The physical media
Platter and head hardware, or NAND flash memory. Where damage occurs, the damaged areas are lost forever — nothing can recover a platter that has lost its magnetic patterns.
Hardware
You do not know how many times a bad drive will allow you to "read" it. The whole field of data recovery is centred around spending these reads intentionally — one time for a read-only copy, then every subsequent test or experiment on that copy instead of the actual drive.
If a drive is failing it may only have enough "reads" left in it to take one complete read of itself. Once you spend that last read on an image of all the data on the drive, every other operation you perform on that drive will occur on an image (copy), cost you nothing to run, and you can repeat these operations as many times as you need to.
This is the basis of almost all the rest of the work that follows and represents the difference between operating in a laboratory environment and with a program.
A failing device may have a limited number of good reads left in it, and you are not sure how many. It could be hundreds; it could be just one. Because nobody actually knows which it will be until the device stops reading, the whole area of recovering lost data is based on using up each available "good read" intentionally rather than trying to determine how many exist.
This is the most important first step in all recovery methods. A "read once" approach requires making a true, read-only copy of the source prior to starting your recovery process. All subsequent attempts at data recovery are then made from this exact duplicate. Once you have created a read-only copy of the source, you can continue with rebuilding, repairing and testing. The original is never written to, so you can fail at any point without damaging it.
The implications of reading once are more significant than they may seem. If you fail while running software on the original device, there will be costs associated with that failure. However, if you were using an image of the original, there would be no cost for having failed. This makes reading once the key difference between recovery of the original versus recovery of an image.
These four steps are done in order and the first step dictates how the next three are completed.
Mechanical? Electronic? Firmware? Logical? Any classification here determines where you go, what equipment you use, what your budget is likely to be, and what the realistic odds are. Therefore, do not start until you classify your fault. That is why the diagnostic comes first and why it is free.
Donor head assemblies, repairs to boards with the original ROM adaptives migrated across, service area rebuilds, access to controllers via vendor mode. Enough to make a drive readable. Not enough to make the drive work again, which is not the purpose.
Image created on hardware made for failing media: per-head targeting, time-outs measured in milliseconds instead of seconds, unreadable sectors logged and bypassed. First pass reads everything that will read. Subsequent passes only go back to areas that did not read.
Repair file systems from their own backup structures, re-assemble arrays using the geometry determined by the data itself, carve files out by signature when there are no longer file systems present.
Files recovered open in the application they were originally generated with. If files cannot be opened they will be identified by name.
This is what you need to understand so that even though two drives have the same symptoms, they can need completely different work.
Platter and head hardware, or NAND flash memory. Where damage occurs, the damaged areas are lost forever — nothing can recover a platter that has lost its magnetic patterns.
Hard drives use a piece of software stored in a special reserved service area on each disk (a.k.a. a "firmware") and SSDs store a table used for translating logical block numbers to actual physical locations on the chip. Once this firmware becomes unreadable, the device is unable to provide information about itself, however, the data stored on the SSD/HD remains intact as it is located directly behind the broken firmware.
Stripe layout, the order of individual member disks within a stripe set, parity rotation and/or vendor pools. This layer is reconstructed by examining the individual disks instead of relying on the controller which was damaged.
The map from your folders to where your files are physically stored. If the file system itself is damaged, then all of your files will be there but they cannot be accessed — and most file systems keep backup copies of their critical structures.
A page about recovering data must explain when it cannot recover.
Overwritten data. If some piece of your file was overwritten after it had originally been written; then that part of the original file is irretrievably lost. For example, no drive made in the last two decades retains any sort of readable magnetic "signature" for anything once it has been overwritten. Older publications may claim otherwise.
Encryption without the key. Drive encryption like BitLocker, FileVault, etc... if the encryption key is lost we might attempt password recovery, which works on weak or partially remembered passwords; however it is completely ineffective against a long random password.
TRIMmed SSD deletions. Physically the controller will wipe the blocks within a matter of minutes using an active drive. So it's really wiped.
Severely scored platters. Wherever a head has stripped away the magnetic layer the area is blank; other undamaged bands on the same disc can still be used to create images. This results in a partial recovery of your data with individual file names for those lost files.
Everything else is simply a matter of cost and time; not ability. For example single drives in Manchester are from £300 +VAT after a complimentary 48-hour diagnostic.
First, a decision is made about what kind of fault there was on the drive. Then repair of the drive only occurs up to the point needed to read and recover your data. An image is created by reading only, and your data is then rebuilt from that read-only image. This way of doing things relies upon the fact that a dying drive may have very few good reads left, therefore they are all spent on creating a single complete image of your original data.
A failed attempt on an image costs nothing, whereas a failed attempt on the original could cost you the hard drive, so the next run will always be against the "copy." So, regardless of how many different ways that someone attempts to recover information, they cannot possibly decrease how much information there is available to recover.
A repair seeks to make the system work again; recovery seeks a single pass through the data. A hard drive fitted with donor heads is a recovery vehicle and not a disk to trust – it is used once and then retired.
No. If someone writes over part of your file, that area is lost forever. The drives made within the past two decades do not have any residual magnetism left to scan in order to retrieve any previously deleted files, regardless of what some outdated article(s) claim.
Yes, with the password/recovery key – encryption provides absolutely no obstacle. Without the password/recovery key — healthy media provides absolutely nothing recoverable. We can attempt password recovery. When weak or partly-remembered passwords are used, this succeeds. Random long passwords will not.
The free diagnostic will be completed generally within 48 hours. Generally, a single drive will complete in 3–4 working days after approval. Donor parts, heavy imaging or array work will take longer. You will receive timescales with each quote.