Choosing a Data Recovery Provider: 10 Questions to Ask Before You Send Anything

Data recovery is largely unregulated: there is no licence needed to open a recovery shop, and claims such as "99% success rate" or "24-hour turnaround" cannot be checked from outside. The same website wording can hide a cleanroom laboratory with years of firmware work, a reseller who sends drives on to someone else, or a company that runs the same off-the-shelf software you could run yourself.

The choice matters because the first attempt is often the only good one. A failing drive gets worse every hour it runs, a RAID rebuilt the wrong way overwrites its own parity, and a ransomware-encrypted database copied over by a careless restore loses the parts that could still be saved. These ten questions help you choose before anything is sent.

"Data recovery" covers very different work. Physical recovery of hard drives needs a cleanroom, donor parts and firmware tools. RAID and server recovery needs knowledge of controllers and file systems. Database and virtual-machine recovery needs people who understand SQL Server, Oracle, VMware or Hyper-V at the level of pages and blocks. Ransomware recovery needs all of that plus an understanding of how encryptors work.

Ask which of these the provider does in-house, and ask for an example of a similar case. A shop that is excellent with laptop drives may have no experience with a 12-disk RAID 6 or an encrypted 500 GB database — and the right answer to "can you do this?" is sometimes "no, but here is who can".

A real evaluation finds the type and extent of the damage — logical corruption, a physical or mechanical fault, a firmware problem, encryption — before any price is given. Ask whether they will actually connect to or image the drive, or examine sample files, rather than quoting from the drive model and your description of the symptom.

For logical damage and ransomware, much of the evaluation can be done remotely: a few encrypted files, a database file or a disk image are usually enough to measure what is recoverable, without shipping the whole system.

The best answer is a list: which files, tables or virtual machines can be recovered, and which cannot. A percentage ("we can recover about 80%") without saying 80% of what is much less useful. For important data, ask to see a sample of recovered files — a few documents that open, or rows from a recovered table — before you agree to the full price.

"No data, no fee" is a common and fair term in data recovery, because the outcome cannot always be known in advance. Check exactly what it covers: some providers still charge for the evaluation, for imaging the drive, for donor parts or for "attempt" fees, whatever the result. Also ask what counts as "data" — if the files you need are not recovered, is that a success for them? Get the terms in writing before the drive or files are sent.

Prices are usually set by the type of damage and the work involved, not by the amount of data, so the same 1 TB drive can cost very different amounts for a deleted folder and for a seized motor. A fair provider gives you a fixed quote after the evaluation and does not raise it once your data is in their hands. Emergency service — working through the night and at weekends — usually costs more; ask what it costs and whether you need it.

A provider who has really diagnosed the problem can describe it: a failed head on surface 2, a corrupt firmware module, a RAID rebuilt with the wrong disk order, a database whose first pages were encrypted. A vague answer such as "the drive is badly damaged, we will do our best" after an evaluation is a reason to ask more questions before going further.

Good practice is to image the failing drive or copy the damaged files once, and then do all recovery work on the copy. That way a mistake costs time, not data. Ask whether they image first, whether your original media is returned unchanged, and whether any repair tool is ever run directly on the original.

For business, medical or regulated data, ask who handles the drive and the recovered data, whether it is kept on isolated systems, how it is returned to you (encrypted drive, secure download), and when the working copies are deleted. A non-disclosure agreement should be easy to get. If you are in a regulated sector or a country with strict data-protection law, ask whether the data will leave the country and on what terms.

Some companies that advertise "ransomware decryption" have been found to simply pay the attackers and pass the cost on, without telling the customer. If a provider promises to decrypt a modern ransomware family for which no public decryptor exists, ask exactly how. Genuine recovery without the key works from what the ransomware did not touch — the unencrypted parts of large files, surviving backups and snapshots — and a genuine provider will tell you what that leaves and what it does not.

Ask also whether they report on what happened: which ransomware it was, which files were encrypted and how much of each. That report is what your management, insurer and, where required, the authorities will ask for.

For a business system that is down, a provider who answers on Monday is no use on Friday night. Ask whether they handle emergencies outside office hours, how quickly an evaluation is done, and how files reach them — by courier, by drop-off, or by secure upload. For logical damage and ransomware, a provider in another city or country can often start the same day over an encrypted upload, which is faster than shipping disks.

Be careful with a provider who guarantees recovery before seeing the media, who quotes a very low price on the phone and raises it once the drive has arrived, who asks for full payment before any evaluation, who will not say where the work is done, or who promises to decrypt ransomware for which no decryptor exists. Be careful too with advice to run repair tools, CHKDSK or a RAID rebuild yourself "before sending it in": these are the steps that most often make data unrecoverable.

At AS IT TECH the assessment is free, and we tell you exactly what is recoverable — which files, tables or virtual machines — before you pay anything. You get a quote for the recovery; if no data is recovered, there is no charge. We work on images and copies, never on the only original, sign an NDA on request, and for ransomware we measure how much of each file was really encrypted instead of guessing. Our own recovery software for SQL Server, Oracle, Veeam and VMware comes from that work, and the case studies show what it has recovered.