Data recovery is one of those subjects nobody thinks about until it's urgent, and by then the decisions you made months ago have already determined the outcome. This guide covers what to do in the first hour, what's realistically recoverable, and how to make the next incident a non-event.
First: stop making it worse
Whatever has happened, the first hour matters more than the next ten.
- If a drive is failing, clicking, grinding, or disappearing from the system, power it off. Every additional attempt to read a failing disk risks turning a recoverable fault into a permanent one.
- If files were deleted, stop writing to that volume. Deleted data usually still exists until something overwrites it. Continuing to use the machine reduces your odds.
- If it's ransomware, disconnect the affected machines from the network immediately, but don't power them down; some keys live in memory. Then call for help.
- Never run recovery software on the original disk. Work from an image.
What's usually recoverable
Deleted files on a healthy disk: good odds if you act quickly and stop using the machine.
Logical corruption (bad file system, failed update, accidental format): usually recoverable, often fully.
Mechanical drive failure: needs a specialist cleanroom. Expensive, and success varies. This is why backups exist.
SSD failures: often worse than hard disks. TRIM means deleted data is genuinely erased quickly, and controller failure can make the whole device unreadable.
Ransomware-encrypted files: without a backup, recovery generally means either a working decryptor for that specific strain, or nothing. Paying is not recovery, it's hoping.
Cloud data: depends entirely on retention settings. As we cover in our piece on Microsoft 365 data responsibility, Microsoft's native windows are shorter than most people assume.
The realistic order of options
- Restore from backup. Fastest, cheapest, most complete. Everything else is a fallback.
- Native recovery tools. Recycle bin, Windows File History, previous versions, SharePoint version history, OneDrive files restore.
- Software recovery from a disk image. For deleted or logically corrupted data on a healthy disk.
- Specialist lab recovery. For physical failure. Costs are typically four figures and there's no guarantee.
That order tells you where to put your money: option one costs a fraction of option four and works every time.
Making the next one a non-event
The 3-2-1 rule still holds: three copies of your data, on two different media, with one copy offsite. In 2026 we'd add a fourth condition, one copy immutable, so an attacker with admin credentials can't delete your backups along with your files.
Practically, for a small business that means:
- Server and workstation image backups with local and offsite copies
- A third-party Microsoft 365 backup covering Exchange, SharePoint, OneDrive and Teams
- Immutable or air-gapped retention
- Monitoring that alerts on failed jobs, not just a green tick nobody reads
Test restores, or you don't have a backup
This is the part almost everyone skips. A backup job that reports success is not the same as data you can restore. We've taken on clients whose backups had been "running fine" for two years and were unrecoverable.
Test quarterly. Restore an actual file, an actual mailbox, and at least once a year an actual server. Document how long it took, that number is your real recovery time objective, not the one in the plan.
Know your two numbers
RTO (recovery time objective): how long you can be down before it seriously hurts.
RPO (recovery point objective): how much data you can afford to lose, an hour, a day, a week.
Most small businesses have never written these down, which means their backup schedule was chosen by accident. Setting them properly is the foundation of a business continuity plan, and it's the first thing our IT consultancy team works through.
If you're in the middle of an incident now
Stop, don't improvise, and get someone experienced involved before you try anything else. Well-intentioned DIY recovery is a common reason data becomes permanently unrecoverable.
We support businesses across Birmingham, Solihull and Worcester, and our helpdesk can triage a data loss incident quickly. If you'd rather never need that call, book a review and we'll test your existing backups for you.