Start by deciding whether the failure is logical or physical. A drive that still appears can often be imaged, while clicking or impact-damaged hardware should stay powered off.
If the drive appears in Disk Management or Disk Utility without clicking, create a byte-to-byte image with Disk Drill, then scan the image. If it clicks, grinds, smells burned, or suffered a hard drop, unplug it plus contact a recovery lab.
Do not format, initialize, defragment, run CHKDSK, or save recovered files onto the damaged drive. Stop powering it on if you hear clicking, grinding, repeated spin-up cycles, or scraping.
Creates a byte-to-byte backup, scans recoverable data, previews found files · Windows + macOS
Disk Drill can create a byte-to-byte image, then search that image for files without repeatedly stressing the original disk. This approach fits deleted data, damaged file systems, RAW volumes, accidental formatting, plus drives that disconnect occasionally but remain readable.
Sometimes the hard drive itself is fine. A worn USB cable, weak power adapter, damaged port, or failed bridge board inside the enclosure can make it look dead.
A second computer may recognize a file system that the first machine cannot mount. Read-only access reduces the chance of automatic repairs or background writes changing recoverable data.
lsblk
, create a mount folder, then mount the volume using a read-only option appropriate for its file system.GNU ddrescue copies readable areas first, records progress in a mapfile, then revisits difficult sectors later. It is more suitable than a normal copy command when the source disk has bad sectors but remains mechanically stable.
lsblk -o NAME,SIZE,MODEL,SERIAL
.sudo ddrescue -f -n /dev/source /dev/destination recovery.map
. Replace the device names with the correct paths.sudo ddrescue -f -r2 /dev/source /dev/destination recovery.map
. Stop if the drive develops clicks, scraping, or repeated power loss.Software cannot repair broken heads, a seized motor, damaged platters, or severe controller failure. A qualified lab can diagnose the hardware, stabilize it, then image readable sectors with specialized equipment.
A drive that appears with the correct capacity but shows as RAW, unallocated, unreadable, or missing a volume often has logical damage. Deleted partitions, damaged file-system records, plus accidental formatting fall into this group.
Clicks, grinding, beeping, a burnt smell, no spin, repeated spin-up cycles, or failure after a drop point toward physical trouble. Cable failure can imitate either category, so one careful connection test is reasonable unless the drive makes abnormal sounds.
Skip DIY scanning after impact damage, liquid exposure, visible circuit damage, or new mechanical noises. Avoid freezer tricks, repeated power cycles, enclosure tapping, PCB swaps, plus opening the sealed disk chamber.
Encryption also changes the plan. Keep passwords, recovery keys, original controllers, plus any hardware associated with the drive because recovered sectors may remain unreadable without them.
Match the method to the drive's symptoms, not just the missing-file problem.
| Method | Best for | Time | Success rate |
|---|---|---|---|
| 1. Recover From a Drive Image With Disk Drill TRY FIRST | Visible drives with logical damage | ~30 min to several hours | ● 82% |
| 2. Replace the Cable, Power Supply, or Enclosure | Connection or enclosure faults | ~10–30 min | ● 75% |
| 3. Mount the Drive Read-Only on Another Computer | Volumes rejected by one system | ~15–60 min | ● 62% |
| 4. Clone the Failing Drive With GNU ddrescue | Bad sectors on a stable disk | ~2 hours to several days | ● 68% |
| 5. Send the Drive to a Data Recovery Lab | Mechanical or electrical damage | ~3–14 days | ● 85% |
Recovering from a byte-to-byte image with Disk Drill is the sensible first move when the drive stays visible, sounds normal, plus can still be read. Try connection hardware checks if the disk never appears, use ddrescue for a stable drive with bad sectors, or choose a recovery lab immediately for mechanical symptoms.
No method can promise every file. Preview recovered items, save them elsewhere, then replace the questionable drive rather than trusting it again.
Protect the source first: make one image or clone, perform recovery work on that copy, then verify the recovered files before wiping or discarding anything.