Almost every piece of advice on this site reduces to the same principle. Don’t run CHKDSK. Don’t let Disk Utility repair it. Don’t rebuild the array. Don’t format, don’t initialize, don’t take ownership across the whole volume.
They all come from one rule: make a complete copy first, then do everything else to the copy.
Worth explaining properly, because once it makes sense the rest stops being a list of prohibitions and becomes obvious.
What imaging actually is
A disk image is a sector-by-sector copy of the entire drive — not the files, the drive. Every sector from the first to the last, including the boot sector, the partition table, the file system metadata, and all the space marked “empty” that still contains deleted files.
Once you have it, that image behaves like the original drive for every purpose that matters. You can mount it, parse the file system, carve files out of unallocated space, run repair tools against it, and if a repair goes badly, make another copy of the image and try something else.
Two properties make it the foundation of everything:
The failing hardware is only used once. After imaging, the original drive goes on a shelf. Every subsequent operation happens against a healthy copy that can be read a thousand times without risk.
Every mistake becomes reversible. This is the real point. Working on the original, a wrong move is permanent. Working on an image, the worst case is that you copy the image again.
Why a file copy isn’t the same thing
Two important differences.
Copy tools stall on bad sectors. Drag a folder in Explorer, hit an unreadable sector, and the copy stops there — retrying, timing out, hammering the exact area that’s failing, while everything past that point stays uncopied. Come back an hour later to a dialog stuck at 4% and a drive in worse shape than it started.
Imaging software built for failing media does the opposite: it reads in large blocks at speed, skips over regions that stall, and comes back for the difficult areas afterward with the healthy 99% already captured. That ordering is the entire difference between recovering most of a drive and recovering the first fraction of it.
A file copy only copies files the file system knows about. Deleted files, orphaned data, and anything hidden behind a damaged index are invisible to it — which is exactly the data you’re usually trying to recover. A sector image captures all of it, because it doesn’t care what the file system thinks.
What “carefully” means
On a healthy drive, imaging is just a long copy. On a degrading one, how it’s done matters:
Multiple passes, increasing in aggressiveness. First pass grabs everything that reads easily. Later passes return to the skipped regions with more persistence. A weak sector that fails ten times sometimes succeeds on the eleventh.
Rest periods. Failing drives get worse when hot. Sometimes the right move is stopping for a few hours.
Reading in a sensible order. Metadata regions first, so that even a partial image can be interpreted.
Knowing when to stop. A drive with failing heads has a finite number of hours left. Spending them retrying a hundred bad sectors, instead of capturing the twenty gigabytes still unread, is a bad trade. This is the judgment call in the job.
The tooling here is mostly unglamorous — ddrescue and its relatives on the open-source side, plus hardware imagers that handle drives standard controllers give up on. The tool matters less than the sequencing.
Free evaluation. Firm quote before any work begins.
Why every warning follows from this
Reread the advice on this site with the rule in mind:
- Don’t run CHKDSK — it modifies the original, and discards what it can’t reconcile
- Don’t run
chkdsk /ron a degrading drive — full-surface reads on failing hardware, on the copy you can’t replace - Don’t rebuild the RAID — writes across the members before they’ve been imaged
- Don’t initialize or format — writes new structures over the ones recovery needs
- Don’t keep browsing a struggling drive — uses up reads that should have gone to imaging
- Don’t take ownership across a whole volume — millions of writes to hardware that’s failing
Every one of them is the same mistake: doing something irreversible to the only copy.
Can you do this yourself?
If the drive is mechanically healthy and you’re comfortable with a command line, yes. ddrescue is free, well documented, and the right tool. You’ll need a destination drive at least as large as the source.
Where I’d say don’t:
- The drive is making noise. Imaging takes hours, and a mechanically failing drive may not survive them. Those hours should be spent by someone who can tell when to stop.
- You’d be imaging to the same physical drive. Obvious once said, easy to do accidentally.
- It’s the only copy of something irreplaceable. The imaging itself is a risk on a degrading drive, and there’s one attempt.
The bottom line
Copy first, work on the copy. It’s the whole methodology, and every specific warning in data recovery is a special case of it. The mistakes that make drives unrecoverable are almost never the original failure — they’re the irreversible thing someone did to the only copy while trying to fix it.
Got a drive that needs imaging before anything else happens to it? Start a case — and if it’s healthy enough that you could do it yourself, I’ll tell you that instead.