Data Recovery Case File · Portable Drives · What the Other Machine Did

It Was Fine Until It Met the Work Laptop

Her enquiry contains a sequence rather than a symptom, and the sequence is worth examining. An external drive used happily with an older personal laptop: "I recently plugged the same drive into my newer work laptop and now neither machine recognises it. The blue light comes on and sometimes you can hear it start up and other times not. I have tried 3 different cables and different USB ports." She has eliminated the cables and the ports thoroughly. What she has not considered is that a managed work machine is not a neutral place to plug something in — though there is also a simpler explanation worth weighing.

The decode: the two explanations, and how to tell them apart

The first, and the one nobody considers: corporate machines are managed, and management software acts on removable media automatically. Depending on policy, connecting a personal drive to a work laptop can trigger a scan, an attempt to apply encryption, a block-and-quarantine, or a prompt that somebody dismisses without reading. Some of those write to the device. An interrupted attempt to apply encryption is particularly relevant here, because it leaves a volume with a protective header partly written — and a drive in that state stops being readable on the personal laptop that had no trouble with it before.

How to find out, and it costs nothing: ask the workplace IT team whether removable media policy applies to that machine, and whether any prompt appeared when the drive was connected. If encryption was applied even partially, the recovery key will have been escrowed to the organisation's systems automatically — which turns this from a recovery into a five-minute internal request.

The second explanation, and the one her own description supports: intermittent spin-up. Sometimes you can hear it start up and other times not is a mechanical or power observation, not a software one — and no management policy causes a drive to spin inconsistently. A drive that starts on some attempts and not others is failing to reach readiness reliably, which points at the mechanism, the motor, or a marginal power path.

Why both may be true: the timing is genuinely suspicious and the intermittency is genuinely mechanical. It is entirely possible that the drive was already marginal, and that plugging it into a machine which put it under sustained access — a policy scan reads a great deal — was simply the load that exposed it. That is the same pattern as a drive failing during a backup, and it means the work laptop may be the occasion rather than the cause.

Why her cable and port testing matters: three cables and multiple ports is a proper elimination and it rules out the cheap explanations on both machines. There is nothing further to establish there.

What not to do: not keep connecting it hoping for a good attempt, since each start is a demand on a mechanism that is not managing them reliably — and not accept any prompt to repair, initialise or encrypt if the drive does appear.

On the bench

Host-side intervention was established before assessment — specifically whether removable media policy applied to the managed machine and whether any encryption or scanning operation had run — since a partially applied policy leaves a volume unreadable on machines that previously had no difficulty with it, and any escrowed key would resolve the case internally. The drive was then assessed on a native connection with the readiness sequence read directly under strict timeouts, and imaged write-blocked on restored readiness, with no repair or initialisation attempted.

The outcome

The host-side question settled first, the drive assessed natively under strict timeouts and imaged on restored readiness. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose drive failed after meeting a work machine: managed computers act on removable media automatically, and a partly applied encryption or scan can leave a drive unreadable everywhere afterwards — worth asking IT, since any key would have been escrowed. But intermittent spin-up is mechanical, so the work laptop may be the occasion rather than the cause.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.