1 00:00:00,000 --> 00:00:06,560 So picture this. You're firing up your PC for another day of hard work, or slacking off at work, 2 00:00:06,560 --> 00:00:11,840 and nothing happens. I mean, the computer turns on, but instead of getting to the operating system, 3 00:00:11,840 --> 00:00:14,880 you get some kind of recurring error message about your storage. 4 00:00:15,760 --> 00:00:22,080 Then it hits you. Your hard drive or your SSD is dead, and the data is about as accessible as 5 00:00:22,080 --> 00:00:27,520 the Ark of the Covenant. But all might not be lost. You can still send your drive off to a 6 00:00:27,600 --> 00:00:33,520 data recovery service so that your tax documents, personal photos, or save games aren't lost to the 7 00:00:33,520 --> 00:00:38,000 ether. But how do you even get started with that? Well, today we're going to tell you how, 8 00:00:38,000 --> 00:00:41,920 and we'd also like to thank our friends over at Drivesavers for sponsoring this video. 9 00:00:42,560 --> 00:00:47,520 First things first, if you use a professional service, it probably won't take a super long 10 00:00:47,520 --> 00:00:53,440 time to get your data back if it is indeed recoverable. But it also won't be a matter of a couple 11 00:00:53,440 --> 00:00:58,720 of hours before you can breathe again either. If you can afford rush service and your recovery job 12 00:00:58,720 --> 00:01:03,600 ends up not being very complicated, it could be turned around in as little as a day. But you may 13 00:01:03,600 --> 00:01:09,600 also end up waiting around a week, so keep your expectations reasonable. If you only need logical 14 00:01:09,600 --> 00:01:14,640 data recovery, the process tends to be quicker. So this is when a drive is still in good shape 15 00:01:14,640 --> 00:01:19,600 physically, but you've lost your data due to something like a problem with the operating system 16 00:01:19,600 --> 00:01:25,600 or an accidental format. However, if you have a physical issue, like a head crash, you might be 17 00:01:25,600 --> 00:01:29,840 waiting around for longer since they'll probably have to take your drive apart, possibly in a 18 00:01:29,840 --> 00:01:34,960 clean room environment, and repair the drive just enough so that there can be a chance that you 19 00:01:34,960 --> 00:01:40,080 can get some of that data back. But how do these processes work? Let's first talk about logical 20 00:01:40,080 --> 00:01:44,880 data recovery, which for example, you might need if there's a problem with the master file table, 21 00:01:44,880 --> 00:01:50,000 which serves as kind of like an index or a record of the physical locations that each 22 00:01:50,000 --> 00:01:56,000 file occupies on your disk. Issues with the MFT can result in your computer simply not knowing 23 00:01:56,000 --> 00:02:02,480 where to find the data, even though it's still on the disk. So that can often still be recovered 24 00:02:02,480 --> 00:02:08,320 with tools that use strategies like bypassing corrupted file system infrastructure or scanning 25 00:02:08,320 --> 00:02:13,360 the data manually and then putting it back together using signatures that are common to certain file 26 00:02:13,360 --> 00:02:18,480 types. Physical recovery is obviously more complicated. Of course, if a drive is very 27 00:02:18,480 --> 00:02:23,120 badly physically damaged, there might not be anything even the best data recovery companies 28 00:02:23,120 --> 00:02:28,000 can do. But if that isn't the case, recovery companies do have a variety of tricks up their 29 00:02:28,000 --> 00:02:33,840 sleeves. It could be repairing or replacing the drive circuit board. You could move the disk 30 00:02:33,840 --> 00:02:38,880 platters to a new drive, a tricky proposition because of how close the read and write head has 31 00:02:38,880 --> 00:02:44,320 to be to the platter surface. And even a drive that suffered a head crash, where the head actually 32 00:02:44,320 --> 00:02:49,200 impacts the disk, it can partially be salvaged by physically moving the head out of the way 33 00:02:49,200 --> 00:02:53,840 before attempting to read any data on whatever good parts of the platter are left. Though it 34 00:02:53,840 --> 00:02:58,640 should be noted that the area directly under the crash is often unrecoverable. If we're talking 35 00:02:58,640 --> 00:03:04,480 about SSDs, the company might actually have to remove the NAND flash that stores the data 36 00:03:04,480 --> 00:03:10,240 and transplant it to a new board with the original controller chip. And then for corrupted firmware, 37 00:03:10,240 --> 00:03:15,440 which also counts as physical failure, by the way, the data recovery company might have to repair 38 00:03:15,440 --> 00:03:21,040 or rebuild the firmware to access your data, which can add additional time. And sometimes data can 39 00:03:21,040 --> 00:03:25,760 be unrecoverable even if there's no physical damage, as is the case of a hard drive that's 40 00:03:25,760 --> 00:03:30,560 overwritten with zeros or an SSD where the trim command has been run. You can learn more about 41 00:03:30,560 --> 00:03:35,520 those things here and here. Now that you have an idea of how it works, how do you go about 42 00:03:35,520 --> 00:03:40,560 picking a service provider? Well, one thing to keep in mind is that reputable places will often 43 00:03:40,560 --> 00:03:44,720 provide some kind of results-based payment structure. You ever see those lawyer commercials 44 00:03:44,720 --> 00:03:49,840 where they say, you don't pay if we don't win? Well, a good data recovery place also shouldn't 45 00:03:49,840 --> 00:03:54,320 be billing you if they can't get your data back. So look out if they try to charge you large amounts 46 00:03:54,320 --> 00:03:58,640 of money that you'll be on the hook for regardless of whether anything is actually recovered. 47 00:03:58,640 --> 00:04:02,400 And on that note, make sure you get a quote in writing before signing anything. 48 00:04:02,400 --> 00:04:06,000 Also, make sure that your provider has comprehensive security protocols in place. 49 00:04:06,000 --> 00:04:10,160 They should be protecting your data and getting rid of any copies that they have 50 00:04:10,160 --> 00:04:14,240 once the recovery process is complete. And of course, like anything else, 51 00:04:14,240 --> 00:04:18,400 read reviews and make sure there aren't an inordinate number of complaints about a particular 52 00:04:18,400 --> 00:04:23,520 company because they took two months and all they could recover was a big folder of Linus face memes. 53 00:04:24,080 --> 00:04:27,440 For example, not that I speak from personal experience. 54 00:04:27,440 --> 00:04:30,560 Thanks for watching guys. Like dislike, check out our other videos, 55 00:04:30,560 --> 00:04:34,480 comment with video suggestions if you want to see a Techquickie topic in the future, 56 00:04:34,480 --> 00:04:36,880 and don't forget to subscribe and follow.