Data Recovery Safety Guide

Protect the original storage first

When data becomes inaccessible, the first priority is to avoid actions that could change the original storage unnecessarily. The safest next step depends on the device and failure type, but the following guidance is appropriate for many recovery cases.

For hard drives

• If the drive is clicking, grinding or making unusual mechanical sounds, stop using it.
• Avoid repeated power-on attempts on a device that is showing signs of mechanical failure.
• Do not open the hard drive.
• Do not initialise or format the original drive.
• Avoid repair or recovery operations that write to the affected drive.

For SSD, USB, SD and flash storage

• Avoid formatting or reinitialising the affected media.
• Avoid unnecessary writes to the storage.
• Keep the original device and note the symptoms.
• Record any tools, repair attempts or recovery steps already used.

For RAID, NAS and storage systems

• Record the original disk order and configuration where known.
• Avoid starting rebuild or reinitialisation operations simply to see whether the data returns.
• Avoid writing new data to a degraded or unstable storage system.
• Keep all member devices available for assessment.

For ransomware-related data loss

Preserve the affected storage where practical and avoid unnecessary writes, formatting or reinitialisation. For cybersecurity containment or incident-response decisions, follow your organisation’s IT/security process or consult a qualified security provider. DataRecovery.lk’s ransomware-related service is limited to data recovery assessment and recovery work involving affected storage.