Recovering Data from a Failed Drive

I got a call from a client who disconnected a large USB-connected external drive, and when he reconnected it, was unable to find the terabytes of images that were stored on it.  He knew about properly disconnecting an external drive, but thought the computer was asleep, and that it would be ok.  It was not.

First let’s talk about preventing this from happening in the first place. External drives can be formatted in different ways.  It is better to format external drives and flash drives using the FAT32 drive format. FAT32 allows USB drives to be hot plugged and unplugged, although I recommend AGAINST any hot unplugging.  It is better to use the Safely eject drive method.

Typically, drives in a Windows environment use NTFS formatting.  Hot plugging is defintely NOT supported on NTFS drives.  This is probably what lead to my clients problem in the first place.  NTFS formatted drives form logical connections with the operating system, and when an NTFS formatted external drive is simply unplugged, it can corrupt the file allocation table and file indexes on the drive, making the data “invisible.”  The data is still there, but the operating system can no longer see it.

Sometimes when you plug in a USB drive that is unreadable or corrupted, the operating system will pop-up a message asking if you want to Scan and Fix the drive.  You should let this troubleshooter run, and it may just solve your problem.

If this message is not spawned but you still can’t read your drive, then try running CHKDSK from a command prompt.

1.  Determine which drive letter is used by your USB drive in File Explorer.  It will NOT be the C: drive.

2. Go to the start menu, type in “cmd” in a search bar, right click “cmd. exe”.  Choose “Run as administrator.”

3. Type in “chkdsk /X /f drive letter:” or “chkdsk drive letter: /f “, for example, “chkdsk /X /f G:” or “chkdsk G: /f“.  Be sure to use the colons where indicated.

If these methods don’t work yo may need to try a software drive restoration product, such as Recuva.

The last option, and this can be expensive, is to send your drive out to a drive recovery company.  I like and work with Data Recovery.  This company will analyze your drive and determine if the data can be recovered, and this part is done free-of-charge.  They will give you a quote for the cost of recovery.  You can expect this to be over $1000.  But I have always had good results with them, except for one time when a wayward drive read/write head scratched the disk media so badly that nothing was recoverable.  But again, no charge to find out.

But prevention is worth 10 times the cure, so format your external USB HDDs, SSDs, and thumb drives using the FAT32 format, and never unplug a drive without safely ejecting it first, or only when the computer has been Shut Down fully (NOT in Sleep Mode or Hibernation).

And did we mention:  back up your data!  This includes contents of flash and external drives too.  Flash drives and solid state drives fail without warning, and fail totally.  Ideally, you should have 3 copies of your important files, pictures, and other personal data, the original media, a local backup that can be restored quickly, and a backup in the cloud in case of catastrophic loss such as in a fire, burglary, or tornado.  Anyone using Microsoft’s Office365 has gigabytes worth of online storage in OneDrive, and Google Drive is another fine alternative.  Automatic backup services such as Carbonite can take care of this for about $90 a year.  Or burn your files to several DVDs.  That worked for one of my clients whose hard drive failed, without a formal backup solution.  He had many DVDs full of pictures he wanted back, and they allowed us to restore at least some of his data.

Be safe with your data.  Data storage these days seems indestructible, but it is all susceptible to damage, and your important files along with it.

More information:

0

About the Author:

I am a cybersecurity and IT instructor, cybersecurity analyst, pen-tester, trainer, and speaker. I am an owner of the WyzCo Group Inc. In addition to consulting on security products and services, I also conduct security audits, compliance audits, vulnerability assessments and penetration tests. I also teach Cybersecurity Awareness Training classes. I work as an information technology and cybersecurity instructor for several training and certification organizations. I have worked in corporate, military, government, and workforce development training environments I am a frequent speaker at professional conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference in 2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. I have been blogging on cybersecurity since 2006 at http://wyzguyscybersecurity.com

Add a Comment


This site uses Akismet to reduce spam. Learn how your comment data is processed.