Data Recovery

Data recovery exploits a fundamental property of how storage devices manage data: deleted or lost data isn’t immediately erased; it’s simply marked as available space. When you delete a file, Windows or macOS removes the file’s entry from the file system’s catalog (NTFS’s MFT, APFS’s Object Map, ext4’s inode table) and marks the file’s data clusters as free for reuse. The actual bytes on the platter or in the flash cells remain unchanged until something else writes new data to those clusters. Recovery succeeds while that overwrite hasn’t happened yet.¹

The same property holds at higher levels of the storage stack. Formatted partitions still contain their old file data; the format operation typically just rewrites the file system’s metadata structures, not the file content. Corrupted partition tables hide partitions that still exist on disk; tools like TestDisk find them by scanning for file system signatures. Even drives that report as RAW or unallocated usually still hold their data; the OS just can’t read the metadata that describes where files start and end. Recovery is mostly metadata reconstruction; the file content was already there waiting.

The standard recovery process

Across all recovery scenarios from simple deletion to catastrophic damage, the same five steps appear in roughly the same order:²

1. Evaluation. Determine the failure type, the severity of damage, and what data is needed. This step decides whether software or lab is the right path. For users, listening to the drive (any clicking, grinding, or repeated power cycling?) and checking SMART data tells most of the story.
2. Stabilization. Stop using the drive immediately. Don’t run CHKDSK, don’t reformat, don’t reboot more than necessary. On suspected mechanical failures, power off and don’t power on again until imaging is ready.
3. Imaging. Create a complete sector-by-sector copy of the source drive to a separate destination drive. Tools like ddrescue and HDD Raw Copy Tool handle bad-sector-tolerant imaging. The source becomes read-only; all subsequent work happens against the image.
4. Recovery. Process the image with file system parsing tools (TestDisk, R-Studio, Disk Drill) or with file carving tools (PhotoRec) when file system metadata is too damaged for parsing. Extract the recoverable files to a separate destination.
5. Verification. Open recovered files to confirm they aren’t corrupted. Compare against checksums or known-good copies if available. File carvers especially can recover incomplete or corrupted data; verification catches that before declaring the recovery successful.

Why recovery succeeds in most cases

The most common data loss scenarios (accidental deletion, format, partition table corruption) all follow the same pattern: file data clusters remain intact on disk, while metadata identifying their location is missing or wrong. Recovery tools rebuild the metadata by inferring it from clues:

• File system signatures. The first sectors of NTFS, FAT32, ext4, APFS partitions contain known-format boot sectors or superblocks. TestDisk scans the entire disk for these signatures to locate partitions even when the partition table is wiped.
• File headers and footers. Most file formats start with predictable byte sequences (JPEG starts with FF D8 FF, PDF starts with %PDF, ZIP starts with PK). PhotoRec scans for these signatures to extract files even when no file system structure remains.
• Catalog references. NTFS’s MFT keeps records for deleted files for some time after deletion; the records aren’t immediately wiped. Recovery tools read the deleted MFT records to find the original file names, sizes, and cluster locations.
• Backup metadata copies. NTFS keeps $MFTMirr; FAT32 keeps a second FAT copy; exFAT keeps a Backup Boot Region; ext4 keeps superblock backups; GPT keeps a backup partition table at the end of the disk. Recovery tools fall back to backups when primary metadata is damaged.

The failure category determines almost everything about the recovery: cost, time, success probability, and whether DIY is even possible. The categories aren’t always perfectly clear (logical issues can be caused by physical degradation), but the practical decision boundaries are sharp.³

Logical failures: software handles it

The drive is physically healthy; the data is inaccessible because of a software-level issue. Common scenarios:

• Accidental deletion. Files moved to recycle bin and emptied, or shift-deleted directly. Most common scenario.
• Accidental formatting. Quick format wipes file system metadata but leaves file content intact. Full format is more aggressive but still recoverable in many cases.
• Corrupted file system. File system metadata becomes inconsistent because of an interrupted write, software crash, or disk error. Drive shows up as RAW in Windows or fails to mount on macOS.
• Lost or damaged partition. Partition table corruption hides the partitions; the data is still there but the OS can’t see it.
• Virus or ransomware damage. Some ransomware encrypts files (recovery requires decryption keys, not data recovery); other malware corrupts metadata (data recovery applies normally).
• Operating system reinstall over user data. Common scenario when reinstalling Windows without preserving the data partition.
• RAW external drive. External HDDs or SSDs that show as RAW after improper disconnect, often a corrupted partition table fixable with TestDisk.

Recovery approach for logical failures: software-only, $0-$100, takes minutes to hours. Tools like EaseUS Data Recovery, Disk Drill, R-Studio, Wondershare Recoverit, and Recuva handle these scenarios. Success rates are high (typically 80-95% of recoverable data when you act before the drive is reused). The image-first rule still applies: image with ddrescue first, run recovery on the image.

Physical failures: hardware tools required

The drive itself is damaged. Symptoms include clicking sounds, grinding noises, the drive not being detected, or the drive randomly disconnecting. Common scenarios:

• Head crash on HDD. The read/write heads physically contacted the platter and damaged it. Continued operation makes the damage worse on every spin-up.
• Controller failure. The PCB on the bottom of the HDD or SSD has burned out, often because of a power surge or component failure. Drive is dead; recovery requires controller-level work.
• Motor failure (HDD). The spindle motor that spins the platters has died. Drive is silent on power-up. Often requires platter swap into a working donor drive’s chassis.
• Stiction. The heads have stuck to the platters (often after long unpowered storage); spinning up risks tearing the magnetic surface. Cleanroom intervention only.
• Severe bad sector accumulation. See Bad Sectors; drives where the spare pool is exhausted and the OS can’t reliably read normal data.
• Flash cell exhaustion (SSD). The drive’s wear has consumed the spare pool; the drive locks up or goes read-only. Requires controller-native tools or chip-off recovery.
• Firmware corruption. The drive’s internal firmware has bugs or corruption preventing normal operation. May respond to firmware-level commands but not standard ATA reads.

Recovery approach for physical failures: lab-grade tools, $300-$3,000, takes days to weeks. Specialists use the PC-3000 imager (industry-standard hardware imager that bypasses standard drive firmware), DeepSpar Disk Imager (similar capability with different feature mix), and donor drives for parts. The cleanroom requirement varies: head swaps and platter work need a class 100 cleanroom; PCB swaps and firmware work don’t. Success rates depend heavily on the specific failure mode; head crashes with platter scoring lose more data than clean head failures with intact platters.

Catastrophic failures: specialized cleanroom work

Severe damage to the drive itself or its environment. Often a candidate for lab work even when DIY would be tempting:

• Fire damage. Soot, heat warping, melted components. Some platters survive surprisingly well; the lab strips the drive down, cleans the platters, and transfers them to a donor chassis.
• Water damage. Submerged drives, floods, sprinkler systems. Critical: do not power on a wet drive. The lab opens the drive, cleans corrosion, dries thoroughly, and recovers from the cleaned platters or cells.
• Lightning or surge damage. The drive’s PCB is destroyed; the platters or flash cells are usually intact. Recovery is a controller swap to a matching donor drive.
• Mechanical impact. Drive dropped while running, severe shock to a powered drive. Can range from a single head crash (recoverable) to platter shattering (unrecoverable).
• Long-term storage decay. Drives left unpowered for many years can develop magnetic decay, stiction, and dried lubricants. Sometimes recoverable, often expensive.
• RAID array catastrophic failure. Multiple disks in a RAID array fail simultaneously, exceeding the array’s redundancy. Recovery requires imaging each surviving disk and reconstructing the array structure.

Recovery approach for catastrophic failures: specialized lab work, $1,000-$5,000+, takes weeks. Often requires multiple donor drives, extensive cleanroom time, and forensic-grade imaging. Success depends on the specific damage; a fire-damaged drive with intact platters can recover almost completely, while a drive with shattered platters is generally unrecoverable.

The DIY-or-professional decision is the single most consequential choice in any recovery scenario. The wrong choice can permanently destroy data the right one would have recovered cleanly. The deciding factor is failure type, not budget: software is wrong for physical failures regardless of budget, and labs are overkill for simple deletion regardless of how much you can afford.⁴

Cost ranges in 2026

Scenario	Recovery path	Cost range	Time
Accidental deletion	DIY software	$0-$100	Minutes to hours
Formatted partition	DIY software	$0-$100	Hours
Corrupted file system / RAW drive	DIY software (TestDisk + recovery)	$0-$100	Hours
Logical failure on healthy drive	Professional logical	$300-$1,500	3-7 days
Head crash / mechanical failure (HDD)	Professional physical	$500-$3,000	1-3 weeks
Controller failure (PCB swap)	Professional physical	$300-$1,500	1-2 weeks
SSD controller failure	Professional physical (chip-off)	$700-$3,500	2-4 weeks
RAID array reconstruction	Professional enterprise	$1,000-$5,000+	2-4 weeks
Fire / water / severe damage	Professional cleanroom	$1,500-$5,000+	3-6 weeks
Rush service (24-72 hrs)	Any of the above	+50-100% premium	1-3 days

DIY pros and cons

Professional service pros and cons

The no-data-no-charge guarantee

Reputable data recovery labs offer a “no data, no charge” or “no recovery, no fee” guarantee. The lab evaluates the drive at no cost, provides a quote, and only charges if they successfully recover the data you need. If recovery fails, you owe nothing beyond shipping costs. This guarantee shifts risk from customer to lab, which incentivizes labs to take only cases they can actually solve. Some labs add a $50-$100 diagnostic fee that’s credited toward the final cost if recovery proceeds; this covers the lab’s cost of careful evaluation regardless of outcome.⁵

Avoid services that require significant upfront payment regardless of outcome. That structure indicates either inexperience or low success rates; legitimate labs don’t need to charge for failed recoveries.

The right tool for a given scenario depends on the failure type, the file system, and what the user is trying to recover. Three tiers of tools exist, each with distinct capabilities and limitations.⁶

Tier 1: Consumer software ($0-$100)

Free and inexpensive tools for logical failures on healthy drives:

• EaseUS Data Recovery Wizard (Windows / Mac, free + paid). The most widely-used consumer recovery tool. Strong NTFS recovery, intuitive interface, broad file format support; free version recovers up to 2 GB.
• Disk Drill (Windows / Mac, free + paid). Polished interface, supports nearly all file systems, free version recovers up to 500 MB. Suitable for general consumer use.
• Wondershare Recoverit (Windows / Mac, free + paid). Wide format support, video preview features; free version recovers up to 100 MB.
• Recuva (Windows, free + paid). Long-standing free option from the makers of CCleaner. Simple wizard interface; effective for recent deletions on NTFS and FAT32.
• PhotoRec (Linux / Windows / Mac, free, GPL). The free file-carving gold standard; recovers files by header signature regardless of file system damage. Awkward text interface but unmatched for damaged file systems.
• TestDisk (Linux / Windows / Mac, free, GPL). Companion to PhotoRec; rebuilds partition tables, undeletes files, fixes boot sectors. Text interface but the standard tool for partition recovery.

Tier 2: Specialized lab software ($200-$1,000+)

Professional tools that combine logical recovery with hardware-aware features:

• R-Studio ($80-$1,000). The most powerful consumer-accessible tool; handles RAID, complex multi-disk scenarios, network recovery. Used by many small recovery labs as a primary tool.
• UFS Explorer ($85-$2,500). Strong RAID and enterprise file system support including ZFS, ReFS, and various NAS-specific formats.
• DMDE ($50-$300). Professional-grade with strong file system parsing; popular as a more affordable alternative to R-Studio for advanced users.
• X-Ways Forensics ($1,500+). Forensic-tier tool with deep file system analysis; widely used in legal data recovery and digital forensics contexts.

Tier 3: Hardware imagers and lab tools ($3,500-$30,000+)

Tools that operate below the standard ATA/SCSI command set, talking directly to drive firmware:

• PC-3000 (ACE Laboratory, ~$3,000-$30,000). The industry-standard hardware imager; firmware-level access for HDDs, SSDs, RAID, with model-specific recovery procedures. Used by virtually every professional lab.
• DeepSpar Disk Imager (DDI Utility, $3,500-$8,000). Hardware imager focused on bad-sector-tolerant imaging; complementary to PC-3000 in many labs.
• Atola Insight (~$8,000-$25,000). Newer hardware imager with strong forensic features; growing share in professional labs.
• RusoLut (~$2,500-$10,000). Specialized SSD chip-off recovery tool; reads raw NAND flash and reconstructs the FTL.

Choosing the right tool for your scenario

The tool selection should follow the failure category, not the user’s preference:

• Recently deleted files on a healthy drive: EaseUS or Disk Drill, free tier, 30 minutes.
• Formatted partition or RAW drive: TestDisk for partition repair, then Disk Drill or R-Studio for file recovery.
• Corrupted partition table: TestDisk; rebuilds partition tables from file system signatures.
• Damaged file system on healthy drive: R-Studio or PhotoRec depending on whether you need file names or just file content.
• Drive with bad sectors: ddrescue (image first), then any recovery tool against the image.
• Drive that doesn’t show up in Disk Management: Stop. Professional lab.
• Drive making clicking or grinding noises: Stop immediately. Professional lab.
• Multi-disk RAID failure: R-Studio or UFS Explorer for simple cases; lab for complex or critical data.
• Mobile device data recovery: Specialized mobile-focused tools (Cellebrite, MobileTrans); usually requires lab.

Some failure modes have no DIY path. Recognizing them quickly saves both money and data; recognizing them late often costs both. The following symptoms, in any combination, mean stop using the drive immediately and contact a lab.⁷

Yellow flags: probably professional

Symptoms that suggest professional work but might still be DIY-recoverable in some cases:

• SMART rapidly deteriorating. Reallocated sector count climbing rapidly, current pending sector count rising. Image first with ddrescue, then assess.
• Drive randomly disconnecting. Often a controller or cable issue, but can also be early signs of mechanical failure.
• Drive showing wrong size or unrecognized in Disk Management. Sometimes a fixable partition issue, sometimes a controller problem.
• Drive freezing during normal operation. Can be bad sectors causing kernel I/O stalls, or early controller issues.
• Files randomly corrupting. File system damage that may be recoverable but indicates ongoing trouble.
• Drive running unusually hot. Mechanical drives that overheat usually fail soon.

Decision framework

The professional-vs-DIY question reduces to five factors:

1. Nature of the problem. Logical → DIY first. Physical → professional only.
2. Value of the data. Irreplaceable → professional. Replaceable → DIY acceptable.
3. Budget. Under $100 budget → DIY only. $300+ available → professional accessible.
4. Time pressure. Need data within hours → DIY first (or rush professional). Days available → professional fine.
5. Technical comfort. Confident with command-line tools and image-first workflow → DIY viable. Uncomfortable with technical tools → professional safer.

Choosing a recovery lab

Reputable labs share several characteristics:

• Free initial evaluation. No-cost diagnosis is industry standard.
• No-data-no-charge guarantee. Pay only on successful recovery.
• Cleanroom certification (ISO Class 5 or better). For physical work.
• Transparent pricing. Written quotes with line items, not vague ranges.
• Verifiable success rate, ideally with public case studies or testimonials.
• SOC 2 or comparable security certification for enterprise data.
• Years in business. Recovery requires experience; long-running labs have seen the failure modes.

Established players include DriveSavers, Ontrack, Secure Data Recovery, and many regional labs of varying quality. Get quotes from at least 2-3 labs for any expensive case; pricing varies significantly even for similar work, and the range often signals different approaches to the same problem.