Data loss at work: what to do in the first hour

• The first 60 minutes decide The greatest damage usually comes from the attempts, not the fault.
• Switch off and do not write to the disk Never install recovery tools on it.
• Recovery is the last resort High cost, long lead time, uncertain outcome.
• A backup without a tested restore Is not a backup, it is hope.

1. Take the device out of use: a failing disk gets worse with every minute powered on, and any write can overwrite the deleted files.
2. Resist restarting: with a mechanical fault, each boot scrapes the read head across an already damaged surface.
3. Disconnect from the network: at the slightest suspicion of malware, so it does not reach shared folders.
4. Go to the backups: if there is a recent, healthy copy, you no longer have a recovery problem: you have a restore, faster, cheaper and guaranteed.
5. Write everything down: noises, on-screen messages, the task in progress, what has already been tried. It saves hours for whoever steps in.
6. Repeated clicking? Switch off immediately: it is a physical fault; software attempts only make it worse.

• Installing recovery software on the disk itself The installation writes over what you want to rescue.
• Running check and repair tools They are designed to fix file systems, not dying hardware, and can make the damage permanent.
• Formatting or reinstalling "to see if it works".
• Opening the disk Outside a clean room, the platters are contaminated for good.
• Trying internet tricks The freezer, tapping it, swapping the board: old myths that ruin recoverable cases.

Then it is no longer recovery: it is a security incident. Take the affected devices off the network, but keep them powered on if you want to investigate. Check whether the backups were reached: those permanently connected to the network are the first target. Preserve the evidence before cleaning up.

Paying the ransom is a management decision, not a technical one: it guarantees nothing and funds the next attack. Involve the board and, where appropriate, lawyers and the authorities. Where personal data is involved, there are mandatory notifications with short deadlines.

• The three-copy rule Production, a local copy for fast restores and a copy off-site or disconnected from the network, beyond ransomware's reach.
• Restores on set dates A backup that has never been restored is an assumption. Schedule the test as you would a fire drill.
• Alarms Know the backup failed on the day it happened, not on the day you need it.

DataRoad - IT Services and Consulting manages backup and disaster recovery for businesses, with tested restores and continuous monitoring, as part of our managed IT services. In 11 years, DataRoad has never suffered a security incident.

See our business data recovery service: what we resolve in-house, what goes to the lab and how to request a diagnosis. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and phone support.

Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.