Media handling: what helps, what destroys data

Most permanent data loss we see was caused after the original failure, by well-intentioned troubleshooting. The tables below list what to do and what to avoid, and explain the mechanism in each case.

Actions that reduce recoverability

Actions that reduce recoverability
Action	Applies to	Mechanism	Severity
Continuing to power a clicking drive	Hard drives	Failed heads abrade the platter surface on every rotation	Severe
Running chkdsk / fsck on a failing drive	All	Writes repairs onto damaged structures and consumes read attempts	Severe
Opening a drive outside a controlled environment	Hard drives	Airborne particulate lands on the platters and is struck by the heads	Severe
Starting a RAID rebuild on a degraded array	RAID / NAS	Writes across all members and can propagate stale parity	Severe
Swapping the circuit board from a donor	Hard drives, SSDs	Adaptive parameters do not match; the drive may write to its own service area	Severe
Formatting or initialising when prompted	All	Replaces the metadata that identifies where the data is	Severe
Installing recovery software onto the affected drive	All	The installation itself overwrites free space holding deleted data	High
Leaving a TRIM-enabled SSD powered after deletion	SSDs	Garbage collection erases the released blocks	High
Drying wet media with heat or rice	All	Evaporation leaves mineral deposits and accelerates corrosion	High
Repeated power cycling	All	Each cycle stresses already marginal mechanics and electronics	High
Freezing a drive	Hard drives	Condensation contaminates platters and electronics	High
Restoring a backup over the affected volume	All	Overwrites the data that was to be recovered	Severe

Actions that preserve recoverability

Actions that preserve recoverability
Action	Applies to	Why it helps
Power down at the first abnormal noise or behaviour	All	Stops progressive damage at its current level
Note exactly what happened and when	All	Fault history directs the evaluation and avoids wasted read attempts
Label RAID member order before removing drives	RAID / NAS	Member order is required for reconstruction
Keep wet media sealed and damp	All	Prevents corrosion and mineral deposits before laboratory cleaning
Work only from a forensic image	All	The original media is read once and preserved
Use a write blocker when evidence may be involved	All	Maintains evidentiary integrity and chain of custody
Package with anti-static and shock protection	All	Transit damage is a genuine and avoidable failure cause
Send the whole device, not just the drive, when it is a laptop or NAS	Laptops, NAS	Configuration and encryption context often lives outside the drive

Notes

If the device is making an unusual noise, nothing done through the operating system will help. Power it down.
If the data may be used as evidence, stop before any acquisition and follow chain-of-custody procedure.
Every recovery begins with an evaluation of the specific device; the guidance above governs the state that device arrives in.