What to do in the event of data loss

The circumstances of a data loss determine the recovery procedures and, in anticipation, the need to adopt the right reflexes as soon as they are detected. Depending on their nature, data losses suffered by information systems and storage media can be detected immediately or go unnoticed for a long time. Whatever their origin, data loss can take several forms:

How was your data lost?

The circumstances of a data loss determine the recovery procedures and, in anticipation, require the right reflexes to be adopted as soon as they are detected.

Depending on their nature, data losses suffered by information systems and storage media can be detected immediately, or go unnoticed for a long time. Whatever their origin, data loss can take several forms:

• loss of access or unavailability of data ;
• data errors, alterations or corruption ;
• disappearance of data (deletion or overwriting).

They affect HDDs (magnetic hard disks) as well as than SSDs (electronic disks) and flash memories. However, the failures that cause data unavailability, loss or corruption will not affect them in the same way:

• mechanical failures only concern HDDs (especially HDAs containing read heads, platters, motors, etc.), as SDDs have no mechanical components;
• electronic failures are associated with SSD flash memories and the electronic controllers (or printed circuits) that manage and operate HDDs;
• Logical failures affect both HDDs and SDDs (file system, partition tables, etc.), although there are some special features (NAND or NOR chips on SSDs).

The causes of the malfunction or damage to the storage medium will also guide data restoration procedures:

• incident (impact, fall…) or disaster (flood, lightning, fire…) ;
• cyber-malware: viruses, malware, ransomware attacks ;
• obsolescence, manufacturing defects or wear and tear of computer components ;
• accidental manipulation or human error (deletion, formatting, etc.) ;

What to do in the event of a storage media failure or disaster?

In the event of malfunction or damage, or when you notice warning signs on your storage media (vibrations, regular metal banging on an HDD, burnt smell, etc.), the first good gestures will prevent any further damage or, in the case of cyber-malware, propagation :

• switch off the power supply to the affected computer or storage device ;
• isolate the device from the web, the internal network or your information system.

Any further intervention on a damaged and/or data-lost storage medium may exacerbate the situation. To prevent any remaining data from being overwritten, or to avoid reducing the volume of data that can be recovered at a later date, please follow these recommendations:

• do not attempt to tamper with the device in any way: opening the bracket, disassembling parts, unsoldering electronic components, etc. may cause further mechanical, electronic or even logical damage to the device;
• in the case of HDDs, opening the disc is particularly forbidden, as even the smallest particle can scratch or damage the magnetic surface of the platters; this operation must be carried out in a clean room by a professional laboratory;
• do not carry out any cleaning operations on a device affected by a disaster (water damage, deposits resulting from fire or smoke, etc.), especially if this involves dismantling the device or using cleaning products; in particular, avoid “recipes” and “tips” from the web;
• do not run any logical commands, even if they are utilities available on the operating system (CHKDSK, Scandisk, macOS Recovery…); operations such as rebooting or formatting are also not recommended or even forbidden;
• don’t install any software on the damaged device, especially free or licensed data recovery software: it may fail to restore your data and make the loss irreversible.

These recommendations are designed to suspend or stabilize the condition of your data storage media. It is advisable to entrust the restoration of your data and related operations (cleaning, component extraction, HDD opening…) to a professional companywith its own laboratory and infrastructure.