The first hour after data loss
decides the rest.

Data loss does not feel like an emergency in the way a fire does. Nothing is burning, the office is quiet, and the natural response is to start trying things. That hour of trying things is, more often than not, the difference between a full recovery and a partial one.

The reason is simple and worth internalising: deleted data is not erased data. When a file is deleted, a partition is lost or a volume is formatted, the contents usually stay exactly where they were. What changes is the bookkeeping that points at them. The data stays recoverable right up until something else is written over the top of it. Every minute the machine stays running, and every tool run against the affected disk, is a chance for that write to happen.

Stop the machine

The single highest-value action, and the one people skip, is to stop using the affected device immediately. Not shut it down gracefully if the loss is on the system disk. Pull the power.

A running operating system writes constantly, without being asked: temp files, logs, swap, search indexes, update caches, thumbnails, crash reports. None of it is your data, and any of it can land on the blocks your data is still sitting in. On a system disk this happens continuously, which is why "I left it on overnight while I thought about it" is a sentence that costs real files.

Listen before you decide anything else

The sound a drive makes tells you which category of problem you are in, and the two categories need opposite responses.

• Clicking, beeping, grinding, or no spin-up at all. This is a physical fault. The heads or the motor are involved. Do not power it on again, at all, for any reason. Every retry drags damaged heads across the platter surface and grinds away the magnetic layer holding your files. This is the fastest way to turn a routine clean room job into a partial recovery.
• Drive sounds normal, but files are missing, the volume asks to be formatted, or reads hang. This is a logical fault. Time pressure is lower, but the overwrite risk is the same, so the machine still comes off.

Things that feel productive and are not

These come up on almost every intake call, and all of them make the case harder:

• Running chkdsk, fsck, or a vendor repair utility. These are consistency tools. Their job is to make the file system self-consistent, and they will happily discard the inconsistent parts to get there. The inconsistent parts are your data.
• Reformatting and trying again. A format writes a new file system over the old one. It does not "reset" anything in a way that helps.
• Installing recovery software onto the affected disk. The installer writes to the very disk you are trying to preserve. If you use software recovery at all, it runs from another machine, with the affected disk attached read-only.
• The freezer trick. Condensation inside a sealed drive contaminates the platters. It has been folklore for twenty years and it has never been good advice.
• Swapping the enclosure, cable, or PSU repeatedly. Fine as one quick check if the drive is silent and undetected. Not fine as an hour of power cycling.
• Letting a controller rebuild a degraded array. Covered at length in the rebuild article, but briefly: a rebuild writes to the array, and if it uses a stale member it overwrites live data.

What to do instead, in order

1. Power down the affected device. At the wall if the loss is on the system disk.
2. Write down what happened. What you were doing, what the first symptom was, what has been tried since, and by whom. This directly shapes the diagnosis and is easy to lose once several people have been involved.
3. Photograph the hardware before disassembling anything. For an array, photograph the disk tray in place so the member order is preserved.
4. Find out whether a backup exists and whether it has actually restored successfully at any point. A backup job that has been failing silently is extremely common and worth knowing about before you plan around it.
5. Call a lab before shipping anything. Some faults get worse in transit, and packing advice is fault-specific.

Why "just try the free tool first" is a false economy

Free recovery tools genuinely work on the easiest category of case: a simple deletion, on healthy media, noticed immediately. The problem is that nothing about that tool tells you which category you are in, and running it on a failing drive keeps the drive powered and reading for hours, which is precisely the load a dying drive cannot take.

The asymmetry is what matters. If the case was easy, a diagnosis costs you nothing and confirms it. If the case was not easy, the DIY attempt can cost you the data permanently. A free diagnosis resolves that question before anything is risked, which is the entire argument for making the call first.