What makes a data center different
- The data belongs to your customers: whoever handles it must sign a confidentiality agreement and document every step.
- Drives often cannot leave the building, because of security policy or the contract with the end customer.
- A single storage failure takes down many customers' services at once.
- Every hour of downtime counts against your availability agreements (SLAs) with your customers.
- Volumes run to tens or hundreds of terabytes, spread across SAN arrays, virtualization and distributed storage.
The failures that take a data center down
According to the Uptime Institute Annual Outage Analysis (2026), power problems cause 45% of impactful outages, and fires have been increasing because of lithium-ion batteries in UPS systems.
Power and UPS
An outage or a UPS failure shuts servers down abruptly: RAID arrays that will not mount again, damaged volumes and inconsistent databases.
Fire and lithium batteries
A cell that overheats can set the whole UPS battery bank on fire. Soot conducts electricity: exposed drives must not be powered on.
Smoke from a nearby fire
A fire in a neighbouring building or in vegetation can draw smoke in through the air intakes: it triggers detection, forces equipment to be shut down and leaves soot on it.
Fire suppression discharge
The blast of gas when the system fires can knock hard drive heads off track, during a test, a false alarm or because of outside smoke, even with no fire in the room.
Water
Flooding from rain or storms, leaks and cooling system failures. Wet equipment must not be powered on.
Extreme heat
If cooling fails, the room overheats and drives start failing one after another.
Ransomware
Before encrypting, attackers usually spend days, sometimes weeks, inside the network: they gain privileges, copy the data to take it away, work out where to cause the most damage, delete or encrypt the backups and snapshots first, and then encrypt servers and storage at the same time.
Sabotage or unauthorized access
A former employee or an intruder deletes virtual machines, volumes or backups. As well as recovering the data, we examine the system logs to reconstruct what happened, from where and when.
Human error
Folders, virtual machines or volumes deleted by accident, a command run on the wrong server, or an array initialized by mistake.
What we solve for a data center
On-site work, hot if needed
When the equipment cannot leave, we work inside the data center, even with systems in production, and in continuous shifts when the urgency demands it.
Independent of the platform
We work at a low level, directly on the data, regardless of the platform or the storage vendor. We rebuild the file system of each one: VMFS, NTFS, ReFS, ext4, XFS, ZFS and others.
Ransomware: we look for the attack's weakness
We work on forensic copies of the affected volumes, including the main host and the hypervisor, and look for the weakness in the attack that opens the way to recovering the data.
Confidentiality and a record of every drive
We sign the data center's non-disclosure agreement or its customer's, and record who receives, handles and returns every drive, and when.
Equipment decontamination
As part of the recovery, we decontaminate drives and electronics exposed to soot, smoke or water before attempting to read them, to stop corrosion and avoid further damage.
Physical damage in a clean room
If a drive in the array is physically damaged, it is opened only in the clean room (laminar flow chamber with positive pressure) at our laboratory and then brought into the rebuild.
Technical report
We document the failure, the procedure and the result, for your end customer and for your audit.
Services most requested by this profile
Frequently asked questions
Do you recover data from Unix servers such as Sun Solaris, IBM AIX or HP-UX?
Yes. We recover information from drives and arrays in Sun and Oracle servers running Solaris (UFS and ZFS), IBM servers running AIX (JFS and JFS2) and HP servers running HP-UX (VxFS and HFS), including drives with non-standard 520 or 528-byte sectors. We first recover access to the data on each drive and extract a binary copy; from it we get the files. When a case requires bringing the whole system back up, for example to open a database exactly as it was, we study the case: depending on the platform, we do it on the server itself, on compatible hardware provided by the customer or on an emulator.
Can you work inside our data center?
Yes. When security policy or the contract with your customer prevents the equipment from leaving, we work on site, even hot with systems in production. We agree the work windows with your team.
Which platforms and file systems do you handle?
VMware ESXi (VMFS), Hyper-V and Proxmox virtualization; SAN and NAS arrays, ZFS, Ceph and vSAN; NTFS, ReFS, ext4 and XFS file systems, among others; and SAS, SATA and SCSI drives and U.2, U.3, PCIe (AIC) and EDSFF NVMe SSDs. On every platform our work is done at a low level, in hexadecimal, directly on the data, and we rebuild the file system of each one.
Do you recover encrypted volumes or files that have been damaged?
Yes. When an encrypted volume or file (BitLocker, VeraCrypt, LUKS or virtual machine encryption) becomes corrupted, we repair the damage so that it opens again with its key. We do this in the laboratory and, when the case allows, also on site, inside the data center. For this we need the customer password or recovery key: without it, the encryption cannot be opened.
Do you sign confidentiality agreements and keep a record of every drive?
Yes. We sign the appropriate non-disclosure agreement and record who receives, handles and returns every drive, and when.
Can the data be decrypted without paying the ransom?
Sometimes, yes. Some ransomware variants have weaknesses that make it possible to recover the data without paying. To find out, we investigate the attack on forensic copies of the affected volumes. If no weakness turns up, we look for copies or data the attack did not reach. Every attack is different, and the investigation shows the path to a solution in each case.
Why did the ransomware also hit our backups?
Because attackers go after them first: they spend days, sometimes weeks, inside the network locating backups and snapshots, and copying the data to take it away before running the encryption, so they can later threaten to publish it. Then they delete or encrypt the backups and launch the main attack, so there is no way to restore without paying. Even so, copies, earlier versions or data the attack did not reach often remain: that is what we look for. If you suspect data was taken, we can confirm it with a forensic analysis.
What should we do while you are on your way?
Do not power on equipment exposed to soot or water. Do not rebuild or initialize the array, and do not restore backups onto the original drives. If it is ransomware, isolate the affected systems from the network. If you suspect sabotage, do not delete or rotate the system logs: they are the evidence of what happened.
What happens if my storage devices were exposed to fire?
It depends on the temperature they reached. Hard drive platters have a very thin lubricant layer over which the head flies, and that layer withstands less heat than the magnetic layer where the data is stored, which is only lost to heat at much higher temperatures (the Curie temperature). If the drive did not exceed what the lubricant layer tolerates, there is a real chance of recovering the data. If it did, the data may still be on the platters, but recovery becomes much harder. That is why it is essential not to power on the drive and to bring it to the laboratory as soon as possible.
What if it is an SSD or flash memory?
An SSD has no platters and no lubricant layer: it stores data as electrical charges in memory chips. Heat speeds up the loss of those charges, and if the temperature was high enough to melt the solder, components can come loose or be damaged. Even so, if the memory chips survived, in some cases the data can still be recovered. Every case is assessed in the laboratory: do not power it on, and send it to us as soon as possible.
How long does it take and what does it cost?
The technical evaluation comes first and has a cost: it takes 5 business days on the standard service or 48 hours on the emergency service, including weekends and public holidays. With its result we deliver a report with a quote based on the technical hours and specialist staff the case requires.
Has your storage gone down, or has an attack encrypted your servers?
Tell us what happened and we will explain how we would approach your case.
We answer in English by email and WhatsApp. Phone calls are answered in Spanish.