Server and virtual server data recovery: what should I do?
Every attempt you make can turn recoverable data into data that can no longer be recovered.
If your server has a disk failure, a broken RAID array, or a virtual machine that has been deleted or become inaccessible, stop using the system. Do not start a repair or rebuild, do not insert a new disk, and do not write new data to the area where the deleted virtual machine was stored. Note the bay order of the disks, the RAID controller model and the virtualisation platform, then contact us.
- Take the server out of use as soon as possible. Repeatedly switching it on and off with faulty disks can make things worse.
- Mark the bay order of the disks (with labels or a photo).
- Write down the RAID controller model, the RAID type and the number of disks.
- Write down the virtualisation platform (VMware ESXi, Hyper-V or another) and the names of the affected virtual machines.
- Take photos of the error messages and controller warnings.
- If there is a backup somewhere else, check its condition, but do not overwrite the backup.
- Do not run a RAID repair (rebuild) or an array initialization.
- Do not delete the configuration on the controller or create a new array.
- Do not reformat the datastore or volume, and do not answer yes to 'initialize'.
- If a virtual machine has been deleted, do not write a new virtual machine or files to the same area.
- Do not put the disks back in a different bay order.
Why does server data become inaccessible?
Servers usually spread data across more than one disk using a RAID structure. When this structure breaks, or the area where the virtual machines are stored is damaged, the data cannot be reached. The main causes:
- Physical failure of one or more disks
- A broken RAID array or a controller failure
- A second disk failing during a repair
- Accidental deletion of a virtual machine or datastore
- File system corruption, a sudden power cut
- Files encrypted by ransomware
What should you do based on the symptom?
| What are you seeing? | What could it mean? | What should you do? |
|---|---|---|
| The server will not start or the operating system will not load | There may be a power, controller or disk problem; the data may be intact | Do not keep retrying; mark the disk order and contact us |
| The controller says 'degraded' or 'offline' | The array may have lost one or more disks | Do not start a repair; talk to us first |
| The virtual machine is not in the list or will not start | It may have been deleted or moved, or its virtual disk file may be corrupted | Do not write to the same area; note the platform and machine name and contact us |
| Files have been encrypted and their extensions changed | It may be ransomware | Disconnect the server from the network, shut it down and see our ransomware page |
What should you watch out for with virtual servers?
Platforms such as VMware and Hyper-V store each virtual machine as one or more virtual disk files. Even if these files are deleted, the chance of recovery is higher if no new data has been written to the area where they were. That is why stopping use of that area as soon as the deletion is noticed is the most important step. Even so, the outcome differs in every incident and cannot be stated before the analysis.
Why are repairs and rebuilds risky?
A RAID repair (rebuild) reads and writes all the disks from start to finish. Disks that are already weakened can fail a second time during this process, and the data in the array can be lost permanently. Deleting and recreating the array erases the old configuration and the location of the data. For more about RAID arrays, see our RAID page; for NAS devices, see our NAS page.
What is done in the lab?
The condition of each disk is examined separately. Where necessary, disks with physical faults are handled in a Class 100 (ISO 5) clean environment. The disks are then put together in their original order, the structure of the array is determined, the RAID is rebuilt, the virtual disk files and the data inside them are extracted and transferred to a healthy disk. The method depends on the fault. You can find out how to send your device on the shipping page and all the steps on the process page.
How long does it take and how much does it cost?
Standard jobs take 10 business days on average, urgent jobs 24 business hours on average. The actual time depends on the type of fault, sourcing the parts needed and the capacity of the disk. Some jobs are completed within a few hours, while others can take months.
The price depends on the type of fault, the parts needed and the time the work takes. After the analysis we send you the exact price in writing. If you do not accept the quote, you get your device back without paying. Not every case falls within the free analysis scope. For requests outside the free analysis scope, you receive written information about the analysis fee before any work begins. For details, see what determines the price and how long it takes.
Can the data always be recovered?
No. If more than one disk is physically damaged, if the array has been deleted and recreated, if new data has been written to the area where the virtual machine was stored, or if the files have been overwritten, some or all of the data may not be recoverable. We cannot know the outcome without carrying out an analysis. After the analysis, you will be informed about the situation.
Frequently asked questions
Do I need to bring the whole server, or are the disks alone enough?
Once you share the model and the symptoms, we decide together which is appropriate. If you are removing the disks, mark the bay order and note the controller details.
If I set up RAID 5 or RAID 6, isn't my data safe?
RAID provides resilience against disk failure, but it does not protect against accidental deletion, ransomware, controller errors or fire. A separate backup is essential.
Can a deleted virtual machine be brought back?
If no new data has been written to the area where it was stored, there is a chance. If data has been written there, it may not be possible to bring it back partly or fully. We give a definite answer after the analysis.
Do I pay anything if I don't accept the quote?
No. If you do not accept the quote after the analysis, you get your device back without paying. In cases where it cannot be foreseen at which stage the data will become reachable, the price may be set after the data has been recovered, based on the time and resources spent on the work. In that case you are under no obligation to pay. Not every case falls within the free analysis scope. For requests outside the free analysis scope, you receive written information about the analysis fee before any work begins.
Why isn't free analysis available in every case?
For some requests a short assessment of the device is enough, and we can offer a free analysis. For other requests, our specialists can only reach an opinion or a result after spending many hours working on your device with professional tools. Because what we call the analysis stage involves carrying out the technical work that has to be done, we may not be able to offer those hours free of charge.
What do you do during the analysis?
During the analysis we actually start the professional technical work that needs to be done. Many businesses, on the other hand, say they offer a 'free analysis' to attract customers and get the device brought to them; once the device has been handed over, without spending any time on it, they say something like 'we will work on it; if it works it costs this much, if not, that much'. Having got customers to hand over their devices with the words 'free analysis', and since the customer will want the work to continue rather than go to the trouble of taking the device back, they put in no effort or time, which is how they can claim to offer a 'free analysis' in every case. In reality this is little more than a trap to attract customers.
Do you charge a service fee?
We do not charge anything under the name of a service fee. We do offer free analysis. For requests outside the free analysis scope, the analysis fee is communicated in writing at the start. Some businesses advertise with phrases like "600 TL data recovery service fee", leading customers to believe they will get their data recovered for 600 TL. That is how they attract customers. We do not work in such an unethical way.
Let's assess your situation together: call 0212 909 56 19 or write to us on WhatsApp. See our contact page for the address and opening hours.
If you are not sure what to do, call us first
Tell us about your situation and we will tell you what to do as a first step.