Data recovery follows a Hippocratic principle: first, do no harm. Every failed device sits in a fragile, sometimes metastable state, where a single wrong action — a reboot, a write-mode analysis, a rebuild — can tip a recoverable case into permanent loss. Diagnosis is the art of observing without degrading, then deciding.
This part follows on from the physical foundations and prepares the intervention methods. It describes how a lab moves from symptom to decision.
1 · Reading the symptoms
The device communicates its state through several channels, which must be interpreted without stressing it needlessly:
Acoustic signals
On a hard drive, a repeated click betrays a head that no longer reads and tries to recalibrate; a grinding noise suggests head-platter contact or stiction; total silence often signals an electronic or motor failure. On a NAS, a coded beep points to a system alarm. Each sound shapes the hypothesis — and, for a drive, demands immediate shutdown.
Electrical signals
Measurements on the power rails, a short, abnormal heating of a component: these readings, taken without booting the host system, locate a board failure (a drive's PCB, a phone's PMIC, a laptop's power supply).
Logical signals
Device detected but unreadable, wrong capacity, format prompt, missing partition: the mechanics and electronics are healthy, the failure is logical (file system, translation table, RAID metadata).
2 · S.M.A.R.T. and its limits
S.M.A.R.T. (Self-Monitoring, Analysis and Reporting Technology) exposes internal counters: reallocated sectors, read errors, temperature, power-on hours. It's useful to confirm degradation, but it doesn't predict everything: a drive can show "healthy" S.M.A.R.T. and die the next day, or conversely accumulate reallocated sectors while staying usable. Diagnosis never relies on it alone: it cross-checks it with physical symptoms and cautious reading.
3 · Forensic imaging
The heart of serious diagnosis isn't to "open the files" but to make a faithful copy of the device, sector by sector, on which all later work will happen. This image is created:
- Behind a write blocker, which guarantees no data is sent back to the source device;
- Prioritizing healthy zones: we first read what reads easily, map the defective sectors, and only insist on difficult zones last, in short passes;
- Managing device fatigue: thermal pauses, limited re-reads, stopping if the state degrades.
The goal: extract the maximum readable data before the device deteriorates further, then work on the copy without ever touching the original again.
4 · Professional tools
The lab relies on specialized platforms able to dialogue with device firmware and bypass defects:
- PC-3000 — access to a hard drive's Service Area, firmware repair, Translator reconstruction, SSD work.
- DeepSpar DDI — imager designed for unstable devices, with fine control of timing and power.
- Atola — fast multi-target imaging with automatic defect mapping.
- ddrescue — free pass-based imaging tool, precisely logging read and to-re-read zones.
5 · Hashing & chain of custody
As soon as the image is created, a SHA-256 cryptographic hash is computed: it proves, at any time, that the copy hasn't been altered since acquisition. For legal or sensitive cases, the whole process follows ISO/IEC 27037 (identification, collection, acquisition and preservation of digital evidence), with an intervention log and seals. This formalism guarantees the admissibility of evidence and, more broadly, the rigor of the work.
6 · From observation to decision
Diagnosis concludes with a classification that drives everything after: a logical failure (software work on the image), electronic (PCB, micro-soldering), mechanical (cleanroom), firmware (Service Area, FTL), or combined. It's this verdict — not a hunch — that dictates the method, the turnaround and the prognosis. At Dafotec, it's delivered free, within 24h, and formalized as a firm quote.