What to do now
Switch off, do not reinstall, do not try to recover by yourself.
Servers and RAID
Server that won't boot, degraded RAID or failing drives.
Ransomware
Encrypted files: recovery from copies and containment.
Data recovery for businesses
Lost data and need it today. Be it a server that won't boot, a degraded RAID, a drive that is no longer recognised or a ransomware attack that has encrypted shares, the first few hours decide almost everything. This page explains what DataRoad does in each case, what no does, and what it should do in the next few minutes.
What to do now — before you call us
Three decisions in the first few minutes determine whether the data comes back or not:
- Switch off the equipment. Every minute that a faulty disk stays powered on means more wear and a higher likelihood of overwriting what is still recoverable. If you hear clicking or abnormal noises, unplug it immediately.
- Do not install recovery software on the affected drive. Installing a program writes to the disk and can destroy precisely the blocks you wanted to save.
- Do not run automatic repairs. One
chkdskor a “repair volume” on a disk with bad sectors usually makes the condition worse, not better.
In case of a suspected ransomware attack, add a fourth: disconnect the machine from the network without turning it off, and do not pay or contact whoever is demanding the ransom before assessing the extent of the encryption and the state of the backups.
Situations we resolve
Server that won't boot
Controller, boot, file system or configuration failure. In most cases the data is intact and what has failed is the path to it. We mount the disks in a controlled environment, extract the content and restore the service, usually without touching the original disks.
Degraded RAID or with more than one disk failing
RAID 5 can tolerate one failed drive; when a second one fails, the volume disappears. That is where we see the most preventable data loss, because the first drive usually failed weeks earlier without anyone noticing. We rebuild the array by imaging the drives, never by rebuilding directly onto the original — a poorly executed rebuild turns a recoverable issue into a permanent one.
Ransomware and encrypted files
We assessed the scope, identified the variant, checked the status of backups and previous versions, and rebuilt from the most recent clean point. In parallel, we dealt with the cause: how it got in, what credentials were used, and what to close off so it doesn't happen again.
Backups that do not restore
It is more common than it seems: the routine runs every night and no one has tested the restoration for two years. When it is needed, it turns out that volumes are missing, that the retention period was shorter than thought, or that the backup destination itself has been encrypted. We recover what exists and leave the routine tested.
Workstations, laptops and external hard drives
Accidental deletion, formatting, lost partitions, systems that have stopped booting. On an SSD, the chances drop very quickly after a deletion, because of TRIM — here, speed matters more than in any other case.
What we don't do — and why we are telling you
We don't have a cleanroom. When the problem is physical — scratched platters, damaged read heads, burnt electronics, a clicking drive — the opening has to be done in a controlled-environment laboratory, and any attempt outside of one reduces the chances.
In such cases we say so immediately, indicate laboratories we work with and handle the coordination: preparation of the shipment, technical monitoring, validation of what has returned and reintegration of the data into the infrastructure. We do not charge for attempting what we should not do.
How we work
- Diagnosis. We assess the state of the media and tell you in writing what is recoverable, with what probability and at what cost. No obligation up to that point.
- Image above all. We always work on a block-by-block copy. The original remains intact and available for a second attempt, by us or by third parties.
- Recovery and validation. We extract and verify the integrity of what has been recovered — we do not deliver a list of files without confirming that they open.
- Restoration of service. We return the data to the place where it needs to be and, if applicable, we rebuild the server or the volume.
- Cause and prevention. At the end we explain what went wrong and what changes so as not to repeat it. It is the part that most people skip.
After recovery: ensuring it doesn't happen again
The way to never need this page again is to have a disaster recovery plan with written RPO and RTO and tested copies.
Data recovery is the invoice for a prevention that never happened. In the contracts of Unlimited IT support the backups are monitored and tested by restoration, not just scheduled ones, and the monitoring alerts you when a drive starts showing signs — which is weeks before it fails. A drive replaced in time costs a fraction of what a recovery costs.
It is also worth reading what to do in first hours after data loss and how does it work managed cybersecurity, where ransomware protection is included.
Frequently Asked Questions
How long does data recovery take?
It depends on the type of failure. A logical failure on a server or a RAID volume is usually resolved on the same day or the next. A hard drive with physical damage, sent to the laboratory, normally takes from a few days to two weeks. We give the initial diagnosis in hours, not days.
How much does data recovery cost?
A logical recovery performed by us has a predictable cost and is quoted after diagnosis. A laboratory intervention in a cleanroom is substantially more expensive, and the price depends on the condition of the storage media. In either case, we state the price before proceeding — we never start and bill afterwards.
Can the data be recovered at 100%?
Rarely can anyone promise it honestly. In a recent logic failure and with the equipment switched off in time, the rate is very high. On an SSD after erasure, or on a drive that continued working with bad sectors, it may be partial. We tell you what we expect to recover before accepting the job.
Do you work with individuals?
No. DataRoad works with businesses. If the loss is on personal equipment, we can recommend laboratories that provide this service.
What if the ransomware attack has already encrypted the backups?
It happens, and that is why a backup that lives on the same network is not a backup. In this scenario we look for copies out of reach of the attack — previous versions, cloud retention, storage snapshots — and assess what is rebuildable from other sources. It is also time to rethink the copy architecture.
Do we need to have a contract with you to request a recovery?
For an emergency, no. We respond to one-off corporate data recovery requests. Ongoing support, on the other hand, is only available under a contract.
Data recovery is one of IT services for businesses What we lend.
Do you need help now
If you are in the middle of data loss, call 211 459 950 before trying anything else. The initial diagnosis is free and we'll tell you honestly whether it's a job for us or for a laboratory.