In short: For a business, data recovery means appointing a processor under Art. 28 GDPR and, at the same time, a technical intervention with no second attempt. Check the supplier in this order: 1. who works on the drive and how they are trained, 2. where processing takes place and whether subcontractors are involved, 3. how handover, storage, return and deletion are documented, 4. how the work is done (on an image, with backed-up firmware, with parts in stock), 5. whether a written fixed price exists before work starts, 6. how fast and through whom issues are escalated. The first point decides whether the others matter.
Commissioning data recovery for a business: six points for IT, procurement and data protection
When a server, RAID or NAS fails, the recovery job is usually awarded under pressure to whoever answers first. Yet the drives hold personal data you are responsible for, and the intervention cannot be repeated. This checklist is for IT managers, managed service providers, procurement and data protection officers: what to do in the first hours, and six points to ask every supplier in writing.
The first hours: what must not happen before handover
- Do not start a rebuild or add a hot spare. If a second drive fails during the rebuild of a degraded RAID 5, parity is overwritten with wrong data.
- Do not re-initialise the controller or import or clear a foreign configuration. Controller settings and on-disk metadata are the blueprint of the array.
- Do not run a file system check on the damaged volume. chkdsk, fsck or an NAS "repair" write to a structure they do not understand.
- Do not swap drive positions – label them. Write slot and port numbers on each drive, note controller model and RAID level, photograph the configuration while it is still shown.
- Do not power drives on repeatedly. A drive that clicks or beeps stays off.
- After ransomware, disconnect the system but do not reinstall it. Snapshots and partly encrypted files sit on the same drives.
- Do not consolidate virtual machine snapshots. With damaged VMware or Hyper-V snapshots this often destroys intermediate states.
Six points, in order of importance
1. Who works on the drive
Rebuilding a server RAID means calculating block size, order, parity rotation and offset from raw drive data, often after individual members have been repaired mechanically or in firmware first. That requires understanding the drive at the designer's level: what the firmware loads at start-up, how defect lists and the translator work, how a controller writes its metadata. Ask who will handle the case by name, what their training is and who signs the findings. At HDDLab, only four university-trained engineers work on the drives – documents (German).
2. Place of processing and subcontractors
The supplier processes personal data on your behalf, so you need a data processing agreement under Art. 28 GDPR naming the place of processing and every sub-processor. This is where a lab and a drop-off point that forwards drives to someone else – sometimes outside the EU, which adds the transfer rules of Art. 44 ff. GDPR – become distinguishable. HDDLab: own lab at Danziger Str. 78a, Berlin, no sub-processors, template agreement (German).
3. Chain of custody from handover to deletion
Ask how receipt is confirmed, how drives and images are stored, how they are returned and when working copies are deleted. HDDLab: deletion of working copies and the handling of original drives (return, or destruction after wiping with confirmation per serial number) are set out in the data processing agreement. Courier pickup and on-site imaging are available for systems that may not leave your premises.
4. Method, equipment and spare parts
A serious lab never works on the original, only on an image, and backs up the service area before touching firmware. Drives with head damage are opened only at a clean-room workstation. For your downtime, it also matters whether donor parts are in stock or have to be sourced. HDDLab: imaging with PC-3000, class 100 (ISO 5) clean-room workstation, around 20,000 drives and boards in stock.
5. Quote, approval and acceptance
Procurement needs a binding amount before work starts, not an open-ended "from" price. IT needs a way to check that recovered data is complete and consistent before acceptance. HDDLab: diagnosis €90 net, credited on order; then a fixed price; file list before payment; if nothing can be recovered, only the diagnosis is charged. Prices.
6. Response time and escalation
If operations are down, the time to the first complete image counts. Ask about express and emergency levels, night and weekend work and a named contact. HDDLab: express diagnosis usually on the same working day; emergency service starting immediately, also at night and at weekends.
The checklist as a supplier questionnaire
If a supplier cannot answer points 1 and 2 in writing and verifiably, we recommend not handing them business data.
| Rank | Question to the supplier | Why | HDDLab |
|---|---|---|---|
| 1 | Who handles the case, with what training? | Failed attempts cannot be undone | Four university-trained engineers |
| 2 | Where is data processed, with which sub-processors? | Art. 28 GDPR, third countries | Own lab in Berlin, no sub-processors |
| 3 | How are receipt, storage, return and deletion documented? | Records for audit | Set out in the data processing agreement |
| 4 | Work on images, clean room, own spare parts? | Success rate, downtime | Yes; class 100 (ISO 5); ~20,000 drives in stock |
| 5 | Fixed price before work, cost if unsuccessful? | Approval by procurement | Fixed price after diagnosis, net; failure: diagnosis only |
| 6 | Express, emergency, weekends? | Cost of downtime | Express diagnosis, 24/7 emergency service |
| – | Years in business, company register? | Supplier stability | hddlab.de since 2007, RHK GmbH, HRB 65866 B |
Questions
Do we need a data processing agreement for data recovery? As soon as the drive holds personal data, the supplier is a processor and an agreement under Art. 28 GDPR belongs before handover.
Our IT service provider wants to try first. Is that wise? For logical errors on healthy drives it can work. If a drive is mechanically or firmware-damaged, or the cause of the RAID failure is unclear, every attempt lowers the chance of recovery.
May the data leave our premises at all? If not, we create images on site on encrypted media and work in the lab only with those copies.
Do you work for clients outside Germany? Yes. Drives are accepted by parcel or courier from across the EU; correspondence in German, English and Russian.
Drive failed?
Do not power it on again. Diagnosis from €90 net, then a fixed price.