For important data on a suspect drive
Use this guide for storage you own or are authorised to manage. It focuses on preserving data and choosing an assessment, not opening a drive or promising recovery. Work equipment, shared storage and RAID/NAS systems need their responsible IT team.
Step 1 of 6
Stop use for danger or new mechanical failure
Stop use for danger or new mechanical failure
If a spinning hard drive starts grinding, clanking or repeatedly failing to start, stop accessing it and power down the affected equipment if safe. Do not restart it to record the sound, run a health test or attempt a full backup. Physical damage and repeated retries can make recovery harder. If the information is valuable or the only copy, arrange a recovery assessment before further access.
Smoke, a burning smell, liquid, damaged power equipment or an unsafe hot device changes the priority to personal safety. Do not touch suspect equipment, unplug it by a damaged lead or move a unit that is unsafe to handle. Keep clear and use appropriate emergency or qualified assistance for the actual danger. Do not put a drive in a freezer, add ice or liquid, shake it or attempt an internal repair.
Some soft chattering or clicking during normal hard-drive work can be normal; a changed sound is not a complete diagnosis. Fans and other moving parts can also make noise. An SSD has no spinning disk mechanism. Do not power equipment back on merely to locate a noise. For a drive that is only warm and working normally, use the exact model’s documented conditions; there is no universal case-temperature test or cooling time that establishes safety.
Stop self-testing for mechanical failure or unsafe conditions. Continue recording only from a safe position or existing information; it does not require powering the drive again.
Identify the device and record what happened
Identify the device and record what happened
From existing records or safely visible information, note the affected computer or external device, its model, what changed and the exact message already seen. Useful history includes a drop, liquid exposure, power interruption, heat warning or an unusual sound. Do not start another session, pick up unsafe equipment or run a test just to collect evidence. Keep serial numbers, file names and account details private.
Separate an internal drive, external USB drive, SSD, memory card and shared NAS/RAID system. A crashed computer can have a software, power or other hardware fault. A drive not appearing can involve its cable, enclosure, connection or encryption; that symptom alone does not establish physical damage. Keep the original enclosure and matching parts together without taking them apart.
For shared or managed storage, stop unauthorised changes and contact its responsible team. Do not remove or reorder RAID/NAS disks, initialise an unfamiliar disk or bypass access controls. Record which important files are affected and whether another verified copy exists. If the device is undamaged and the issue is clearly ordinary USB detection, the USB connection guide may be relevant; do not use repeated connection tests on a physically suspect drive.
Keep the original device and parts intact. Record known symptoms and data priorities without treating an error message or computer crash as a confirmed drive diagnosis.
Check existing backups and identify the missing files
Check existing backups and identify the missing files
Check an existing backup, separate device or supported online recovery history using an appropriate healthy system. Confirm its date and whether the required folders/files are actually present. A sync icon, completed-job message or copy on another folder of the same failing drive is not proof of an independent usable backup. Keep version and retention limits in mind.
Open a harmless sample from the existing copy, or restore a sample to a separate healthy location, without replacing the only original or older recovery versions. The backup and recovery checks explain how to verify a copy. Identify the files still missing, their importance and any encryption recovery key or legitimate account access the responsible provider may need. Never post keys or passwords in a support note.
For grinding, physical damage or repeated failure, do not try to create that missing backup by continuing to run the source. A recovery provider should assess whether and how to access it. A stable drive showing a health warning may still need prompt copying and replacement, but the appropriate plan depends on its condition and the value of the data. Ask for that plan rather than alternating full scans, retries and copies. A known-good complete backup can change the recovery decision; it does not make the failed drive reliable.
Verify copies on healthy storage and preserve their versions. Missing or unverified data keeps recovery assessment relevant; a backup check does not authorise further use of a grinding source.
More checks3 detailed checks
Avoid writes and destructive repair prompts
Avoid writes and destructive repair prompts
If the drive contains needed data, do not accept Format, Initialise, Erase, factory reset or operating-system reinstall to make it appear usable. Avoid running repair utilities, file-system repairs, stress tests, firmware updates or a long recovery scan on the suspect source before an appropriate preservation plan. Save files recovered later to different healthy storage, never back onto the only source.
RAW, unallocated or uninitialised status can have several causes. Some encrypted external products can appear unavailable until properly unlocked; this is not a reason to initialise them. Use the genuine owner/provider recovery route and preserve legitimate keys. Do not guess repeatedly, bypass encryption or download an advertised recovery tool from a pop-up.
Utilities such as Disk Utility First Aid address some file-system problems; they cannot repair physical hardware failure and their normal workflows require a backup. Instructions that finish with erasing a disk are not a recovery procedure for someone who still needs its contents. Keep any message already available and tell the assessor which actions have already been attempted. If no data is required, replacement or reuse is a separate decision after condition, ownership and safe disposal are considered.
Cancel destructive prompts when data is needed. Being able to format, mount or briefly read a drive does not establish that it is healthy or that the files are safe.
Arrange assessment before a warranty return or replacement
Arrange assessment before a warranty return or replacement
Contact the responsible IT team or an appropriate data-recovery provider before returning, replacing or disposing of the source. A warranty replacement is not the same as recovering your files and can mean surrendering the original. Explain the symptoms, what happened, required data, existing copies, encryption and previous attempts. Ask whether the provider handles the suspected fault or needs to arrange a specialist assessment.
Our data recovery service is a relevant starting point for discussing the problem and next step. Agree assessment charges, consent before additional work, privacy, destination storage and what outcome will be checked. Recovery can be incomplete or impossible; a quote or initial detection is not proof that the required files are recoverable.
Keep an intact disconnected drive stationary and protected from knocks, moisture and pressure. Follow the receiving provider’s packaging instructions, using suitable protective packaging where safe. Do not open a sealed drive, remove an internal drive by guesswork or attempt board swaps. Wet, electrically unsafe or battery-damaged equipment needs appropriate handling advice before packing or transporting; an ordinary padded case does not resolve those hazards.
Agree recovery and original-device handling before surrendering it. Proceed to verification only when there is an actual recovered copy or replacement outcome to check; otherwise keep the assessment in progress.
Verify recovered files and plan reliable storage
Verify recovered files and plan reliable storage
On an appropriate healthy destination, check the agreed priority folders, file counts/date range where useful, and open representative harmless files with their normal apps. A list of recovered file names or successful transfer message does not establish that every file is complete. Record omissions, corruption or unavailable encrypted material with the provider. Keep sensitive customer/work data within the agreed access rules.
Do not overwrite or dispose of the original until its handling is agreed and the required outcome has been checked. A physically failing drive is not repaired because it briefly works or some files were copied. Use a suitable replacement and restore normal apps/access through their supported routes; for continuing computer crashes, preserve evidence and use the crash troubleshooting guide rather than assume the drive explains every fault.
When the agreed files and normal tasks have been checked, keep separate protected backups and test a restore periodically. If important data is still missing or unreadable, return to the assessment with that precise finding. Stop unnecessary attempts on the source; no recovery result or future backup arrangement guarantees that a storage device cannot fail again.
Check real file contents and required tasks on healthy storage. Finish only the agreed recovery/replacement outcome; unresolved missing data remains an assessment issue, not a reason to keep retrying the original.
