Data recovery for businesses

Lost data and need it today. Whether it's a non-booting server, a degraded RAID, a disk that stopped being recognized, or a ransomware attack that encrypted the partitions, the first few hours decide almost everything. DataRoad provides data recovery for businesses: this page explains what it does in each case, what no does, and what it should do in the next few minutes.

What to do now — before you call us

Three decisions in the first few minutes determine whether the data comes back or not:

• Switch off the equipment. Every minute that a faulty disk stays powered on means more wear and a higher likelihood of overwriting what is still recoverable. If you hear clicking or abnormal noises, unplug it immediately.
• Do not install recovery software on the affected drive. Installing a program writes to the disk and can destroy precisely the blocks you wanted to save.
• Do not run automatic repairs. One chkdsk or a “repair volume” on a disk with bad sectors usually makes the condition worse, not better.

In case of a suspected ransomware attack, add a fourth: disconnect the machine from the network without turning it off, and do not pay or contact whoever is demanding the ransom before assessing the extent of the encryption and the state of the backups.

Situations we resolve

Server that won't boot

Controller, boot, file system or configuration failure. In most cases the data is intact and what has failed is the path to it. We mount the disks in a controlled environment, extract the content and restore the service, usually without touching the original disks.

Degraded RAID or with more than one disk failing

RAID 5 can tolerate one failed drive; when a second one fails, the volume disappears. That is where we see the most preventable data loss, because the first drive usually failed weeks earlier without anyone noticing. We rebuild the array by imaging the drives, never by rebuilding directly onto the original — a poorly executed rebuild turns a recoverable issue into a permanent one.

Ransomware and encrypted files

We assessed the scope, identified the variant, checked the status of backups and previous versions, and rebuilt from the most recent clean point. In parallel, we dealt with the cause: how it got in, what credentials were used, and what to close off so it doesn't happen again.

Backups that do not restore

It is more common than it seems: the routine runs every night and no one has tested the restoration for two years. When it is needed, it turns out that volumes are missing, that the retention period was shorter than thought, or that the backup destination itself has been encrypted. We recover what exists and leave the routine tested.

Workstations, laptops and external hard drives

Accidental deletion, formatting, lost partitions, systems that have stopped booting. On an SSD, the chances drop very quickly after a deletion, because of TRIM — here, speed matters more than in any other case.

What we don't do — and why we are telling you

We don't have a cleanroom. When the problem is physical — scratched platters, damaged read heads, burnt electronics, a clicking drive — the opening has to be done in a controlled-environment laboratory, and any attempt outside of one reduces the chances.

In such cases we say so immediately, indicate laboratories we work with and handle the coordination: preparation of the shipment, technical monitoring, validation of what has returned and reintegration of the data into the infrastructure. We do not charge for attempting what we should not do.

How we work

1. Diagnosis. We assess the state of the media and tell you in writing what is recoverable, with what probability and at what cost. No obligation up to that point.
2. Image above all. We always work on a block-by-block copy. The original remains intact and available for a second attempt, by us or by third parties.
3. Recovery and validation. We extract and verify the integrity of what has been recovered — we do not deliver a list of files without confirming that they open.
4. Restoration of service. We return the data to the place where it needs to be and, if applicable, we rebuild the server or the volume.
5. Cause and prevention. At the end we explain what went wrong and what changes so as not to repeat it. It is the part that most people skip.

After recovery: ensuring it doesn't happen again

The way to never need this page again is to have a disaster recovery plan with written RPO and RTO and tested copies.

Data recovery is the invoice for a prevention that never happened. In the contracts of Unlimited IT support the backups are monitored and tested by restoration, not just scheduled ones, and the monitoring alerts you when a drive starts showing signs — which is weeks before it fails. A drive replaced in time costs a fraction of what a recovery costs.

It is also worth reading what to do in first hours after data loss and how does it work managed cybersecurity, where ransomware protection is included.

Para empresas na capital, veja a nossa assistência informática em Lisboa, com suporte remoto, telefónico e no local.

Frequently Asked Questions

Data recovery is one of IT services for businesses What we lend.

Do you need help now

If you are in the middle of data loss, call +351 211 459 950 before trying anything else. The initial diagnosis is free of charge and we tell you frankly whether it is a case for us or for a laboratory.