Used to pull every drive before touching a machine, now I image it first and it saved me a $400 job last Tuesday
For a long time my routine on any repair ticket was pull the drive, slap it in the dock, and start scanning right away. That was fine until I got a Dell laptop in last Tuesday from a guy who runs his own print shop, and his whole business was on that single drive. I plugged it into my dock like always and it started clicking, and I felt my stomach drop because I had already handled it before making a copy. Now I boot off a cheap write blocker and clone the drive first, every single time, even when the client says it doesn't matter. The clone took about 45 minutes on that drive, and the original quit for good two days later, so the copy was all we had left. What got me here was a $400 recovery bill I ate myself on a machine six months back, because I poked around on the only copy that existed. Just last week the same thing almost happened again and the clone saved the job. Does anyone else keep a strict rule about copying before you even look, or do you just go straight in when the drive still spins?
Man, that gut drop feeling when you hear clicking is the worst, been there. My rule is simple: if the data matters at all, clone first, and if the drive is already making noise I stop and send it to a pro instead of spinning it more. Write blockers are cheap, losing a client's whole business is not, so I just treat every drive like it's the only copy left.