempt in the first minutes can make things worse.
- Stop using the device.
- Write down what happened and when.
- If the disk is making noises, switch it off.
- If the important data has a backup somewhere else, check it.
- Do not keep switching the device on and off.
- Do not install repair or recovery software on the same disk.
- Do not format the disk or reinstall the operating system.
- Do not open the disk yourself.
- Do not put the faulty device in the freezer or heat it.
First step by symptom
| Symptom | First step | Details |
|---|---|---|
| The disk is clicking | Switch it off immediately | Clicking noise |
| The disk is not detected | Change the cable, do not format | Disk not detected |
| The SSD is not recognised | Switch it off, do not run firmware tools | SSD |
| Files were deleted or the disk was formatted | Do not write to the disk | Deleted files |
| Files are encrypted and there is a ransom note | Disconnect the device from the network | Ransomware |
| A NAS or RAID has failed | Do not start a repair | NAS, RAID |
| Fell in water, was dropped, burned | Do not apply power | Physical damage |
| A BitLocker-encrypted disk will not open | Look for the recovery key | BitLocker |
Why do the first minutes matter?
Data loss often starts with a single event, but the attempts made afterwards make things worse. On a mechanical disk, every power-on can mean damaged heads harming the platter. Every piece of new data written to the area where deleted files sit can destroy those files permanently. So the first rule is to stop and think.
What should you have ready when you contact us?
- The brand, model and capacity of the device
- What happened and when
- The folders or files that matter most to recover
- What has already been tried (which program, which operation)
- For NAS and RAID: the number of disks, the RAID type and the disk bay order
How long does it take and how much does it cost?
Standard jobs take 10 business days on average, urgent jobs 24 business hours on average. The actual time depends on the type of fault, sourcing the parts needed and the capacity of the disk. Some jobs are completed within a few hours, while others can take months.
The price depends on the type of fault, the parts needed and the time the work takes. After the analysis we send you the exact price in writing. If you do not accept the quote, you get your device back without paying. Not every case falls within the free analysis scope. For requests outside the free analysis scope, you receive written information about the analysis fee before any work begins. For details, see what determines the price and how long it takes.
Can the data always be recovered?
No. Depending on the type of damage, how long the device has been run and whether the data has been overwritten, some or all of the data may not be recoverable. We cannot know the outcome without carrying out an analysis. After the analysis, you will be informed about the situation.
Frequently asked questions
Should I switch the computer off or leave it on?
If the disk is making noises or physical damage is suspected, switch it off. With ransomware, you first need to disconnect it from the network; for the decision on switching off, see our ransomware page.
Is it harmful to try with another program?
If the disk works normally, software can be tried, but it must not be installed on the same disk. If the disk is making noises, do not try. For details, see our software or lab page.
Do I pay anything if I don't accept the quote?
No. If you do not accept the quote after the analysis, you get your device back without paying. In cases where it cannot be foreseen at which stage the data will become reachable, the price may be set after the data has been recovered, based on the time and resources spent on the work. In that case you are under no obligation to pay. Not every case falls within the free analysis scope. For requests outside the free analysis scope, you receive written information about the analysis fee before any work begins.
Let's assess your situation together: call 0212 909 56 19 or write to us on WhatsApp. See our contact page for the address and opening hours.
If you are not sure what to do, call us first
Tell us about your situation and we will tell you what to do as a first step.