Recover files from an unrecognised external hard drive in 2026

Identify the nature of the problem (5 minutes)

Before installing any recovery software, initial diagnosis conditions everything else. Three major failure categories with opposite strategies:

Mechanical failure (abnormal sounds)

Repetitive clicking, continuous scraping, irregular humming that stops → the drive has a physical problem: head crashing into platters, tired motor, damaged PCB controller. Unplug immediately and don't insist. Every additional attempt worsens damage. For valuable files (>$500), go straight to a cleanroom professional (Ontrack, DriveSavers, Secure Data Recovery) — plan $800 to $2,500 depending on severity, 75-90% success rate on quickly-diagnosed mechanical failures.

PCB controller or power failure

Silent drive when plugged in, LED off, no system detection → external electronics failure. Try another USB cable and another enclosure (if drive is removable 2.5″ or 3.5″). The USB-to-SATA enclosure is often the real culprit, not the disk itself. Cost of a new enclosure: $12 to $30. Also check external power (for 3.5″) — a failing transformer can show the same symptoms as a disk failure.

Logical corruption (the most common case)

Disk detected, normal sound, but Windows offers to format OR the filesystem appears as RAW or unrecognised → allocation table corruption (MFT for NTFS, FAT for FAT32/exFAT). It's the most common and most recoverable case. Underlying data is almost always intact — only the index pointing to it is broken. This is where TestDisk + EaseUS + PhotoRec operate.

Don't format, don't panic

The most dangerous reflex when Windows shows "You need to format the disk in drive X: before you can use it" is to accept. Never accept. Formatting overwrites the allocation table and seriously complicates later recovery: you go from an easy case (table reconstruction) to a hard case (complete carving without names or directory tree).

Correct sequence:

1. Click Cancel on the pop-up
2. Eject cleanly (right-click > Eject or Safely Remove Hardware)
3. Plug into another PC, ideally Linux (kernel more permissive on corrupted partitions)
4. Start a recovery session with TestDisk or EaseUS

The golden rule: image the disk first

For any case where files have value, the first operation is to clone the disk bit-by-bit. This lets you work on a COPY and try multiple approaches without risk of degrading the source disk.

On Linux, the reference command is ddrescue (GNU dd_rescue) in two passes:

sudo ddrescue -d -f -n -b 4096 /dev/sdX /path/image.bin /path/image.log
sudo ddrescue -d -f -r 3 -b 512 /dev/sdX /path/image.bin /path/image.log

The first pass quickly reads healthy areas in 4 KB blocks, immediately skipping difficult areas. The second pass returns to difficult areas in 512-byte blocks with 3 retries. The logbook (image.log) lets you resume if interrupted.

To automate this cleanly, see our ddrescue-safe.sh wrapper with safety rails (refuses to write to source disk, explicit confirmation before clone, integrity hash verification).

Free TestDisk vs paid EaseUS

For recovery from disk image (or directly from source in read-only mode if you didn't take time to image), two tool families:

TestDisk (free, open-source CGSecurity) remains unbeatable for partition table and boot sector corruptions — its historical specialty since 2003. Command-line interface but usable by a patient beginner with some reading. For file carving (signature analysis without table), it's PhotoRec, its companion tool — but PhotoRec loses filenames and directory tree (all recovered files go to recup_dir.1, recup_dir.2 folders with numeric names).

EaseUS Data Recovery Wizard (Pro edition $49-69 on annual commitment, free limited to 2 GB) offers a modern GUI, does both table reconstruction AND carving in one pass with name preservation when possible, handles BitLocker-encrypted drives well, and offers preview mode before purchase. For 90% of consumer cases, EaseUS delivers equivalent or better result in half the time vs TestDisk + PhotoRec combo, especially for non-technical users.

For a Linux sysadmin comfortable with command-line, TestDisk + PhotoRec cover the same cases for free, with better flexibility on LUKS-encrypted disks and LVM partitions.

Destination strategy and backup

Classic mistake: recovering files to the same disk being recovered. This potentially overwrites still-recoverable data. Always point destination to a distinct disk — a second external drive, network share, or directly to cloud.

Once recovery succeeds, the second reflex is to set up a backup strategy to prevent recurrence. The reference rule is 3-2-1:

• 3 copies of data (original + 2 backups)
• 2 different media (local disk + cloud, or local disk + NAS)
• 1 offsite (encrypted cloud or disk at a relative's, safe from local fire or burglary)