Data Recovery in Pretoria: What Can and Can't Be Recovered

The drive has failed. Maybe it is clicking, maybe the laptop says "no bootable device", maybe the folder with five years of invoices is suddenly empty. Before you do anything else, read this. In data recovery the first few decisions matter more than anything a specialist does afterwards, and much of what you read online is sales copy. This is the honest version for Pretoria business owners and home users.

The Three Ways a Drive Fails

Almost every case falls into one of three classes, and the class decides what is possible, how long it takes and what it is likely to cost.

Logical Failure

The hardware is fine; the data is not. Deleted files, a formatted drive, a corrupted partition table, a file system Windows suddenly cannot read. This is the most common class and usually the most recoverable, as long as nothing has been written over the space the lost data occupied.

• Usually recoverable — deleted files, quick-formatted drives, corrupted partitions, most file system damage
• Usually not — data overwritten by new files, and SSD deletions where TRIM has already cleared the blocks

Mechanical Failure

The drive is physically broken: a clicking or ticking sound, a drive that spins up and powers down again, or one that does not spin at all. The heads may have failed, the motor may have seized, or the heads may have touched the platters (a head crash), scoring the surface where the data lives.

• Usually recoverable — failed heads, seized motors and stuck heads where the platters are undamaged. Skilled workshop work, never a quick job
• Usually not — platters that are scored, shattered or heavily scratched; once the magnetic surface is gone, so is the data

Electronic Failure

The drive is not recognised at all, or shows the wrong capacity, and makes no noise. In South Africa the usual cause is a power surge when the electricity returns after load-shedding. The circuit board (PCB) or a component on it has failed.

• Usually recoverable — board failures where the platters and heads were untouched. Not a simple board swap, since modern drives keep drive-specific data on the board, but a well-understood problem
• Usually not — cases where the surge also damaged the heads or pre-amplifier inside the drive, which turns an electronic case into a mechanical one

What Is Usually Not Recoverable, Whatever You Are Told

• Overwritten data — recovery finds what is still there; it does not reverse time
• TRIM'd SSD deletions — SSDs erase deleted blocks in the background. Once TRIM has run, the data is physically gone
• Encrypted drives without the key — BitLocker, FileVault, VeraCrypt or a self-encrypting drive: without the password or recovery key, the recovered data is random noise. Find the key first
• Physically destroyed platters — shattered, burnt or scored across the whole surface
• Ransomware-encrypted files without backups — data recovery reads what is on the disk. If what is on the disk was encrypted by criminals, reading it does not help. Backups do

Anyone who promises a result in these cases before looking at the drive is guessing.

The First Ten Minutes

What you do right now matters more than anything else. Do these:

1. Stop using the drive. Every write is a risk to the data you want back
2. Power it down cleanly if you can, and leave it off
3. Note the sounds, the error messages and whether the power had just come back
4. If it is the boot drive, leave the machine off rather than restarting it again and again
5. Phone someone who does this for a living before trying fixes

And do not do these:

• Do not keep powering a clicking drive — each spin-up with failed heads can scrape the platters further
• Do not run CHKDSK or any "repair" on a failing disk — CHKDSK writes to the disk, and on a drive with bad sectors it can "fix" the file system into a state that no longer points at your files
• Do not install recovery software onto the same drive — installing anything writes to the disk and can overwrite the files you want back
• Do not open the drive — not even to look. Dust and fingerprints on a platter are permanent
• Do not freeze it — the freezer trick is an internet legend from a different era of drives. Condensation on the platters does real damage

For a drive that failed in the last hour, the checklist at what to do when a hard drive fails covers exactly this.

How an Assessment Works

Here is what happens when a drive comes to Code Masters. The sequence is designed so that nothing is done to your drive that cannot be undone.

1. Intake — we record the drive, the symptoms and what has already been tried. Be honest about the attempts; it changes the approach
2. Imaging first — before anything else, we try to make a sector-by-sector copy of the drive onto healthy storage, skipping bad areas and returning to them later, so the original spends as little time powered up as possible
3. Working from the image — all recovery work happens on the copy. The original is not touched again unless the image is incomplete and it is worth the risk to try further
4. File list before quote — you get a list of what has been found, so you can see whether the folders you care about are there before you commit to anything
5. Quote and approval — recovery work is quoted after assessment, and nothing is done without your approval of the quote

If the drive is mechanically failed, the assessment tells you that early, so you decide with facts rather than hope.

RAID and NAS: A Word to Small Businesses

A RAID array or a NAS is not a backup. It is a way of surviving one drive failing. When two fail, or the controller fails, or someone starts a rebuild with the wrong drive, the whole array is at risk.

• Do not rebuild — a rebuild with a wrong or failing drive can overwrite parity across every disk, and the job becomes far harder
• Label the drive order — bay 1, bay 2 and so on, written on the drives before anything is removed. RAID recovery depends on knowing the original order and configuration
• Do not initialise — if the NAS offers to "initialise" or "create a new volume", say no; that writes over the old structures
• Note the model, RAID level and controller messages

Code Masters recovers from RAID arrays and NAS units as well as single drives. There is a fuller guide in our RAID recovery guide for South Africa.

SSDs and Phones: The Honest Picture

SSDs fail differently. There is no clicking; they just stop being recognised, drop into a read-only state, or report a capacity of zero. Recovery from a failed SSD controller depends heavily on the make and model. Deleted files are another matter: TRIM tells the drive it may erase them, and it often does within minutes. Stop using an SSD the moment you notice a deletion, but the window may already have closed.

Phones are harder still. Modern iPhones and Android phones encrypt their storage by default, tied to the device and your passcode. A phone that will not switch on is generally not a data recovery job; the practical route is the cloud backup that was (or was not) running. If your photos matter, check today whether your phone is actually backing up.

How Long It Takes

Logical recoveries on a healthy drive can be quick, sometimes a day or two including the imaging. Imaging a drive with many bad sectors is slow by design, and a multi-terabyte drive in poor condition can take days just to copy. Mechanical work adds time for parts and the workshop process; RAID depends on how many drives are involved and their condition. Ask for an estimate after intake; it firms up as the imaging progresses.

What Drives the Cost

There is no honest single number: every job is quoted after assessment and depends on the failure type. What moves the quote up or down:

• Failure type — logical work is generally the least involved; mechanical work the most
• Drive condition — a drive that images cleanly is a very different job from one that fights every sector
• Capacity — more data means more imaging time and more storage for the result
• Number of drives — RAID and NAS jobs scale with the array
• Urgency — if you need it fast, say so, and you will be told whether that is possible

Assessment first, then a quote, then your decision.

The Recovery Software I Found Online

Fair question. For a simple logical case, where you deleted a folder on a healthy drive and nothing has been written since, reputable recovery software can work, and we will tell you so. Install it on a different drive, recover to a different drive, and stop at any sign of hardware trouble.

Where it goes wrong is on a failing drive. Recovery software scans the whole disk repeatedly, which is exactly what weak heads or bad sectors cannot take. A drive that was recoverable when the problem started can be beyond help after a weekend of scanning. If it clicks, disconnects mid-scan, or the scan is taking many hours, stop.

Prevention: The Part Nobody Reads Until Afterwards

The cheapest data recovery is the one you never need. One thing to take from this article:

• The 3-2-1 rule — three copies of your data, on two types of storage, with one copy off site or in the cloud. An external drive next to the server is a second thing to lose in the same fire, theft or surge
• Test the restore — a backup that has never been restored is a hope, not a backup. Restore a file once a month and open it
• Back up Microsoft 365 — emails, OneDrive and SharePoint are not backed up the way most people assume. Deleted items eventually leave the recycle bin, and ransomware can sync encrypted files straight into the cloud. A separate Microsoft 365 backup closes that gap
• Protect the power — a UPS with a clean shutdown when it runs low prevents many of the electronic failures that follow load-shedding

If you are not sure your business would survive losing its main server tomorrow, our disaster recovery page explains how to plan for it, and IT support in Pretoria covers keeping backups running and tested.

Data Recovery for Pretoria, From Centurion

Code Masters handles data recovery for hard drives, SSDs, USB drives, memory cards, RAID arrays and deleted or corrupted files from our office at 257 Jean Avenue, Building 5, Central Office Park, Centurion, 0157, 15 to 30 minutes from most of Pretoria. The helpdesk is open 07:00 to 18:00 on weekdays, and emergencies are handled 24/7. Read more on our data recovery service page or the data recovery in Pretoria page, or contact us with the symptoms.