Clear answers before any step
Data recovery — frequently asked questions
These are the questions we are asked most often about losing data, diagnosing faults, how long recovery takes, confidentiality, hard drives, SSD and NVMe, RAID and servers, ransomware, CCTV footage, phones and memory cards.
The answers give the general rule, but they do not replace a diagnosis. The type of medium, the nature of the damage, and what happened after the loss are what actually decide whether recovery is possible.
Search the questions
No question matched. Describe what happened and we will help you identify the first step.
Most asked
Most asked
Eight questions that cover most of what reaches us.
Stop any new writing to the device or storage medium. Do not copy files, do not install software, and do not agree to format. Note what happened and when the files were last visible normally, then ask for an assessment before trying any fix.
Some tools help with simple deletion from a healthy medium, but they do not suit a drive that is slow, intermittent, or does not appear reliably. Installing the tool — or saving its results — onto the same medium can also overwrite the very data you want. If the files matter, an assessment first is safer.
It may be possible. A device that has stopped does not automatically mean the data has gone — the fault may be logical, electrical or mechanical. The inspection establishes why it stopped and what path is open before any judgement about the result.
Yes — inspection and diagnosis are free and carry no obligation. After the diagnosis the condition and the recommended step are explained before any recovery is approved. More about how we work.
It varies with the type of medium, the type of damage, the capacity, how stable the reads are, and whether parts or extra processing are needed. Some logical cases finish within a day or two, while mechanical failures or complex arrays take longer. An estimate follows the diagnosis.
An exact price cannot be set from the device name or capacity alone — two identical drives can carry entirely different faults. After the inspection the type of damage and the scope of work are clear, and the cost is presented before recovery is approved.
Yes. Confidentiality is fundamental: corporate data is processed on isolated media and handed back on separate media, and a non-disclosure agreement can be signed on request. See the privacy policy.
Not always. It depends on the medium, the type of format, the file system, and whether new data was written afterwards. A quick format on an HDD behaves very differently from a full format, or from erasing an SSD with TRIM. More on recovery after formatting.
Before you try anything
Stop any new writing to the device or storage medium. Do not copy files, do not install software, and do not agree to format. Note what happened and when the files were last visible normally, then ask for an assessment before trying any fix.
If there is an unusual noise, a fall, water, or heat and a burning smell, cut the power at once. For deletion or formatting, stop using it so nothing is written over the data. For an active ransomware attack on a company network, isolate the machine from the network first and do not shut it down or restart it at random before coordinating with whoever runs your IT.
Not advisable if the device does not appear, makes a noise, or the fault started after a fall or a power cut. One more power-on may add nothing to the diagnosis while widening the damage. Tell us what happened instead of repeating the test.
Some tools help with simple deletion from a healthy medium, but they do not suit a drive that is slow, intermittent, or does not appear reliably. Installing the tool — or saving its results — onto the same medium can also overwrite the very data you want. If the files matter, an assessment first is safer.
No. A format prompt can mean the file system or partition table cannot be read; it does not necessarily mean the data is gone. Formatting changes the structure of the medium and can reduce the chance of recovering names and folders. See the deletion and formatting questions.
Disconnect the power, do not switch it on, and do not try to dry it with heat. Do not open a mechanical hard drive, and keep every part, cable and enclosure. Tell us the type of damage and whether the device was running at the moment it happened. If a drive was dropped, read what to do when a hard drive falls.
Not necessarily, but everything that was done must be described in detail: how many times it was powered on, which tools were used, whether a format, a rebuild or a file-system repair was run, and whether the device was opened. That history can change the inspection path and stop a damaging step from being repeated.
Just the type of device, what happened before the problem, what you see now, any sounds or error messages, and what was tried after the loss. Describing the sequence matters more than naming the fault. Send the description here.
Diagnosis, time, cost and confidentiality
It may be possible. A device that has stopped does not automatically mean the data has gone — the fault may be logical, electrical or mechanical. The inspection establishes why it stopped and what path is open before any judgement about the result.
Yes — inspection and diagnosis are free and carry no obligation. After the diagnosis the condition and the recommended step are explained before any recovery is approved. More about how we work.
We can give initial guidance and say what to do or avoid, but a recovery rate cannot be confirmed from an external description alone. An accurate assessment needs the storage medium inspected and the history after the fault.
The device type and model if possible, the capacity of the medium, the last event before the loss, the error message, whether the device appears in BIOS or the operating system, any noise or heat, what has been tried so far, and which file types matter most.
It varies with the type of medium, the type of damage, the capacity, how stable the reads are, and whether parts or extra processing are needed. Some logical cases finish within a day or two, while mechanical failures or complex arrays take longer. An estimate follows the diagnosis.
An exact price cannot be set from the device name or capacity alone — two identical drives can carry entirely different faults. After the inspection the type of damage and the scope of work are clear, and the cost is presented before recovery is approved.
No result can be guaranteed before diagnosis. What is possible depends on the state of the medium, how much damage or overwriting has occurred, encryption, and earlier attempts. The honest approach is to set out what to expect after the inspection, without an absolute promise.
No. The path is inspection first, then an explanation of the condition and the options, then your decision. No approved recovery step begins before you know the scope and agree to it.
On separate media — never written back onto the damaged device. The capacity of the delivery medium and whether you collect it or it is shipped are agreed according to the volume of data and where you are — see the shipping and handover questions.
Yes. Confidentiality is fundamental: corporate data is processed on isolated media and handed back on separate media, and a non-disclosure agreement can be signed on request. See the privacy policy.
Hard drive questions
Recovery may be possible, but clicking is a likely sign of physical failure in the heads or the read mechanism. Cut the power at once and do not power it on again; every extra spin-up can damage the platter surface. Read the signs of a failing hard drive and the hard drive recovery page.
Yes — the cable, the enclosure, the USB bridge, the circuit board and the drive itself can all be inspected. Keep the original enclosure and cable, because some external drives depend on them for the connection or for encryption.
It can help with simple logical deletion if the drive is stable and reports its correct capacity. It can be dangerous when the drive is slow, disappears, or makes a noise, because it forces continuous reading and can accelerate the decline.
Stable logical cases can be shorter, while electronic or mechanical failures need inspection, staged imaging and possibly matching parts. A realistic estimate follows the diagnosis rather than a single fixed number.
It may be possible depending on the state of the board and the internal surfaces. Do not power the drive on, do not dry it with heat, and do not clean it yourself. Leave it as it is and send it for inspection with a description of what it went through.
No. Damage to the heads or motor may only show on the first power-on after the fall. If the data matters, a dropped drive is inspected, not tested — whether it was running or switched off when it fell. Details in the dropped-drive guide.
No. Cooling does not address the common failures in modern drives, and it can cause moisture to condense inside, adding corrosion or scratches. Leave it at room temperature and do not power it on again. The full explanation: the freezer myth.
Stop writing to it and copy only what matters most, if it is still reading steadily and making no noise. Do not run sector-repair tools or CHKDSK before taking an image, because slowness and freezing can mean deteriorating read areas.
If there is no unusual noise, trying a different cable and port once is reasonable. Do not swap the drive's board at random; modern boards can carry calibration data unique to that drive. And keep the original enclosure, as it may be part of the connection or the encryption.
SSD and NVMe questions
In some cases, yes. The outcome depends on why it does not appear and on the state of the controller, the firmware, the NAND memory and any encryption. No moving parts does not mean a simple fault. More on SSD and NVMe recovery.
Yes — NVMe and M.2 drives are inspected and the approach follows the protocol, the controller and whether the drive is detected. The M.2 form factor alone does not mean the drive is NVMe; some run the SATA protocol.
Yes. An SSD stores data inside NAND chips and manages its placement through a controller and an internal translation layer, while an HDD relies on magnetic platters and mechanical heads. The tools, the risks and the imaging method all differ.
TRIM can reduce the chance considerably, because it lets the controller erase pages that were logically deleted. That does not make every case impossible, but stopping the drive early is decisive.
The physical data may be extractable, but reading it requires the correct recovery key or password. Sound modern encryption cannot be bypassed simply by reaching the memory chips.
The fault may be in the power, the controller, the firmware or the board, so it is worth inspecting. Do not keep reconnecting it through different enclosures and adapters, and do not attempt a firmware update before the state is preserved.
The controller may have entered a protective mode after detecting an internal fault, or the drive may report an incorrect capacity because of a firmware problem. Do not try to repair the capacity or force writes; if the drive is reading, this session may be the opportunity to image it before it stops.
Not before an assessment. Some updates and initialisations reset internal tables or change the state, and can close a path that was still open for reading. Keep a photo of the error message and the model, then stop experimenting.
Questions after deletion and formatting
Not always. It depends on the medium, the type of format, the file system, and whether new data was written afterwards. A quick format on an HDD behaves very differently from a full format, or from erasing an SSD with TRIM. More on recovery after formatting.
They may be, if their space has not been taken by new data. Stop using the device or card — do not take photographs and do not copy new files, because every write can replace part of the older content.
It can be harder than on an HDD because of TRIM, internal encryption and memory management. The word “format” alone is not enough to judge; the type of drive, the method used, and what happened afterwards all matter.
A quick format rebuilds parts of the file-system structure and can leave large areas of old data intact, while a full format writes across a much wider area and can sharply reduce the chance. The details also vary by operating system and medium.
Some data may survive if the new system has not occupied the same space, but system files, updates and applications write continuously. Switch the machine off and stop using it, and do not install recovery software onto that same drive.
Deleting removes references to specific files, formatting creates a new file-system structure, and deleting a partition removes its boundaries from the partition table. The effects differ, but the rule is the same: do not create a new structure and do not write to the medium before an assessment.
The file-system structure and the data may still sit behind the missing partition table. Do not create a new partition and do not use automatic repair tools; the correct step is to identify the boundaries of the old partition and work on an image.
Not necessarily. Deletion usually removes the file's reference before its content, but the space becomes available for new writes. Stop using the drive, especially if it is the system drive or an SSD.
If the file-system records survive, names and paths may return. If the index is damaged, files may be recovered from their content and signatures without their original names or folders. The inspection establishes which of the two applies.
RAID and server questions
It depends on the RAID level, the number of disks, the order in which they dropped out, and how well each still reads. Even beyond the designed tolerance there may be options — but do not start another rebuild before the inspection. More on RAID and server recovery.
Yes — NAS systems can be assessed when disks, the file system or the storage layers fail. The unit must be treated as one interdependent set, not as separate disks inspected in isolation.
Stop the system, do not start another rebuild, and do not reinsert old disks or change their order. Photograph the error messages and the controller log, then preserve every disk exactly as it is.
Common levels such as RAID 0, 1, 5, 6 and 10 can be assessed, as well as NAS, SAN and software RAID. The path follows the number of disks, how the data is distributed, and the controller and file system. New to this? What is RAID?
Send every disk in the array unless told otherwise, each numbered by its original position. Rebuilding a RAID needs the disks read together and needs to establish which one dropped out first.
Continuing to run can add new writes or trigger an automatic rebuild. In critical cases it is better to stop the services and any writing and freeze the state, then assess whether the system should be shut down entirely.
Not necessarily. The order, the stripe size and the parity direction can sometimes be inferred from the disks' contents, though that is longer and harder. Do not try random orders and do not create a new array.
The device and controller, the RAID level, the number of disks and their capacities, the port order, the error messages, the sequence of failures, any rebuild or replacement performed, and which data matters — databases or virtual machines, for example.
No. RAID keeps a system running when a disk fails within its design limits, but it does not protect against deletion, ransomware, file-system corruption, fire or human error. A backup must be separate and tested.
Ransomware questions
It may be possible depending on the ransomware family, the encryption pattern, the state of the backups, and whether deleted originals, snapshots or unencrypted fragments survive. No promise can be made before a sample from the case is analysed. More on the service.
Usually not. Removing the malware may stop further activity, but it does not decrypt files whose contents have already been changed. Cleaning the system and recovering the data are two separate jobs.
Paying does not guarantee a working key, and it does not prove that a stolen copy of the data was deleted. The decision can carry management, legal and regulatory dimensions, so it starts with a technical assessment of the backups, the data and the alternatives — not with the attacker's promise.
No. Some families have reliable tools in specific circumstances; others have no general decryptor. Files can also be partially encrypted or damaged. The family, the version and the encryption pattern must be identified before choosing a path.
Keep multiple backups, with one immutable or disconnected from the network, and test restores regularly. Close exposed remote access, enable multi-factor authentication, patch systems, reduce account privileges, and separate the backup network from production. The full guide: protecting a server from ransomware.
Isolate it from the network by pulling the cable or disabling the port, and disconnect backup units before the encryption reaches them. Do not delete files, do not format and do not rebuild. Record the time and the affected systems and coordinate with whoever owns security or IT.
Keep the ransom note, the new file extension, a sample of an encrypted file, and an intact copy of the same type if one exists. These help identify the family and the encryption method — though a matching extension alone is not always enough.
Database files such as MDF and LDF, and virtual machine images such as VMDK and VHDX, can be assessed, because some attacks encrypt scattered portions of large files. The structure and the intact pages are examined on a copy before any attempt to start the database or the virtual machine.
Isolate them and do not reconnect them to the infected system. Backups, previous versions, snapshots and unallocated space can all be examined for what survived or was deleted before the encryption. A copy permanently attached to the network may fall inside the blast radius.
Never on the only copy. Verify its source and that it matches the ransomware family, and take a copy of the encrypted data first. The wrong tool can alter the files or introduce a fresh infection.
CCTV footage questions
It may be, if new recordings have not been written over the space you need. Stop the recorder at once and note the date, the time and the camera number, with a margin before and after the event. More on CCTV recovery.
The outcome depends on the type of initialisation, the storage format, the state of the drive, and how much new recording followed. Do not initialise or format again, and do not return the disk to a device that will resume recording.
Hikvision, Dahua and other common systems can be examined. The brand name alone is not enough; the model, the firmware version, how clips are stored and the internal index all need to be identified.
If new data has been written over the entire clip, nothing returns from the replaced space. Fragments or gaps may survive depending on the recording pattern, the disk capacity and the number of channels — the inspection establishes what actually remains.
Behaviour differs between devices, but the bigger risk is recording continuing in the background. It is better to stop the device and avoid unnecessary operations on the only storage medium.
If the channel was recording audio and that data still exists, it may be extracted with the clip. Some systems store audio separately or do not record it at all, so the channel settings and the recording structure are reviewed.
It can be assessed, but it needs every disk with its order and the RAID details. The case is treated as footage recovery and array recovery at the same time — disks must not be swapped and the array must not be rebuilt at random.
Yes, depending on the state of the card and how much new writing has occurred. Remove the card, do not put it back in the camera, and do not record test clips or format it. See memory card recovery.
They are useful indicators, but they can be affected by the device clock, the time zone, daylight saving, or a reset. In sensitive cases the clock offset and the extraction method should be documented.
Admissibility is decided by the competent authority and cannot be guaranteed by a recovery provider. If the purpose is legal, say so before intake so that documentation requirements, original copies, chain of custody and the handover method can be discussed.
Stop the device immediately. It is now first and foremost a hard drive failure, and continued running adds unstable reads and writes new footage over the source itself. Do not move the disk into another DVR.
It depends on the storage capacity, the number of cameras, the resolution, the frame rate, and whether recording is continuous or motion-triggered. Do not rely on a general number of days; stop the recording and work out the window you need from the device's actual settings.
Phone data recovery questions
Switch it off, do not charge it, do not use a hairdryer, and do not put it in rice. Disconnect accessories and leave it off; current and heat can accelerate corrosion inside the board. The inspection establishes whether the board can be brought back to a state that allows extraction. More on phone recovery.
In many cases yes, if the device runs and the board and memory are intact. A temporary repair to the display or touch path may be needed so the passcode can be entered and the data extracted safely.
Modern devices use encryption tied to keys that a factory reset usually destroys, so older data can become unreadable even when the memory is accessible. The judgement depends on the model, the OS version and the encryption method.
It depends on the operating system, its version and the state of the device. On modern phones the passcode is part of decrypting the data, so the correct code may be essential — and bypassing sound encryption cannot be promised.
Passwords are not requested during inspection. If a specific step needs proof of ownership, unlocking the device, or access to a cloud backup, the reason and the method are explained in advance and your credentials stay under your control.
Some cases require opening the device, working on the board, or a temporary repair to the boot path. The aim may be to bring the device up once so the data can be extracted, not to return it to daily use. That possibility is made clear before work starts.
The problem may be power, the operating system, the memory or the board. On encrypted devices the path is usually to bring the original board back to a stable boot state and then unlock it with the passcode; moving the memory alone to another board is generally not enough.
It depends on the device, the encryption, whether an iCloud, Google or in-app backup exists, and how long the phone was used after the deletion. On modern devices access keys may be removed or the space reused quickly, so there is no guaranteed general outcome.
Memory card and USB questions
No. The fault may be in the file table while the data is still there, and formatting can change the very structure that helps recover names and folders. Unplug it and do not write to it. More on the service.
It may be, depending on the card, the video structure and how much new footage was shot. Remove the card immediately; video clips can be fragmented and need reassembling from their structure, not a search for a single file.
The connector, the traces, the board and the NAND chip can all be examined. If the chip is intact there may be a way to read it — but do not solder, glue, or keep reinserting it, because a short circuit can destroy the memory itself.
The fault may be in the contacts, the controller or the chip. Some cards are monolithic — a single moulded piece — and need specialised access, so what is possible follows from the card type and the state of the memory.
Stable logical cases can finish within a day or two, while a physical break, an electrical fault or monolithic media need longer to complete the read and rebuild the data order. The estimate follows the inspection.
Not necessarily, but every new photo or video can overwrite older space. Stop using the card immediately; whole files or fragments may return depending on where the new writes landed.
That can point to a fault in the controller or the internal firmware rather than ordinary deletion. Do not use factory initialisation or capacity-repair tools; they can reset the medium instead of reading the data.
If the file system and its index are readable, names and folders may return. If the index is damaged, photos and videos may be recovered by signature and internal structure without their original names.
Locations, shipping and handover
Yes. The lab is in Riyadh and you can hand the device over during working hours: Saturday to Thursday, 10 AM to 10 PM. It helps to send a description of the case and confirm the time before coming.
Yes. Disconnect the cables, put the storage medium in an anti-static bag and then in a padded box that stops it moving. Do not let the courier or any shop power it up or test it on the way.
It may, if the device arrives during working hours — but that is not a promise to finish the diagnosis the same day. Inspection time varies with the medium, the fault and the number of disks.
No. The lab is in Riyadh, and cases from Jeddah and Dammam and the Eastern Province arrive by shipping after an initial conversation and packing instructions.
Put the drive in an anti-static ESD bag, then inside a rigid box with padding that stops movement on every side. Include the enclosure, cable and power adapter if the device is external, and do not power it on before packing. Use a trackable shipment.
Talk to us first. In many cases all the disks are enough, after photographing their order and numbering each by its port, along with the controller and RAID details and the error messages. Sometimes the controller or the whole unit is needed if the setup is non-standard.
Inspection and diagnosis are free and carry no obligation, while arranging the shipment, its cost and the transit time are the client's responsibility with the courier. After recovery the files are handed over on separate media and returned by the agreed method.
Yes, a non-disclosure agreement can be signed on request. For corporate cases it can be agreed before the disks leave your site, along with the intake and handover method and any special requirements ahead of shipping.
Didn't find your case?
You do not need to know the name of the fault. Describe what happened.
Send the type of device, the last thing that happened before the data was lost, the message you saw, and what has been tried so far. We will give you the correct first step, then the free inspection and diagnosis begins, with no obligation.
Clear diagnosis · Full confidentiality · Handover on separate media