Recover files from an unrecognised external hard drive in 2026

Identify the nature of the problem (5 minutes)

Before you install any recovery software, the first diagnosis drives everything else. There are three main failure types, and each one needs an opposite strategy:

Mechanical failure (abnormal sounds)

Repeated clicking, steady scraping, or an uneven hum that stops → the drive has a physical problem: head crashing into platters, tired motor, damaged PCB controller. Unplug immediately and don't push on. Every extra attempt makes the damage worse. For valuable files (>$500), go straight to a cleanroom pro (Ontrack, DriveSavers, Secure Data Recovery). Plan $800 to $2,500 based on how bad it is. The success rate is 75-90% on mechanical failures caught early.

PCB controller or power failure

Silent drive when plugged in, LED off, no system detection → external electronics failure. Try another USB cable and another enclosure (if the drive is a removable 2.5″ or 3.5″). The USB-to-SATA enclosure is often the real culprit, not the disk itself. A new enclosure costs $12 to $30. Also check the external power (for 3.5″). A failing transformer can show the same signs as a disk failure.

Logical corruption (the most common case)

Disk detected, normal sound, but Windows offers to format OR the filesystem shows up as RAW or unrecognised → allocation table corruption (MFT for NTFS, FAT for FAT32/exFAT). This is the most common case, and the easiest to recover. The data under it is almost always intact. Only the index that points to it is broken. This is where TestDisk + EaseUS + PhotoRec come in.

Don't format, don't panic

The worst move when Windows shows "You need to format the disk in drive X: before you can use it" is to accept. Never accept. Formatting writes over the allocation table and makes later recovery much harder. You go from an easy case (rebuilding the table) to a hard one (full carving with no names or folder tree).

Correct sequence:

1. Click Cancel on the pop-up
2. Eject cleanly (right-click > Eject or Safely Remove Hardware)
3. Plug into another PC, ideally Linux (its kernel is more forgiving on corrupted partitions)
4. Start a recovery session with TestDisk or EaseUS

The golden rule: image the disk first

For any case where files have value, the first step is to clone the disk bit-by-bit. This lets you work on a COPY and try several methods with no risk to the source disk.

On Linux, the reference command is ddrescue (GNU dd_rescue) in two passes:

sudo ddrescue -d -f -n -b 4096 /dev/sdX /path/image.bin /path/image.log
sudo ddrescue -d -f -r 3 -b 512 /dev/sdX /path/image.bin /path/image.log

The first pass quickly reads healthy areas in 4 KB blocks and skips the hard areas right away. The second pass goes back to the hard areas in 512-byte blocks with 3 retries. The logbook (image.log) lets you resume if it stops.

To automate this cleanly, see our ddrescue-safe.sh wrapper with safety rails. It refuses to write to the source disk, asks you to confirm before the clone, and checks the integrity hash.

Free TestDisk vs paid EaseUS

For recovery from a disk image (or straight from the source in read-only mode if you didn't take the time to image), there are two tool families:

TestDisk (free, open-source CGSecurity) is still the best tool for partition table and boot sector corruptions - its strength since 2003. It uses a command-line interface, but a patient beginner can use it with some reading. For file carving (signature analysis with no table), the tool is PhotoRec, its companion. But PhotoRec loses filenames and the folder tree (all recovered files go to recup_dir.1, recup_dir.2 folders with numeric names).

EaseUS Data Recovery Wizard (Pro edition $49-69 on an annual plan, free limited to 2 GB) offers a modern GUI. It rebuilds the table AND carves in one pass, and keeps names when it can. It handles BitLocker-encrypted drives well, and shows a preview before you buy. For 90% of consumer cases, EaseUS gives an equal or better result in half the time vs the TestDisk + PhotoRec combo, above all for non-technical users.

For a Linux sysadmin at ease with the command line, TestDisk + PhotoRec cover the same cases for free, with more room to move on LUKS-encrypted disks and LVM partitions.

Destination strategy and backup

Classic mistake: recovering files to the same disk you're recovering. This can write over data you could still save. Always point the destination to a separate disk - a second external drive, a network share, or straight to the cloud.

Once recovery works, the next move is to set up a backup plan so it doesn't happen again. The go-to rule is 3-2-1:

• 3 copies of data (original + 2 backups)
• 2 different media (local disk + cloud, or local disk + NAS)
• 1 offsite (encrypted cloud or disk at a relative's, safe from local fire or burglary)