York Data Recovery

York Data Recovery: The UK's Premier HDD & SSD Data Recovery Specialists

For 25 years, York Data Recovery has been the UK's leading expert in data resurrection from all storage media, with unparalleled specialisation in HDD (SATA, PATA) and SSD recovery. Our engineers possess a deep, forensic understanding of magnetic media, NAND flash memory, and the complex firmware that bridges the physical and logical worlds. We support every major manufacturer and interface, recovering data from the most catastrophic physical and logical failures for clients across all sectors. Our state-of-the-art lab, equipped with a comprehensive inventory of advanced tools and a Class 100 cleanroom, ensures the highest possible success rate. All cases begin with a free, no-obligation diagnostic.

A 25-Year Legacy of Storage Media Expertise A quarter-century in data recovery has given us an unparalleled archive of knowledge. We have navigated the entire evolution of storage, from the MFM and RLL coding of early drives to the sophisticated LDPC error correction and wear-leveling algorithms of modern TLC and QLC SSDs. This historical corpus includes proprietary firmware versions, common failure points across drive families, and manufacturer-specific recovery procedures. For SSDs, our experience is critical; we understand the transition from planar NAND to 3D NAND and the implications for chip-off recovery. This vast, accumulated knowledge allows us to bypass common pitfalls and implement proven, tailored recovery strategies that newer labs cannot match.

Comprehensive Manufacturer & Interface Support

We recover data from all storage devices, regardless of age, interface, or manufacturer.

Top 40 HDD/SSD Manufacturers & Popular Models:

1. Seagate HDD: Barracuda, IronWolf, Exos, SkyHawk

2. Western Digital (WD) HDD: Blue, Black, Red, Purple, Gold, Ultrastar

3. Toshiba HDD: P300, X300, N300, MG Series

4. Samsung SSD: 860/870 EVO, 970/980/990 PRO, 860/870 QVO

5. Hitachi (HGST) HDD: Ultrastar, Deskstar, Travelstar

6. Intel SSD: 665p, 670p, Optane, DC Series

7. SanDisk SSD: Ultra 3D, Extreme PRO, SSD Plus

8. Kingston SSD: KC Series, A400, NV2, UV Series

9. Crucial (Micron) SSD: MX500, BX500, P3, P5 Plus

10. ADATA SSD: SU800, XPG SX8200 Pro, Legend 960

11. Corsair SSD: MP600, Force Series, Neutron

12. Fujitsu HDD: MBA, MJA Series (now part of Toshiba)

13. PNY SSD: CS900, CS3030, XLR8

14. Sabrent SSD: Rocket 4.0, Rocket Q

15. TeamGroup SSD: T-Force Cardea, Vulcan, CX Series

16. LaCie (Seagate): Rugged, Porsche Design, 2big

17. Maxtor HDD: (Historical, now Seagate) DiamondMax, OneTouch

18. IBM HDD: (Historical, now Hitachi) Deskstar, Travelstar

19. Micron SSD: (OEM for Crucial) 1100, 1300, 2210

20. Plextor SSD: M8V, M9P

21. OCZ SSD: (Historical, now Toshiba) Vertex, ARC

22. Transcend SSD: SSD220, SSD230, MTE Series

23. Silicon Power SSD: A55, A80, P34A

24. WD_Black SSD: SN850X, SN770, AN1500

25. Seagate SSD: FireCuda, BarraCuda, IronWolf 125

26. Toshiba SSD: Kioxia (Brand) EXCERIA, XG Series

27. HP SSD: S700, FX900, Z Turbo

28. Dell SSD: (OEM) Ent NVMe, SATA Read Intensive

29. Lenovo SSD: (OEM) SL7, PM9A1

30. Apple SSD: Proprietary blades (A, B, C keys)

31. Inland SSD: (Microcenter) Platinum, Professional

32. Netac SSD: NV Series, S500

33. G.Skill SSD: Ripjaws, Phoenix

34. Mushkin SSD: Source, Reactor, Helix

35. Patriot SSD: P300, P210, Viper

36. Addlink SSD: S70, S90, H90

37. KingFast SSD: (Budget) SATA, NVMe

38. Lite-On SSD: (OEM) CV Series, PH Series

39. SuperMicro SSD: (Server) SATA, NVMe

40. Vaseky SSD: (Budget) SATA

Supported Interfaces:

• SATA (Serial ATA): SATA I (1.5 Gbps), SATA II (3.0 Gbps), SATA III (6.0 Gbps)

• PATA/IDE (Parallel ATA): ATA-1 to ATA-7, UDMA Modes

• SAS (Serial Attached SCSI): SAS-1 (3 Gbps), SAS-2 (6 Gbps), SAS-3 (12 Gbps), SAS-4 (22.5 Gbps)

• SCSI (Small Computer System Interface): Narrow, Wide, Ultra, Ultra320

• PCIe (Peripheral Component Interconnect Express): PCIe 3.0, 4.0, 5.0 (via add-in cards)

• NVMe (Non-Volatile Memory Express): Over PCIe and M.2 form factor

• M.2: Supporting SATA and NVMe protocols (Key B, Key M, B+M)

• U.2 (SFF-8639): Enterprise NVMe interface

• eSATA (external SATA)

• Legacy & Enterprise: Fibre Channel (FC), IEEE 1394 (FireWire), USB (1.0/2.0/3.0/3.1/3.2), Thunderbolt (1/2/3/4)

In-Depth Technical Recovery: Physical & Logical Failures

Our lab is equipped to handle the full spectrum of storage failures. Below is a forensic-level breakdown of common issues and the sophisticated recovery processes we employ.

Top 30 HDD Mechanical & Electronic Failures

1. Read/Write Head Stack Failure: The physical heads crash onto the platters, becoming damaged and contaminating the HDA.

   • Technical Recovery: In our Class 100 cleanroom, we perform a head stack assembly (HSA) transplant. This requires sourcing a donor HSA from an identical model drive (matching model number, FW revision, and sometimes DOM). The patient drive's platters are carefully cleaned to remove debris from the crash. The donor HSA is installed with precision alignment. The drive is then connected to a hardware imager (e.g., DeepSpar Disk Imager) to perform a slow, controlled read, handling bad sectors with custom read-head tuning to minimise stress on the donor heads.

2. Spindle Motor Seizure/Bearing Failure: The motor that spins the platters fails due to worn bearings or lubrication failure, preventing spin-up.

   • Technical Recovery: A full platter transplant is required. In the cleanroom, the platters are removed from the patient drive and transferred to an identical donor drive with a functioning motor and head stack. Extreme care is taken to maintain platter alignment using specialized alignment jigs and tools. The donor drive's adaptive parameters must often be modified to accommodate minor variations in the patient's platter stack.

3. Preamp Failure on Head Assembly: The preamplifier IC on the head arm, which amplifies the signal from the heads, fails.

   • Technical Recovery: The preamp is integrated into the head stack assembly. Recovery requires a full HSA transplant, as detailed above. Diagnosing a preamp failure involves measuring resistance across the head contacts and analysing the drive's error logs via a utility like PC-3000.

4. Firmware Corruption in Service Area (SA): Critical firmware modules stored on the platters' System Area become corrupted, preventing the drive from initialising.

   • Technical Recovery: We use a PC-3000 system to directly access the drive's SA in a utility mode. We diagnose the corrupted modules (e.g., the ROM overlay, translator, or zone configuration) by checksum verification. We then repair them by rewriting from a known-good firmware database or by manually rebuilding the modules using backups stored in other SA sectors. The translator module, which maps logical to physical addresses, is often the most critical to repair.

5. PCB (Printed Circuit Board) Failure: The drive's electronics are damaged by power surges, component failure (e.g., TVS diodes, motor driver IC), or physical trauma.

   • Technical Recovery: A simple board swap is insufficient due to adaptive data stored in the board's serial ROM. We perform a PCB transplant by de-soldering the 8-pin serial EEPROM from the patient PCB and transplanting it onto an identical donor PCB using hot-air rework stations. We then verify the donor PCB's compatibility and power the drive for imaging.

6. Bad Sectors & Media Degradation: The magnetic coating on the platters degrades, leading to unreadable sectors.

   • Technical Recovery: We use hardware imagers to perform a slow, sector-by-sector clone. The imager employs read-retry algorithms, adjusting read thresholds and timing to read marginal sectors. For persistent bad sectors, we may use the PC-3000 to disable the drive's internal error correction and attempt a raw read, applying our own software-based ECC afterwards.

7. Platter Scratching/Severe Media Damage: A head crash scores the platter surface, physically destroying data.

   • Technical Recovery: We image the drive, skipping over the physically damaged zones. For critical data in the damaged area, we may use magnetic force microscopy (MFM) services (a highly specialised and costly process) to attempt to read the magnetic remnants, though this is often not feasible for consumer recovery.

8. Stiction (Platters Adhered): The platters become stuck together due to lubricant breakdown or contamination, preventing spin-up.

   • Technical Recovery: In the cleanroom, we manually and gently separate the platters using specialised non-magnetic tools. The platters are then cleaned and transplanted to a donor drive.

9. Thermal Calibration Crash (TCC): The drive's internal thermal recalibration routine fails, causing the drive to reset repeatedly.

   • Technical Recovery: Using the PC-3000, we can often disable the TCC function or modify its parameters, allowing the drive to remain stable long enough to be imaged in a temperature-controlled environment.

10. Servo Wedge Damage: Damage to the servo information embedded between data sectors prevents the heads from positioning accurately.

    • Technical Recovery: This is a severe failure. We use the PC-3000 to attempt to regenerate the servo information or to work in a "logical" mode that bypasses the damaged servo, though this often results in partial data recovery.

11. Spindle Driver IC Burnout.

12. Voice Coil Motor (VCM) Failure.

13. ROM Corruption on the PCB.

14. Translator Module Corruption.

15. Adaptive Parameters Mismatch.

16. Head Degradation (Read Instability).

17. Write Function Failure.

18. SA Sectors Unreadable.

19. Multiple Head Stack Failure.

20. HDA Internal Contamination.

21. PCB Trace Damage.

22. Filter Clogging on HDA Breather Hole.

23. Lubricant Breakdown on Spindle.

24. Head Armature Deformation.

25. Platter Misalignment.

26. External Enclosure/Adapter Failure.

27. SATA/Power Connector Damage.

28. Water/Fire Damage to HDA.

29. Impact Damage (Shock).

30. Degaussing/Magnetic Damage.

Top 30 Software, Firmware & Logical Failures

1. Accidental Formatting/Partition Deletion: The file system metadata (e.g., MBR, GPT, $Boot for NTFS) is overwritten, but user data remains.

   • Technical Recovery: We perform a raw scan of the storage device using tools like R-Studio or UFS Explorer. These tools analyse the raw sectors for residual file system structures (e.g., NTFS $MFT records, EXT inode tables) and known file signatures (file carving). We then reconstruct the directory tree and file metadata to restore the original file names and hierarchy. The success rate is high if the area has not been overwritten by new data.

2. File System Corruption (e.g., NTFS $MFT, EXT Superblock): Critical file system structures are damaged, making the volume unmountable.

   • Technical Recovery: We work on a sector-level image of the drive. For NTFS, we attempt to repair the $MFT using its mirror copy or by extracting records directly from the journal ($LogFile). For EXT3/4, we use backup superblocks via dumpe2fs and e2fsck. For severe corruption, we bypass the file system entirely and use raw data carving techniques to extract files based on their headers and footers.

3. Virus/Ransomware Encryption: Data is encrypted by malware, rendering it inaccessible.

   • Technical Recovery: We first attempt to identify the ransomware variant. If a decryption tool exists (e.g., from No More Ransom), we apply it. If not, we search for unencrypted shadow copies (VSS), temporary files, or backup $MFT entries that may contain pre-infection file information. For some types of ransomware that only encrypt headers, file carving can be effective.

4. SSD Controller Failure (Bricked Drive): The SSD's main processor fails or its firmware enters a fatal error state, making the NAND flash inaccessible via standard interfaces.

   • Technical Recovery: This requires a NAND chip-off procedure. We desolder the NAND flash memory chips from the SSD's PCB using a hot-air rework station. Each chip is then read individually using a dedicated NAND reader (e.g., via PC-3000 SSD) to create a binary dump. The complex process of "reassembly" then begins, where we use specialised software to analyse the dumps, reverse-engineer the controller's firmware algorithm (including page layout, block management, and wear-leveling), and virtually reconstruct the user data area.

5. FTL (Flash Translation Layer) Corruption: The SSD's internal mapping table, which correlates logical addresses (LBAs) to physical NAND pages, becomes corrupted.

   • Technical Recovery: We use the PC-3000 SSD to access the drive's service mode. We attempt to extract and repair the FTL metadata from the drive's reserved areas. If this fails, we may perform a "physical-to-logical" reconstruction by scanning the physical NAND pages (after a chip-off, if necessary) and building a new translation table by analysing data and metadata within each page.

6. SSD NAND Wear & Read Disturb Errors: As NAND cells age, the charge threshold for reading data becomes ambiguous, leading to uncorrectable errors.

   • Technical Recovery: We use hardware tools to apply read-retry techniques at a physical level. This involves repeatedly reading the problematic NAND page with slightly adjusted read reference voltages, attempting to find a "sweet spot" where the raw bit error rate is low enough for our software ECC to correct. This process is time-consuming and requires deep knowledge of NAND physics.

7. TRIM/UNMAP Command Data Wipe: The OS has instructed the SSD that certain data blocks are no longer needed, and the SSD may have erased them internally.

   • Technical Recovery: Recovery is time-sensitive. We immediately create a physical image. On some SSDs, data persists for a short time after a TRIM command before the garbage collection routine erases it. We use tools to scour the physical NAND for these "lingering" pages. Once garbage collection has run, the data is typically unrecoverable.

8. Failed Firmware Update: A power loss or system crash during a firmware update corrupts the drive's operational code.

   • Technical Recovery: For HDDs, we use the PC-3000 to force the drive into a boot mode and manually re-flash the firmware using a known-good version from our extensive database. For SSDs, the process is similar but often requires vendor-specific commands to access the bootloader.

9. User Password Lock (ATA Security): The drive is locked with a user-set password, denying access.

   • Technical Recovery: We use specialised hardware/software combinations (like PC-3000) to perform a "Security Erase" or "Master Password" unlock, which complies with the ATA security protocol to clear the password without data loss, provided the drive is functionally healthy.

10. RAID Configuration Loss.

11. Database Corruption (SQL, PST, etc.).

12. CCTV DVR Proprietary Format & Overwrite.

13. Bad Block Management Overload.

14. S.M.A.R.T. Bypass Required.

15. Bootloader Corruption.

16. Complex Partition Table Damage.

17. Encrypted Volume (BitLocker, FileVault) Key Loss.

18. Deleted Files with Overwritten Metadata.

19. Operating System Crash & Inaccessible Boot Volume.

20. Accidental dd or Diskpart Clean Command.

21. Dynamic Disk Database Corruption.

22. Software RAID (mdadm, Storage Spaces) Member Failure.

23. ZFS/ReFS/Btrfs Pool Corruption.

24. APFS Container Superblock Corruption.

25. HFS+ Catalog File Corruption.

26. exFAT FAT & Cluster Heap Corruption.

27. XFS Allocation Group Corruption.

28. Logical Bad Blocks in Critical Metadata Area.

29. Journaling File System Replay Failure.

30. Unsupported or Obsolete File Systems (e.g., HPFS, JFS1).

Why Choose York Data Recovery?

• 25 Years of Forensic Expertise: Our knowledge base, built over a quarter-century, is your greatest asset in recovering lost data.

• Multi-Vendor, Multi-Technology Mastery: From legacy PATA drives to cutting-edge NVMe Gen5 SSDs, we have the tools and the know-how.

• Advanced Tooling: We invest in the best infrastructure to ensure physical recoveries are performed under optimal conditions.

• Free, Transparent Diagnostics: We provide a clear, detailed report and a no-obligation quote before any work begins.