Removed the Drive and Still Cannot Recover It, or Only Part Came Back? Advanced Differentiation: Enclosure Layers, Logical vs Hardware, SSD TRIM, Encryption Keys, Image-First Priority, Controlled-Environment Handling and RAID

Premise: this is not a repeat of the basic removed-drive guide

If you are reading this, you have probably already tried the basic step: the laptop will not turn on, the drive was removed, and it was read through an enclosure or adapter on another computer. That basic approach was already covered in the earlier article, "Dead Laptop Data Recovery: Reading a Removed Drive and Encryption Reminders" — the key points being that a drive that is itself intact can generally be read directly, a drive that is itself damaged may not respond to that approach, encryption needs a key or password prepared first, and any unusual sound means stop at once.

This advanced article assumes those basic methods have already been tried, but the result is one of the following: nothing can be read at all, only part of the data was recovered before things got worse, file names appear in a scan but the files will not open, or a format prompt keeps appearing. At that point, the problem is probably not that you have not tried enough, but that the layer at fault has been misjudged. Repeating the same method can make the remaining readable part harder to handle. The sections below work layer by layer: which layer has failed, why some files come back and others do not, why encryption and SSDs are especially troublesome, when a controlled-environment handling is genuinely needed, and what information to prepare before asking for a quotation.

One principle runs through the whole article: without a physical inspection, any cause is only a possibility, not a diagnosis, and any recovery outlook depends on the inspection result and cannot be promised in advance.

Step one: enclosure reads it or not — first say clearly which layer you have reached

"My enclosure cannot read it" can mean four quite different layers. Before asking for a quotation or for help, say clearly which layer you have reached, so that the next step can be judged correctly; otherwise the wrong method is easily chosen.

Layer	Common presentation	Advanced differentiation
Cable, port, power	No light, no spin sound, no response on any computer	Compare with another cable, another USB port and another computer; for models needing external power, confirm the power supply is normal. Until this layer passes, the drive itself has not yet been reached
Enclosure bridge board	The drive itself spins quietly with no unusual sound, but the whole external drive is not recognised	The bridge board can fail independently. Keep the original enclosure, original cable and original power supply; do not discard them, because the bridge board may carry information needed for decryption
Recognised at system level, invisible in File Explorer	Disk Management or Disk Utility lists the drive, but there is no drive letter, and it shows as RAW, unallocated or not initialised	More likely a partition or file system problem, but firmware or bad sectors can also cause it. "The drive is visible" does not mean "the drive is healthy"
Visible in File Explorer but will not open, or partly read then worsening	A format prompt appears, folders will not open, copying breaks off midway, reading gets slower and slower	Typical of logical damage, but if slowness, disconnection and unusual sounds occur at the same time, treat it as a mixed fault, not a purely logical problem

Two misjudgements are especially common. First, on some external drives the hardware encryption key sits on the bridge board, so removing the bare drive and reading it in another enclosure may return only encrypted content. That does not mean the data inside is already gone, and initialisation or creating a new partition must not be done in that state. Second, very slow reading, frequent disconnection or freezing the computer must not be treated as "just slow" while File Explorer is used to drag files one by one; those symptoms point to an unstable drive, which should be stopped first and handled with the whole-drive imaging approach described below, rather than being worked harder.

Step two: partition and file system damage, or hardware failure?

Drive failures are generally grouped into four types: logical, mechanical, electronic and firmware. The grouping is not for terminology's sake; each type leads to a completely different next step, and using the wrong method can make things worse.

Leaning towards	Typical symptoms	Direction for the next step
Logical failure	The drive is detected, the capacity displays correctly and there is no unusual sound, but a partition shows as RAW or unallocated, or a format prompt appears	The file bodies are often still on the platters or flash; what is broken is the "map", that is, the partition table or file system index. Save the files or image first; do not format first
Mechanical failure	Repeated clicking, grinding or beeping, very slow spinning, repeated spin-up and stop, abnormal heat, or freezing the computer when connected	Stop at once on any unusual sound; do not run repeated power-on tests. Each power-on gives the heads another chance to scratch the platter surface
Electronic failure	Complete silence, no spinning, not detected on any computer, sometimes with a slight burnt smell, although that smell is not a certain symptom	The data itself is often still on the media; the problem is the circuit board. Do not buy a same-model drive to swap boards yourself, because modern drive boards usually carry calibration data specific to that drive
Firmware failure	Spinning sounds normal with no unusual sound, but the system does not recognise the drive, or shows a wrong capacity (for example a very small capacity or 0 GB) or a wrong model	Ordinary file recovery software does not reach the firmware layer; do not treat an ordinary scan as a firmware repair

Only logical failure is suited to careful handling with ordinary software, and recovered files must be saved to a different healthy drive, never written back to the same faulty drive; the recovery software itself must not be installed onto the faulty drive either. Repeated scanning of a mechanical, electronic or firmware failure with ordinary software usually makes things worse.

Mixed cases also need attention: one drive can have both logical and hardware problems. Bad sectors are themselves a hardware or media problem, but they can also damage the file system, making the symptoms look like purely logical damage. When behaviour is unstable, the drive should be stopped rather than judged a purely logical problem from a single symptom. Self-monitoring data can only be used as a screening reference, not as a guarantee.

Two ordering mistakes are the most common. First, a system prompt asking to format or initialise must be refused; formatting rewrites the file system structure and makes an originally rebuildable structure harder to restore. Second, repair tools (for example CHKDSK or a disk utility repair function) aim to bring the file system back to consistency, not to rescue files; using a repair tool before the important files have been rescued may overwrite the structure that rescue needs. The correct order is to rescue the files or image first, and consider repair tools afterwards.

Step three: SSDs — deleting a file and a faulty SSD are two completely different things

This is the section most easily written wrongly and most easily misunderstood, so the two situations must be kept separate.

An SSD uses NAND flash memory; before new data can be written, a whole block must first be erased, and in-place overwriting is not possible. TRIM is the operating system telling the SSD that certain blocks are no longer needed, so that the SSD can erase them in advance and free space. After a file is deleted, TRIM erasure can happen within a short time; once the relevant blocks have been erased or overwritten, recovery tools cannot recreate the original content out of nothing. However, "receiving the TRIM command" and "physical erasure completed" are two separate events; erasure may be carried out during idle time by garbage collection, and there is no fixed time limit that applies to all models. It must therefore not be written that data "will certainly be gone within a few minutes", nor that it "will certainly still be there for a few days".

Situation one: deleting files or quick-formatting a healthy SSD. In this situation the chance of recovery depends on the inspection result, and the difficulty is generally higher because TRIM may already have erased the data. The correct immediate action is to stop using the drive at once: do not keep using it, and do not install recovery software onto the same drive, because installation itself is a write, and it also gives TRIM more idle time to complete erasure. For an external SSD connected over USB, whether the TRIM command actually reaches the SSD depends on the operating system, the enclosure controller and the connection method, so the difficulty of recovering deleted files from an internal SSD and from an external SSD can differ and must not be generalised.

Situation two: the SSD itself is faulty. This is the opposite problem from deletion: if the fault is in the controller, firmware or interface rather than a deletion, the data may still remain in the NAND, and TRIM is not the obstacle at that moment. Both "an SSD file once deleted is certainly unrecoverable" and "a dead SSD is certainly unrecoverable" are therefore wrong. SSD failure often arrives suddenly, with little of the advance audible warning typical of HDDs; common symptoms include sudden disappearance from the system, disappearance during copying, wrong capacity display, a generic model name, becoming read-only, or frequent crashes. Do not judge an SSD by the HDD rule of "a sound means it is broken". On a modern SSD with hardware encryption where the key sits in the controller, controller damage can make reading impossible even when the NAND is intact; removing NAND chips to read them is not a general solution for modern SATA or NVMe SSDs.

By contrast, when a file is deleted from an HDD, usually only the marker pointing to the data location is removed, and the content itself remains until it is overwritten by new data. This contrast can explain why deleted-file recovery prospects differ between HDDs and SSDs, but it must not be turned into "an HDD deletion can certainly be recovered".

Step four: encryption — BitLocker, FileVault and external-drive hardware encryption; keys come first

The encryption section must be split into three questions: first, is encryption switched on? Second, which kind of encryption is it? Third, where is the key or password, and can it still be found? Until all three are answered, neither a quotation nor a recovery outlook can be stated accurately. More importantly, without a password and without a recovery key, no method for bypassing encryption should be implied.

A BitLocker recovery key is a 48-digit number generated when encryption was switched on, as a fallback unlocking method when the password is forgotten. Without a password and without a recovery key, the encrypted data becomes inaccessible, and third-party recovery software cannot bypass BitLocker encryption. Places where a recovery key may be stored include: a Microsoft account, a printed paper copy, a copy stored on a USB drive or in a file, and a work or school domain or managed account. Before asking for a quotation, each of those places should be checked one by one, rather than assuming there is none. Three things must also be kept distinct: a sign-in password is not a recovery key, and a recovery key is not a key identifier; a key identifier only identifies which key it is, it is not the key itself, and a key cannot be derived from the identifier.

For FileVault, recovery depends on having at least one unlocking credential: the user sign-in password, the FileVault recovery key, or a recovery key held through an Apple ID. If all three are missing and there is no other unlocking route, the data stays locked. Two hosting routes must be distinguished: a key held through iCloud can be sought with identity verification, while a locally kept key is held only by the user and, once lost, the original key cannot be retrieved. On a FileVault-encrypted volume, even the file system metadata is encrypted; before decryption, recovery software cannot identify file locations or metadata, and therefore cannot carry out a scan-based restore. Even with a password, if the encryption metadata or container header itself is seriously damaged, the data may become inaccessible; "a password guarantees recovery" is a false promise.

When an encrypted drive also has a hardware fault, the reasonable order is to make a read-only copy or image first, then repair the encrypted volume structure on the copy, and only then decrypt with the key provided by the owner; decryption must not be attempted repeatedly on the faulty original drive. External-drive hardware encryption is different again: the key may be bound to the bridge board or a dedicated security chip rather than to the storage device itself, so even chip-level reading of such a drive may return only ciphertext. That is why the original enclosure should be kept when sending a drive in, as already noted above, and it matters even more in an encryption case.

Step five: only part recovered — how to choose priority files: image first, then choose

Partial recovery is normal; it must not be implied that "recovered means fully recovered" or that "not recovered means nothing". The correct order for an unstable drive is: make a whole-drive image first, then carry out all scanning and restoring on the image or copy, never by repeated work directly on the original drive.

Imaging tools generally work in two stages: the first stage copies all sectors that read at normal speed and skips slow or unresponsive parts; the second stage goes back to handle the unread parts one by one. The purpose of this order is to secure the largest readable content first and reduce strain on the faulty drive. The prerequisites for imaging include: the drive can spin, the system can detect it, and there is no clicking, beeping or grinding sound; with those sounds, or with no detection at all, stop and do not force this method. The imaging target drive must have at least the capacity of the source drive for a whole-drive image, and restored files must be saved to another healthy drive, never written back to the source drive.

The priority list should be set by the owner, not guessed by the repair side. The principles are: unique and unrepeatable items first, such as identity documents, work files, photographs with no other copy, contracts and financial records; business-critical items first, such as files that restore communication, transactions, payroll or finance; small but critical items first, such as documents, databases and configuration files, which are usually more worth rescuing first than large media files; and if the connection itself is unstable, copy the most important files first rather than starting with the largest, most easily replaceable folder, because the connection may break off at any moment. A drive that briefly reads again after handling may not stay stable for long, so work should follow the owner's priority order and take the most important files first.

Common reasons for partial recovery include: some sectors already damaged, some files already overwritten, some file metadata already damaged, or a file spanning both damaged and undamaged areas; therefore "half recovered" does not mean "the other half will come back by trying the same method again". On acceptance, each file should be opened and checked: can the document open normally, does the photograph display completely, does the video play, is the spreadsheet data complete? A file name appearing in a scan does not mean the file has been recovered; a name existing does not mean the content is complete. Files rescued by file-signature carving tools may lose their file names and folder structure, and large or fragmented files may be truncated, and that limitation should be stated in advance.

Step six: opening the drive and controlled-environment handling — when is it genuinely needed?

Not every data-loss case needs controlled-environment handling. Opening a drive only makes reading possible; it does not guarantee complete content. Writing an unnecessary case as needing it is misleading, and writing a case that needs it as not needing it harms the reader.

Situation	General direction
Deleted files, formatting, ordinary logical failure	Usually no need to open the drive; the focus is imaging and file system rebuilding
Enclosure bridge board, cable or power problems	No need to open the drive; test the bridge board and the drive separately first
Firmware-layer cases that dedicated tools can handle without opening	Depends on the individual model and the extent of damage; do not state it as a general rule, and opening is not necessarily needed
Clicking, grinding or beeping, not spinning, not detected, head damage, motor seizure, or physical damage from a drop, water or high temperature	Consider controlled-environment handling; when mechanical failure is suspected, the first step is to power off and stop using the drive
SSD failure	An SSD has no HDD-style heads or platters; the focus is the controller, firmware and NAND, not opening the drive

Opening a hard drive in an ordinary indoor environment exposes the platters to dust; at high rotational speed, dust particles too small to see can scratch the magnetic recording layer and cause permanent loss. A head assembly is generally replaced rather than repaired: in a controlled environment, a donor head assembly of the same model and matching firmware replaces the faulty one, and imaging follows. Modern drive calibration values may be stored on a dedicated chip on the circuit board, so a board swap requires moving the original board chip over; it is not a matter of fitting any same-model board. Repeatedly power-testing a drive with a mechanical fault can let an already damaged head sweep across the platter surface again and again, widening the damage.

Folk remedies such as freezer cooling, tapping or shaking must be stated as things not to do: cooling introduces condensation moisture, while tapping and shaking can make the heads strike the platter surface. These are not "worth a try"; they can make later handling more difficult. The grading of a controlled environment also needs care: different sources mention different grades, and no single grade should be written as the sole standard; this article therefore only writes "controlled dust-free environment", and the actual equipment of a given handling provider is a matter for individual inspection, not a general promise.

Step seven: RAID and multiple drives — why more drives do not mean more protection

RAID is not a substitute for backup. Even where an array itself has redundancy, RAID does not stop mistaken deletion, formatting, file system damage, controller failure or human error, and an independent backup is still needed. This must be stated first, or readers will wrongly assume that rebuilding equals recovering the data.

The fault-tolerance limit of each level is a design limit, not a recovery guarantee. RAID 0 has no redundancy; one drive failing leaves files striped across drives missing a part. RAID 1 is mirroring; with one member drive intact, the data is relatively easy to retrieve, but the surviving drive itself must be confirmed healthy. RAID 5 is designed to tolerate only one drive failing; a second drive failing before rebuilding finishes will usually take the array offline. RAID 6 uses double parity and is designed to tolerate two drives failing at the same time, but rebuilding remains technically demanding and must not be written as certainly safe. RAID 10 depends on which two drives fail: two drives of the same mirror pair failing together affects the related data, while one drive failing in each of two different pairs gives a completely different result.

An array failure does not mean the data on the member drives is already gone; often the data is still on the member drives and only the array itself cannot assemble. The focus of rescue is therefore to image each drive first and then rebuild the array virtually, rather than rebuilding repeatedly on the original array. Rebuilding on your own is dangerous: rebuilding writes new data or parity data to all member drives; if the RAID parameters are wrong, the drive order is wrong, or the array structure is already damaged, rebuilding will overwrite rescuable data. Rebuilding with a stale drive — one that went offline earlier with older data — will calculate new parity from outdated data and write wrong data to healthy drives. The rebuilding process also puts all remaining drives under sustained high load, and a drive already on the edge may fail completely during the process.

The safe order after a RAID failure is: stop the array, do not write further, and do not try different rebuilding or repair operations; label each drive with its original slot number and record the drive order; record the RAID level, the number of member drives, each drive's capacity and model, the stripe size, the controller model and its error messages; check each member drive's health one by one, and stop first on any drive showing physical-fault symptoms; image each member drive sector by sector, and work on the images or a virtual rebuild rather than rebuilding on the original array; save rescued files to a completely independent storage device. Operations that must never be done include: formatting any member drive, initialising a drive in the controller, creating a new array on the same set of drives, running repair tools on the RAID volume, or repeatedly plugging drives in and out or shuffling their order.

Step eight: questions to settle before a quotation — bring this checklist

Data recovery pricing is subject to a written quotation after diagnosis. For reference on other repair items, see pricing; to book an inspection, see diagnostic. But until the items below have been settled, no pricing range or time range can be stated accurately. The checklist below can be used directly to check your own situation; bring the information with you rather than only saying "it cannot be recovered".

• Drive type and interface: HDD or SSD, SATA or NVMe, 2.5-inch or M.2, internal or external, and whether the original external enclosure is still available.
• Drive brand, model and capacity; whether the capacity detected by the system matches the labelled capacity — a mismatch points to firmware or hardware problems.
• Symptoms: any clicking, grinding or beeping, whether it spins, whether it gets hot, whether the computer freezes when connected, and how often it disconnects.
• System level: whether the BIOS, Disk Management or Disk Utility sees the drive, and whether it shows as RAW, unallocated, asking to format, or not visible at all.
• What has already been tried: enclosure, another computer, recovery software, formatting, initialisation, repair tools, opening the cover, freezer remedies — each may affect later possibilities and must be stated honestly.
• Drops, water or power incidents: whether it was dropped, got wet, or failed after lightning or a power surge.
• Encryption: whether BitLocker, FileVault or external-drive hardware encryption is switched on; where the password or recovery key is, which places have been checked, and whether it can still be retrieved from an account.
• Deletion or formatting background: whether it was a mistaken deletion, formatting, loss after a system crash, or a drive that suddenly became unreadable; for an SSD mistaken deletion, state whether it is internal or external, and whether it kept being used after deletion.
• Priority files: the owner's own priority order, file types and approximate quantities, whether other copies exist, and whether a target drive is available to receive rescued files.
• RAID or multiple drives (if applicable): RAID level, member drive count and order, which drive failed first and which failed later, whether the drive order was shuffled, and whether rebuilding was tried.
• Backups: whether there is a system backup, file history, cloud backup or external backup drive — if a backup exists, the urgency and scope of rescue change completely.
• Stop authority: if inspection finds that continued reading would widen the damage, whether stopping first and discussing the next step is agreed; this should be settled before quotation, not argued about midway.

Closing: the stop principle — with unusual sounds, instability, or encryption not yet unlocked, stopping beats trying again

To sum up in one line: when basic methods have already been tried and data still cannot be recovered, or only part of it comes back, do not repeat the same method. First differentiate the layers: cable and power, bridge board, hardware, file system — each layer has its own next step. Stop and power off on any unusual sound. For logical problems, rescue the files or image first, and consider repair tools afterwards. For SSDs, distinguish deletion from failure. For encryption, find the key first and do not assume it can be bypassed. For partial recovery, accept against the owner's own priority list, and only count a file as recovered when it opens and its content is complete. For RAID, do not rebuild blindly on the original array. For controlled-environment handling, consider it only for mechanical or physical damage.

If you have already worked through the checklist above, you can bring the drive type, symptoms, recognition state, encryption state, operations already tried and priority file list to diagnostic to book an inspection; pricing reference is at pricing, and data recovery is subject to a written quotation after diagnosis. Shop information: Room 1209, Daly Plaza, Shek Mun, Sha Tin; telephone +852 2186 8010; WhatsApp +852 6558 6806; business hours 12:00-19:00.