Data Recovery Case File · Trust, Practice & Honest Limits · The Question Nobody Asks
Recovering Data Creates Copies of It, and That Is Worth Agreeing in Writing
This enquiry comes from an institution and asks something almost nobody asks. Data required from an external drive where "the data has personal information and raw research data that will require deleting after the recovery process." A recovery necessarily produces copies before it produces a result — an image of the source, working copies during reconstruction, and the delivered output — and for material of this kind, what happens to all of them afterwards is a legitimate part of the job.
| Media | 1TB external hard drive holding personal information and research data — recovery required with defined retention and destruction terms |
| Reported situation | External drive holding personal information and raw research data · recovery required · deletion of all copies required following recovery · institutional requester · terms sought in advance |
| Fault class | Recovery with data protection obligations attached — handling, retention and destruction terms determinative alongside the technical work |
| Equipment used | Retention and destruction terms agreed in writing before receipt · working copies enumerated and their locations recorded · access restricted to those performing the work · imaged write-blocked with the image held for a defined period · all copies destroyed on confirmation with written record supplied |
The decode: what a recovery actually creates
Why the question is a good one: people think of recovery as retrieving something, which implies moving it. It is closer to duplicating it several times and then handing one copy back — and for ordinary personal content nobody considers that, because there is no obligation attached.
What gets created in a typical job: a sector-level image of the source drive, so that no further work touches the original. Working copies during reconstruction, because rebuilding structures means operating on something that can be altered. And the delivered output on whatever medium it is returned on.
Why the image in particular is worth discussing: it is a complete copy of everything on the drive, including material the customer did not ask for and may not know is there. Deleted files, old versions, and content from earlier uses of the drive are all in it.
Why retention is not simply a failure to delete: holding the image for a defined period has a real purpose. If the delivered drive fails in transit, or something proves to be missing, the work does not have to be repeated — which for a difficult recovery may be the difference between a second attempt and none. So the honest answer is a period rather than zero.
What to agree in advance, and all of it is reasonable to ask: what copies are created, where they are held, for how long, who has access to them, how they are destroyed, and whether written confirmation of destruction is provided. Any competent provider will answer all six, and having them in writing before the device is sent is better than raising them afterwards.
Why written confirmation matters institutionally: an organisation holding personal information has to be able to account for where it went. A recovery is a transfer to a third party, and a record of what was held and when it was destroyed is what makes that accountable rather than merely intended.
What is worth adding about the delivery medium: the output drive is a copy of personal data leaving one organisation and arriving at another. How it travels and whether it is encrypted in transit are part of the same question, and encrypting the delivered output is straightforward and worth specifying.
Why raising it before sending is the whole point: terms agreed in advance are terms; terms raised afterwards are a request.
On the bench
Retention and destruction terms were agreed in writing before receipt — recovery producing a sector-level image of the source, working copies during reconstruction, and the delivered output, with the image constituting a complete copy including deleted and historic content the requester may not anticipate. Working copies were enumerated and their locations recorded, access restricted to those performing the work, and all copies destroyed on confirmation with written record supplied.
The outcome
Terms agreed in writing before receipt, copies enumerated and access restricted, and all copies destroyed on confirmation with a written record. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: a recovery multiplies the copies of your data before it reduces them — an image, working copies, and the output. For regulated material that is worth agreeing in writing before the device is sent.
Recovering data with protection obligations attached
Agree six things in writing before you send the device: what copies are created, where they're held, for how long, who has access, how they're destroyed, and whether you get written confirmation. Any competent provider will answer all of them. Understand that recovery duplicates before it delivers — a sector-level image of the source, working copies during reconstruction, and the output — and the image is a complete copy including deleted and historic content you may not know is there. Retention isn't simply a failure to delete, either: holding the image briefly means the work needn't be repeated if the delivered drive fails. Ask for a period, not zero.
Get the terms in writing first — call Easy Data Recovery on 028 9002 0144; retention and destruction agreed before receipt, copies enumerated and access restricted, written record of destruction supplied.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.