HDD data recovery: procedure by fault type and when to call a specialist

Immediate answer: HDD data recovery is governed by the type of fault, not the tool. Deleted files or a corrupted partition on an otherwise healthy drive can sometimes be handled by software — but always by recovering to a different drive, never back to the original. As soon as a drive clicks, slows down, reports incorrect capacity, or holds the only copy of company data, stop experimenting, disconnect the power, and have it diagnosed; every further read attempt reduces the chance of rescue.

This text is not a „launch a program and download files" guide. It is a decision-making procedure: how to recognize the fault type from the symptoms, what you can safely handle yourself without risk, and when it is cheaper and safer to disconnect the drive and hand it over to a service. Because with business data, the most expensive mistake is usually not the cost of recovery, but a hasty attempt that overwrites the only copy of a contract.

First, determine the fault type, not the tool

Data recovery does not start by installing a program, but by distinguishing the fault. A logical error (deletion, formatting, corrupted partition) requires a different procedure than bad sectors, electronics failure, and an entirely different one for mechanical damage inside the sealed chamber. A program for deleted files won’t fix clicking heads — and running it on a dying drive will, on the contrary, finish what the fault started.

The value of the data also plays a role. You decide differently for a copy of downloaded materials than for an accounting database, email in a PST file, project documentation, or the only image of a virtual server. Before you even touch the drive, answer these questions:

  • Does another copy of this data exist?
  • How much does one day without it cost the company?
  • Do you need the entire system, or just a few specific folders?
  • Has the drive been subjected to a fall, impact, water, or power surge?
  • Is it making different sounds than before?
  • Is the volume encrypted with BitLocker?

If the data is irreplaceable, the safest step is to power off the drive and have it diagnosed. A home attempt only makes sense with a stable drive and data whose loss you could tolerate.

How the fault manifests itself — and what to do based on it

SymptomProbable faultWhat can be safely checkedWhat not to do
Files disappeared, the drive is normally fast and quietLogical error (deletion)That the drive reports the correct capacityDo not save anything else onto it
Windows offers to format, or the partition is marked as RAWCorrupted file system or partition tableModel and capacity in Disk ManagementDo not format, do not run CHKDSK
Copying stops, the system freezes, read errorsBad sectors, surface degradationBriefly read SMART without a long testDo not run a surface test or attempt repeated copying
The drive clicks, spins up and stops againHeads, motor, or platter surfaceNothing further — power off the driveDo not power on again, do not open it
The drive does not spin up at allPower supply, electronics, motor, seized headsFor an external drive, try a different cable and a proper power sourceDo not blindly swap the controller board
The drive reports incorrect capacity or becomes unresponsiveFirmware or address translatorWrite down the exact model and serial numberDo not update firmware, do not try service commands

Clicking, bad sectors, crashed heads, and micro-grooves on platters have their own articles on the website; here, only one decision is essential. If the drive exhibits mechanical or rapidly worsening symptoms, further diagnostics using a regular computer are no longer safe. When a drive clicks, it is almost always a mechanical issue — heads, motor, or platter surface — and every further spin-up increases the risk.

The first ten minutes are decisive

First, close applications working with the drive. Then, power off a system drive normally and stop working with it; forcibly cutting the power itself risks an unclean write, and therefore only makes sense with clear mechanical symptoms. For an external HDD, stop the transfer and safely disconnect the device. If the drive clicks, beeps, scratches, or repeatedly spins up and stops, disconnect the power immediately.

Write down the circumstances — it will save the technician time and you money:

  • what happened just before the failure,
  • whether the drive fell or was connected during a power outage,
  • whether someone ran a file system repair (CHKDSK, fsck),
  • whether a recovery attempt has already been made,
  • the exact model of the drive and the computer, NAS, or external enclosure,
  • which files have the highest priority.

For an external drive, you may try a different high-quality USB cable and a different port once; for 3.5” drives, also verify the correct power adapter (they supply both 12 V and 5 V; a foreign power source may not spin up the drive). Beware of WD external drives (My Passport, Elements): their encryption is often handled directly by the USB controller in the enclosure, so a „bare" drive pulled out and connected via SATA will return only an unreadable jumble. If the behavior doesn’t change with a different cable, further reconnecting won’t help.

Do not put the drive in the freezer, do not tap it, and do not open it outside a clean environment — dust settling on exposed platters will cause further damage when spun up. For high-capacity helium-filled drives (roughly from 12 TB), opening it outside a lab is practically a death sentence.

When software is enough — and when it is not

Programs like R‑Studio, DMDE, or UFS Explorer can help with deleted files, a corrupted partition, or a lost file system structure. They will not fix faulty heads, a motor, or a damaged platter surface — they are not meant for that.

Deploy software only when the drive:

  • makes no unusual sounds,
  • maintains a stable connection,
  • reports the correct capacity,
  • is not working noticeably slowly,
  • does not have a growing number of read errors.

Recovered files are always saved to a different drive. Installing a program or writing results to the original HDD overwrites exactly the data you want to rescue. And do not run CHKDSK just because Windows offers it: it repairs file system consistency by writing changes, which is useful for getting a working volume running, not as a first step for the only copy of data. With bad sectors, moreover, every repeated read further stresses the surface.

Why an unstable drive is cloned first

For an unstable drive, files are not recovered directly from the original. First, a sector copy — a disk image — is created, from which data is then extracted. The reading is managed so that easily accessible areas are collected first and problematic spots are left for last.

A proven tool for controlled cloning is GNU ddrescue. It keeps a map file, so the work can be interrupted and resumed without re-reading already acquired areas. By itself, however, it won’t solve a mechanical fault: if the drive’s condition worsens during reading, a standard SATA or USB controller cannot safely manage faulty heads or change reading parameters.

A specialized lab will use a hardware platform like PC‑3000, works with the drive’s firmware, and can disable a problematic head or read by delimited zones. File system analysis then runs on the copy, not on the dying medium. Likewise, blindly swapping the controller board is not a solution — modern electronics carry adaptive data unique to the specific unit (in a ROM chip), so even an „identical" board requires transferring that memory.

When to stop and hand the drive over to a specialist

Disconnect the drive and hand it over to a service if at least one of the following applies:

  • it clicks, scratches, beeps, or does not spin up,
  • the computer freezes after connecting it,
  • after a fall, it changed its sound or stopped working,
  • copying is getting slower and slower,
  • SMART reports a growing Current Pending Sector or Offline Uncorrectable count,
  • it contains the only copy of important business data,
  • it involves accounting, a database, a virtual machine, or an encrypted volume,
  • previous attempts made the condition worse.

A special rule applies to BitLocker: a technician can recover sectors of an encrypted volume, but cannot replace a missing key. To access the data, you will need the password or the 48-digit recovery key — without it, even perfectly read sectors will remain just encrypted garbage. Where to look for the key is summarized in the article about BitLocker.

How much HDD data recovery costs

The price is not determined by the number of files, but by the fault and the required work. We intentionally do not list specific amounts here — they vary by model, drive condition, and parts availability and quickly become outdated; you will get a reliable number as a quote after diagnostics. However, a clear order-of-magnitude difference applies: software recovery from a stable drive is a fraction of the cost of mechanical intervention involving opening the drive, donor parts, and controlled reading in a lab.

The final price is mainly influenced by:

  • the condition of the platter surface and the necessity to open the drive,
  • the availability of a compatible donor drive,
  • the drive’s capacity and technology (large and SMR drives take longer to recover),
  • encryption,
  • the required processing speed,
  • time to assemble and verify the result.

A detailed breakdown can be found in the article how much data rescue from a disk costs. Before ordering, clarify whether diagnostics are charged, whether the price includes parts, and on what medium you will receive the data.

How to recognize a serious recovery offer

The provider should not promise a result before diagnostics. The condition of platters, heads, or the readability of critical areas cannot be reliably determined from a phone description — someone who guarantees rescue „100%" in advance either doesn’t understand or is exaggerating.

A serious procedure includes:

  • logging the drive by model and serial number,
  • diagnostics without unnecessary writes to the original,
  • a comprehensible explanation of the fault type,
  • a price framework before any paid intervention,
  • working according to a list of priority data,
  • information on which files are damaged,
  • delivery of data on a different medium,
  • an agreement on the handling of the original and working copies.

For business data, also ask about its protection: who has access to the data, where the working copy is stored, and when it will be deleted. For accounting, personnel documents, or customer databases, this is not a formality. And do not judge the result by the percentage of read sectors — even a small unreadable area can hit a database or a file system table. What matters is the list of actually usable priority files and verification that they can be opened.

What to prepare before handing over the drive

Bring the bare drive; for an external solution, also bring the entire enclosure (it may be part of the fault). Include the power adapter if it is not a common standard type. State the operating system, the file system, and any encryption. Write down your priorities — accounting databases and contracts are usually more important than a complete recovery of a user profile, so the technician will first verify the areas on which the company’s operation depends.

After recovery, do not use the original HDD as a working drive. Check the data, make at least two additional copies (ideally following the 3‑2‑1 rule), and only then address getting the computer back into operation.

Frequently asked questions

Can data be recovered from an HDD that Windows does not see?

Sometimes yes. The cause is often a corrupted partition, a faulty USB bridge, electronics, firmware, or mechanics. It depends on whether the drive reports the correct capacity and spins up stably. Do not power on a clicking drive again.

Should I allow the formatting that Windows offers?

No, if you want the original data. Formatting changes file system structures and complicates further recovery. Close the prompt and disconnect the drive.

Will swapping the electronics from an identical drive help?

It is usually not enough. Many drives have adaptive data tied to the specific mechanics, so even a compatible board requires transferring the ROM memory or service work with the firmware.

How long does recovery take?

Logical recovery of a stable drive is usually a matter of days. A mechanical fault, sourcing a donor, or repeated reading of a damaged surface takes longer. A more precise timeframe will only come after diagnostics.

Can all data be saved?

Sometimes yes, but it cannot be guaranteed. The result depends on whether the sectors containing the needed files are readable and whether the platters have been damaged or the data overwritten. That is why priority folders are defined beforehand, and the result is verified by opening key files.