WeRecoverData

Failure symptoms, likely cause, and recoverability

The table below maps what a user actually observes to the underlying fault class, what to do first, and what usually determines whether the data can be recovered. It covers hard drives, SSDs, RAID arrays, and flash media.

Hard drive symptoms

Hard drive symptoms
SymptomLikely causeFault classCorrect first actionEffect on recoverability
Repeating click or beep on power-upHead assembly failure or heads stuck on plattersPhysicalPower down immediately, do not retryGood if powered down early; each retry risks surface damage
Grinding or scraping noiseHead contact with the platter surfacePhysicalPower down immediatelyReduced; damaged tracks may be permanently unreadable
No spin-up, no sound at allSeized motor bearing, or electronics/PCB failurePhysicalPower down, do not attempt a board swapUsually good — the media itself is typically undamaged
Detected by BIOS with wrong capacity or model nameFirmware / service area corruptionPhysical (firmware)Power down, do not run repair utilitiesUsually good once the service area is repaired in a lab
Very slow reads, system freezes on certain filesBad sectors and read retriesMixedStop using the drive, image it before anything elseTime-critical; degradation is typically progressive
Drive asks to be formattedFile system or partition table corruptionLogicalDecline the format, stop writing to the driveUsually good if nothing is written afterwards
Files deleted or volume reformattedUser or software actionLogicalStop using the device immediatelyDepends entirely on how much was written since
Burnt smell, visible scorching on the boardElectronics failure, often power relatedPhysicalDo not reapply powerUsually good; damage is normally confined to the board

SSD and flash symptoms

SSD and flash symptoms
SymptomLikely causeFault classCorrect first actionEffect on recoverability
Device not detected at allController failure or power-supply fault on the boardPhysicalStop power cyclingDepends on controller family and encryption state
Detected with 0 MB capacity or a generic vendor nameController has entered a safe/panic modePhysical (firmware)Power down, do not initialise the diskOften recoverable in a lab; initialising the disk is destructive
Read-only: files visible but nothing can be writtenController has entered a protective read-only stateFirmwareCopy the data off immediately, to another deviceGood while the state persists — it may not survive a reboot
USB drive reports “please insert disk”Controller or NAND page failurePhysicalStop retrying, do not formatDepends on controller; chip-level work may be required
Files deleted from a TRIM-enabled SSDTRIM plus garbage collectionLogicalPower down immediatelyPoor — deleted contents are commonly erased within seconds
Memory card unreadable after camera errorFile system corruption or NAND wearMixedStop shooting to that card, do not let the device repair itUsually good if the card is not written to again

RAID, NAS and server symptoms

RAID, NAS and server symptoms
SymptomLikely causeFault classCorrect first actionEffect on recoverability
Array reported degraded, one member offlineSingle member failurePhysicalDo not rebuild yet; label the drive order firstGood — but an immediate rebuild can destroy it
Array offline after a rebuild attemptSecond member dropped, or parity written over good dataMixedPower down the whole arrayVariable; reconstruct from images, not from the controller
NAS boots but shares are emptyVolume or file system corruption on an intact arrayLogicalDo not run the vendor repair or reset the configurationUsually good if configuration is not overwritten
Controller replaced, array now shows as foreign or uninitialisedMetadata mismatch between controller and membersLogicalDo not initialise or import as newGood — the member data is normally untouched
Accidentally reinitialised or reconfigured the arrayAdministrative actionLogicalPower down before anything is writtenDepends on whether a rebuild or format followed

Notes