What to do (and what NOT to do) in the first 24 hours after losing your data

What should you do if you have just lost important data? The first thing is to stop using the device immediately. Most failed recoveries are not caused by the original damage, but by the attempts at fixing it that come afterwards, made without knowing that each additional action can overwrite the information.

Why the first hours matter most

Most storage failures are recoverable if the device is not used again. The problem is that the most natural reactions, such as restarting several times, running a repair tool or reinstalling the operating system, are exactly the ones that reduce the chances of success. Every additional write to the drive is another opportunity to overwrite precisely what you are trying to get back.

What TO do

• Switch the device off and leave it off if you suspect physical damage: noises, it will not start, or a smell of burning.
• Write down exactly what happened: when you noticed the problem, what you were doing beforehand, and whether there was any sound or error message.
• If the device is still on and accessible, do not save or install anything new on it.
• Contact a specialist before attempting any repair yourself.
• If this is a business case, isolate the machine from the network if you suspect an attack such as ransomware or malware.

What NOT to do

• Do not run disk repair tools such as chkdsk or fsck without knowing exactly what they do: they can rewrite damaged structures and make the loss irreversible.
• Do not restart a drive that is making unusual noises several times over: each additional power-up can increase the physical damage.
• Do not install free recovery software “just to try” on the same drive you want to recover: installing it there can overwrite exactly what you are looking for.
• Do not format the device “to see if that fixes the problem”.
• Do not wait for days to see whether it resolves itself: the more time passes, the more likely the data is overwritten through ordinary use.

Logical versus physical cases: why the answer differs

Not all data loss is the same. An accidental deletion or a format with no physical damage is a logical case, and those can often be resolved even remotely. A drive that makes noises, will not power up or is not detected by the system is showing signs of physical damage, and that requires laboratory work, never home software.

When it is time to call a professional

If the device is making unusual noises, is not detected, the data is critical, or you have already tried something and the problem got worse, that is the moment to stop and get specialist help, before the next action becomes the one that cannot be undone.