After a data loss, there is no single right move, there is the right move for your problem. It all depends on what happened. Some situations get worse hour by hour, a flood, a fire, ransomware encrypting your files, and the window to recover is then very short. Others, a mechanical failure or deleted files, freeze as soon as the device is switched off and can wait for days. The reflex common to every case: switch the device off quickly, and do not tinker with anything before having it analysed.

What follows explains how to recognise which case you are in, what to do in the first hours, and the manipulations that turn a recoverable situation into a lost one.

The only reflex that applies to everyone: switch off, and fast

Whatever the device, phone, hard drive in a server, NAS server or server in a RAID, the first move is the same: cut the power quickly. As long as the system is running, it can keep making the problem worse, either by writing to the disk or by letting a physical damage progress under power.

The ransomware case is the most telling. As soon as you see that your files are being encrypted, do not wait, do not try to understand: switch off right away. For every minute the machine stays on, the software keeps encrypting new files and can export some to the outside. Letting the computer carry on means running the risk that all of your data ends up encrypted.

A hard drive showing signs of weakness follows the same logic, for a different reason. When the heads click or the drive becomes very unstable, you must switch it off and stop running it. Above all, do not restart it ten, fifteen or twenty times in the hope that it will pick up again. At best, very rarely, the problem sorts itself out. At worst, and this is the most frequent case, each attempt worsens the damage and can make recovery impossible.

When every hour counts

Two families of problems get worse as long as you do nothing. These are the emergencies.

External physical degradation: water, powder, chemicals

A flood, the powder from an extinguisher or a splash of a chemical attack the hardware continuously. Water is the most urgent case of all. Under power, a flood does not merely wet things: it creates corrosion and adds an electrolysis phenomenon that eats away at the components. Even simple droplets can permanently damage a device, whether a phone, a hard drive or an SSD, in just a few hours.

This damage carries on with its work even with the device switched off. Switching off stops the electrolysis and the short circuits, but the corrosion, the powder and the chemical residues carry on their attack. That is why these situations require prompt handling on our part: the sooner the device reaches us, the sooner we halt the physical destruction and stabilise the situation.

Logical destruction in progress: ransomware, TRIM, updates

The other family of emergency is the logical destruction that runs as long as the machine is on: ransomware encrypting, the TRIM that permanently clears the cells of an SSD after a deletion, system updates and writes that go over your data.

Here, switching off is enough to stop the process. Once the machine is powered off, nothing more is written, the situation is frozen and no longer worsens. That is the whole difference with water damage: for software, cutting the power freezes the problem; for water, it does not.

When nothing is pressing once the device is off

Conversely, many failures no longer get worse once the device is powered off. In these cases, the urgency is not to make things worse, not to rush.

A mechanical or internal physical failure, a faulty read head, a short circuit, electrical clicking, a system that has become inoperative, freezes when you switch off. The problem no longer continues and does not worsen on its own. You can take the time to entrust us with the device.

The short circuit deserves a clarification. You must not leave a device under power when there is a short circuit or a burning smell: continuing to power it heats up components that are not made for it, and they end up giving out and breaking further. But once the device is powered off, a short circuit that has already occurred does not call for intervention within the shortest possible time: the element is frozen.

Formatting and deleted files follow the same rule. As soon as the system is switched off, no more updates or writes take place, so nothing comes to overwrite the deleted data. You can send us the drive in the coming days or weeks: it is not the delay that will make the data unrecoverable, it is the writing. A RAID that only has a software problem, or a drive that clicks outside of any ongoing water or fire damage, also falls into this category: it can wait.

Still getting worse or frozen? The sorting table

Situation	Still getting worse?	The right move
Flood, water damage	Yes, even switched off (corrosion)	Switch off and bring it to us quickly
Extinguisher powder, chemical	Yes, even switched off	Switch off and bring it to us quickly
Ransomware encrypting	Yes, as long as it is on	Switch off right away
Deletion on SSD (TRIM active)	Yes, as long as it is on	Switch off right away
Read head, clicking, mechanical failure	No, once switched off	Switch off, do not restart, have it analysed
Short circuit, burning smell	No, once powered off	Unplug, do not plug back in
Formatting, deleted files (system off)	No	Write nothing more, send even later
RAID with a purely logical problem	No	Do not launch a rebuild, have it analysed

Two pitfalls that turn a failure into a loss

Beyond the right timing, two manipulations come up often and seriously worsen the situation.

The first, as we have seen, is to repeatedly restart a failing hard drive. Switching a drive whose heads are clicking back on ten or twenty times almost never repairs it and deteriorates the mechanics a little more with each attempt.

The second concerns the RAID. When a disk in an array fails, ask yourself a question first: have you already had a faulty disk on this same RAID before, a month ago for example? If so, launching a rebuild is risky. There is a strong chance that a second disk, already worn out, will fail in turn or be declared unstable during the reconstruction. The RAID then ends up completely degraded and far harder to recover. When in doubt, you do not launch a rebuild, you have it analysed.

What happens when you entrust us with the device

Once the device is in our hands, we start with an analysis to understand what happened. We draw up a complete and detailed analysis report, with photos of the observed damage where needed. If we consider the data recoverable, we submit a quote to you, which you are free to accept or refuse.

That is also why it is better to call us early: on water, powder or chemical damage, every hour saved is preserved material. In the other cases, a simple phone call avoids the manipulations that come at a high cost.

What to remember

The right move depends on the problem, but one reflex applies to all: switch the device off quickly and do not tinker with anything before having it analysed. Two types of situations get worse and require acting fast: the external physical damage that continues even switched off (water, extinguisher powder, chemicals), water first and foremost, and the logical destruction that runs as long as the machine is on (ransomware, TRIM on SSD, updates), which cutting the power is enough to freeze.

The other cases, mechanical failure, short circuit, formatting, deleted files, RAID with a logical issue, no longer get worse once the device is switched off and can wait. That leaves two pitfalls to avoid at all costs: repeatedly restarting a drive, and launching a RAID rebuild when a disk has already failed in the past. When in doubt, you switch off, you do not tinker, you have it analysed.

Frequently asked questions

What should you do first of all after a data loss?

Switch the device off quickly, whatever it is (phone, hard drive, NAS server, RAID), and do not tinker with anything before having it analysed. As long as the system is running, it can worsen the problem by writing to the disk or by letting a physical damage progress under power.

Do you always have to act in an emergency?

No. It all depends on the problem. Damage from water, extinguisher powder or chemicals, as well as ransomware and deletions on SSD, get worse and require acting fast. A mechanical failure, a short circuit or deleted files freeze as soon as the device is switched off and can wait for days.

Why is water damage the most urgent case?

Because water attacks the hardware continuously. Under power, it creates corrosion and adds an electrolysis phenomenon that eats away at the components. Even switched off, corrosion carries on its work, and simple droplets can permanently damage a phone, a hard drive or an SSD in a few hours.

My hard drive is making a clicking noise, can I try to start it again?

No. When the heads click, each new attempt deteriorates the mechanics a little more. Restarting it ten or twenty times almost never repairs it and can make recovery impossible. You must switch it off and have it analysed.

A disk in a RAID has failed, can I launch a rebuild?

Caution, especially if another disk in the array was already faulty in the past. A rebuild puts heavy strain on the remaining disks and can make a second one fail, which completely degrades the RAID. When in doubt, do not launch a rebuild and have it analysed.

I deleted or formatted by mistake, do I have to hurry to send it to you?

It is not the delay that matters, it is the writing. As soon as the system is switched off, nothing more is written to the disk and nothing comes to overwrite the deleted data. You can send it to us in the following days or weeks, as long as you have written nothing more on it.