Data recovery in the event of a hard disk crash

  • Artikel-ID: 106721
  • Aktualisiert: 14 Apr 2014

Product
SafeGuard Easy multi-platform 4.5x

Client OS

Windows 2000 Professional SP4, Windows XP SP2 Professional Edition

Server OS

None

Question

What is the best way to recover data from an encrypted, but defective hard disk drive?

Answer


1)
Do not panic and do not overreact. Carefully consider the next steps instead.

2)
Ask yourself what you actually mean by "hard disk crash":

-> does the operating system still boot to a certain point, but then simply error out (e.g. bluescreen of death; these kind of errors typically occur after you have installed new software or new drivers)

-> or is it more likely that the hard disk is suffering from a physical defect (e.g. hard disk makes rattling or clicking sound, hard disk is no longer recognized by the BIOS of the machine)

In case, you are not sure whether the cause of the error may be of a physical nature or a simple driver error, please seek the assistance of your IT department to help you determine the real cause. It is vitally important to make sure, when deciding on the next steps.

(Sometimes, it is really hard to find out: an error like a BSOD (or bluescreen) can also be caused by an underlying physical defect on the hard disk)

3)
In cases where a physical defect is suspected, do not attempt any further recovery yourself. Switching on and of the machine is likely to make things worse and the risk of loss of data is high.

In this case, your prime focus should be to transfer the data from a defective hard disk drive to one that is fully intact.

How to do so? This is tricky and requires the help and knowledge of a professional hard disk recovery company. There are companies which are specialized in that discipline. Simply search the internet for "hard disk recovery" and check out for a company that looks sufficiently reputable to you.

Their service will cost you money. So in cases where a physical defect is the cause, please decide whether the data on the disk is well worth spending hundreds of Euros or Dollars. If the data on the disk has been backed up elsewhere, it might be cheaper to retrieve it from the backup.

Should you wish to take advantage of a professional data recovery company, ask them whether they are able to create a sector-based copy onto another hard disk. Ideally, this second hard disk should be from the same manufacturer and is identical in size a disk geometry. Once, the data has been transferred to the new media, insert it into the machine in question and try to boot the operating system. It depends on the amount of data that could be recovered, whether you will still have access to all the files.

Note: It may be necessary to perform a emergency decryption on the new medium, too. In that case, proceed to step 4.

4)
In cases where no physical defect is suspected, use the SafeGuard Easy Emergency Tools to decrypt the hard disk first. Once, the decryption has completed, you can use other tools that allow you to repair the operating system. Alternatively, you can connect such a decrypted hard disk as a slave drive to another machine and simply access your data via the Windows explorer.

You find a description on how to create and use the SafeGuard Easy Emergency Tools in the knowledge base article 102166.

Alternatively, you can try to use the prepared WinPE ISO with integrated SafeGuard Easy filter drivers which can be found in our knowledge base artlcle 66019.
You can boot this CD directly and try to access the files using your SafeGuard Easy credentials. It is necessary, that a PBA is still in place and the used SafeGuard Easy user has the right to boot up from external media. Further information about this ISO and how to use it can be found in the aforementioned article.

5)
In case you are uncertain about any of the steps described above, please contact our Sophos helpdesk to cross-check.

Related documents
107390 - Purpose of the SafeGuard Easy kernel backup
102166 - How to use SafeGuard Easy Emergency Disk
66019 - How to use the WinPE CD with integrated SafeGuard Easy logon tool

Keywords: emergency Notfall deinstallation crash datenrettung recovery 201 400 113 sge recovery hardware harddisk

 
Wenn Sie weitere Informationen oder Unterstützung benötigen, wenden Sie sich bitte an den technischen Support.

Artikel bewerten

Ungenügend Hervorragend

Anmerkungen