--- title: "Data loss at work: what to do in the first hour | DataRoad IT" description: "Data loss at work: what to do in the first 60 minutes, the mistakes that make it permanent and how managed backup prevents it. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/data-loss-first-hour-response-protocol/ source: https://www.dataroad-it.com/en/data-loss-first-hour-response-protocol/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Data loss at work: what to do in the first 60 minutes, the mistakes that make it permanent and how managed backup prevents it. No-obligation proposal. # Data loss at work: what to do in the first hour At a glance For decision-makers short on time. - 01 The first hour decides: most permanent losses come from recovery attempts. - 02 Switch off, do not restart and do not install recovery software on the affected disk. - 03 Ransomware is a security incident: isolate, check backups, preserve evidence. - 04 Three copies, scheduled restores and alarms mean you never need recovery. ### In this article Most data lost forever is not lost in the incident. It is lost afterwards, in the attempts to save it. That is why **business data loss** is handled with discipline: switch off, install nothing on the affected disk, check the backups before anything else. And the bigger lesson comes afterwards: recovering data is expensive, slow and without guarantee; a managed backup with tested restores means you never have to. ## The essentials before you touch anything - **The first 60 minutes decide** The greatest damage usually comes from the attempts, not the fault. - **Switch off and do not write to the disk** Never install recovery tools on it. - **Recovery is the last resort** High cost, long lead time, uncertain outcome. - **A backup without a tested restore** Is not a backup, it is hope. ## What should you do in the first 60 minutes? - **Take the device out of use**: a failing disk gets worse with every minute powered on, and any write can overwrite the deleted files. - **Resist restarting**: with a mechanical fault, each boot scrapes the read head across an already damaged surface. - **Disconnect from the network**: at the slightest suspicion of malware, so it does not reach shared folders. - **Go to the backups**: if there is a recent, healthy copy, you no longer have a recovery problem: you have a restore, faster, cheaper and guaranteed. - **Write everything down**: noises, on-screen messages, the task in progress, what has already been tried. It saves hours for whoever steps in. - **Repeated clicking? Switch off immediately**: it is a physical fault; software attempts only make it worse. ## Which actions destroy data that could still be saved? - **Installing recovery software on the disk itself** The installation writes over what you want to rescue. - **Running check and repair tools** They are designed to fix file systems, not dying hardware, and can make the damage permanent. - **Formatting or reinstalling "to see if it works"**. - **Opening the disk** Outside a clean room, the platters are contaminated for good. - **Trying internet tricks** The freezer, tapping it, swapping the board: old myths that ruin recoverable cases. ## What type of loss are you dealing with? | Situation | Signs | Chances | | --- | --- | --- | | Files deleted by mistake | They have disappeared, but the disk works | The best: provided nobody writes to the volume again | | Logical failure | Partition gone, file system damaged, prompt to format | Good, with the right tools and experienced engineers; the disk is fine, the index is lost | | Physical failure | Noises, disk not detected, intermittent faults | Only in a lab with a clean room; the most expensive and the least forgiving of amateur attempts | | Degraded RAID | One disk died months ago with no alarm; the second exposes the problem | Depends on the rebuild order: getting it wrong destroys the entire array | ## What if it is ransomware? Then it is no longer recovery: it is a security incident. Take the affected devices off the network, but keep them powered on if you want to investigate. Check whether the backups were reached: those permanently connected to the network are the first target. Preserve the evidence before cleaning up. Paying the ransom is a management decision, not a technical one: it guarantees nothing and funds the next attack. Involve the board and, where appropriate, lawyers and the authorities. Where personal data is involved, there are mandatory notifications with short deadlines. ## How do you make sure you never need this protocol? - **The three-copy rule** Production, a local copy for fast restores and a copy off-site or disconnected from the network, beyond ransomware's reach. - **Restores on set dates** A backup that has never been restored is an assumption. Schedule the test as you would a fire drill. - **Alarms** Know the backup failed on the day it happened, not on the day you need it. DataRoad - IT Services and Consulting manages [backup and disaster recovery for businesses](https://www.dataroad-it.com/en/managed-backup-services-portugal/), with tested restores and continuous monitoring, as part of our [managed IT services](https://www.dataroad-it.com/en/managed-it-services-networks-security-cloud/). In 11 years, DataRoad has never suffered a security incident. ## Has the loss already happened? See our [business data recovery](https://www.dataroad-it.com/en/business-data-recovery-servers-raid-nas/) service: what we resolve in-house, what goes to the lab and how to request a diagnosis. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and phone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed IT for business ## One StepAhead of IT. Technology that works quietly, so your team works without interruptions. Engineering precision in every request. - **11** years in business, since 2015 - **1** contract and one owner for everything - **232** clients under management We do **IT** right. DataRoad IT Unlimited ## Operational continuity is not luck. It is method and contract. IT Unlimited reduces risk and shows in writing what changed. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/data-loss-first-hour-response-protocol/