Data recovery in the event of a hard disk crash

  • Article ID: 109327
  • Rating:
  • 1 customers rated this article 3.0 out of 6
  • Updated: 02 Jul 2009

Sophos SafeGuard Disk Encryption 4.60

Client OS

Windows 2000 Professional SP4, Windows XP SP3

Server OS



What is the best way to recover data from an encrypted, but defective hard disk drive?


Do not panic and do not overreact. Carefully consider the next steps instead.

Ask yourself what you actually mean by "hard disk crash":

-> does the operating system still boot to a certain point, but then simply error out (e.g. bluescreen of death; these kind of errors typically occur after you have installed new software or new drivers)

-> or is it more likely that the hard disk is suffering from a physical defect (e.g. hard disk makes rattling or clicking sound, hard disk is no longer recognized by the BIOS of the machine)

In case, you are not sure whether the cause of the error may be of a physical nature or a simple driver error, please seek the assistance of your IT department to help you determine the real cause. It is vitally important to make sure, when deciding on the next steps.

(Sometimes, it is really hard to find out: an error like a BSOD (or bluescreen) can also be caused by an underlying physical defect on the hard disk)

In cases where a physical defect is suspected, do not attempt any further recovery yourself. Switching on and of the machine is likely to make things worse and the risk of loss of data is high.

In this case, your prime focus should be to transfer the data from a defective hard disk drive to one that is fully intact.

How to do so? This is tricky and requires the help and knowledge of a professional hard disk recovery company. There are companies which are specialized in that discipline. Simply search the internet for "hard disk recovery" and check out for a company that looks sufficiently reputable to you.

Their service will cost you money. So in cases where a physical defect is the cause, please decide whether the data on the disk is well worth spending hundreds of Euros or Dollars. If the data on the disk has been backed up elsewhere, it might be cheaper to retrieve it from the backup.

Should you wish to take advantage of a professional data recovery company, ask them whether they are able to create a sector-based copy onto another hard disk. Ideally, this second hard disk should be from the same manufacturer and is identical in size a disk geometry. Once, the data has been transferred to the new media, insert it into the machine in question and try to boot the operating system. It depends on the amount of data that could be recovered, whether you will still have access to all the files.

Note: It may be necessary to perform a emergency decryption on the new medium, too. In that case, proceed to step 4.

In cases where no physical defect is suspected, use the Sophos SafeGuard Disk Encryption Emergency Tools to decrypt the hard disk first. Once, the decryption has completed, you can use other tools that allow you to repair the operating system. Alternatively, you can connect such a decrypted hard disk as a slave drive to another machine and simply access your data via the Windows explorer.

You find a description on how to create and use the Sophos SafeGuard Disk Encryption Emergency Tools in the knowledge base article 109363.

In case you are uncertain about any of the steps described above, please contact your local Sophos vendor to cross-check.

Related articles:
109220 - Purpose of the Sophos SafeGuard Disk Encryption kernel backup
109363 - How to use Sophos SafeGuard Disk Encryption Emergency Disk
109299 - Access to encrypted data on extended partition after operating system had been re-installed
Data recovery in the event of hard disk failure:

Keywords: emergency Notfall deinstallation crash datenrettung recovery 201 400 113 sde hardware harddisk data uninstall

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent