Home / Case Studies / Found the Files, Could Not Open Them
Macs and Apple Kit · case file

Found the Files, Could Not Open Them

A design studio in the Cultural Quarter lost a job folder the week a rebrand went to print: a shared drive tidied late in the day, the wrong directory emptied. They went to a recovery firm first, who reported that the material was all still there and then sent back a set of files that no application would open. They found them but we cannot use them, the studio director wrote, asking whether a second look was worth paying for.

Hard DriveMacDeleted / Formatted
// the job in four lines
MediaA hard drive used as shared studio storage on a Mac, from which a live job folder was erased. A previous recovery attempt located the material but returned it in a form that would not open.
What was reportedHard drive, artwork folder erased in error on a Mac, an earlier firm confirmed the files were present but could not hand them back openable, second opinion sought before the deadline.
Fault classLogical, and already half proved. Erasing a file removes its entry from the catalogue rather than its contents from the disk, so the material was intact. What the first attempt had produced were contiguous extractions of files that are not stored contiguously.
On the benchRead through a hardware write blocker so no further allocation could occur, imaged in one pass with the surface health checked first, catalogue and extent records recovered from the image in R-Studio and cross-read in UFS Explorer, each file rebuilt from its own fragment list rather than from a signature guess, samples opened in the applications that made them, and the set written to fresh media.
// reading the fault

Reading the fault

That another firm found the files settled the important question. If the material had been overwritten there would have been nothing to find, and there was. So the argument was never about whether the artwork survived; it was about the method used to lift it off, and methods differ far more than most people expect.

Signature carving reads a disk as one long ribbon. It looks for the few bytes that mark the beginning of a known format, then takes everything after it until the file looks long enough. On small files that works. On a layered artwork document or a video, which the operating system scatters across whatever space was free at the time, it produces a file with the correct beginning and a stranger's data in the middle, which is precisely a file that will not open.

The alternative is to ask the filesystem where the pieces went. When a file is erased, its record is marked reusable but frequently sits untouched for a long while, and that record still lists every fragment in order. Recovering the record first, and then following it, gives back the document rather than a plausible-looking impostor. It is slower and it is the difference between a result and a bill.

Where this does not work is worth saying plainly. On an internal SSD the operating system tells the controller to discard the blocks behind a deleted file, and once that has happened there is no record and no content to follow. This was a spinning disk used as a shared volume, so nothing had been discarded and the window was still open. Had it been the studio's internal storage, the honest answer would have been no.

// bench work

Bench work

The disk went behind a write blocker before anything read it, because the one genuine hazard left was the studio putting the volume back into service and letting new work land on the space the old work occupied. It profiled clean, held full speed and imaged in a single pass.

Working from the image, R-Studio recovered a large part of the catalogue, including records for most of the erased folder, and UFS Explorer was run over the same image as an independent reading. Each file was reassembled by following its own list of fragments. A handful whose records had been reused were carved by content signature and flagged as such rather than presented as equals. Samples from each format were opened in the software that had created them before anything was written to fresh media.

// what went back

What went back

The rebrand folder came back openable, layers and linked assets included, along with two earlier rounds of the same job that the studio had assumed were gone with it. The small number of carved files were returned separately with a note explaining why they might be incomplete.

One disk is £300 + VAT. Nothing was opened and nothing was lifted off a circuit, so no fix, no fee applied and the bill went out once the studio had confirmed the artwork opened.

When a recovery comes back unopenable

Ask what form the files will arrive in before you agree to a second attempt, because a report that says the data was found tells you very little on its own. Files extracted by content signature are guesses at where a document ended, and on large or layered work those guesses are wrong more often than they are right. In the meantime, stop writing to the volume: every new file saved onto it can land on the space the deleted one still occupies, and that is the one step that turns a recoverable job into a lost one. Do not run another scanning tool over it either, particularly one that offers to save its results back onto the same disk.

Is this your drive as well? Every file on this page began with somebody describing a noise or a message, and the route in is the same each time. Nothing is charged for finding out what has happened. That examination finishes two working days after the parcel is logged in — never sooner, because rushing it is how evidence gets destroyed — and it ends in one number, written down, which does not move afterwards. Where a single drive is recoverable it is generally back with you two to four working days later. How you pay turns on which kind of fault it is, and the wording does not vary across this network: no fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. So a deletion, a broken file system, a lost partition, a firmware or service-area repair all keep the guarantee — nothing comes back, nothing is owed. Opening a drive under laminar flow, rebuilding a board, lifting a memory chip, or anything that arrived wet or burnt does not: half the agreed figure is taken before the work, and the balance only if your files come home. The published figures run: £250 + VAT for a memory card, a USB stick or a pen drive; £300 + VAT for any one hard drive or SSD, NVMe included; £400 + VAT for a recorder disk or a BitLocker volume; from £500 + VAT for an array, a NAS or a server; and £800 + VAT for a forensic investigation that ends in a written report. Five bands, all of them public, and the only one outside the guarantee is the forensic work. On packing: if the storage is screwed inside a laptop, a tower, a Mac or a server, take it out and send the bare unit, because dismantling equipment is not work this bench does. Three things go the other way and travel complete — an external drive in its own case, a NAS, and a WD My Passport or My Book with its cable, since on those the key sits on the bridge rather than the disk. A Fusion Mac needs both of its drives, labelled. A RAID or a server sends its member disks only, numbered by bay, with the front of the chassis photographed first. Flash soldered onto a mainboard, as on Apple Silicon Macs and many thin laptops, cannot be taken in at all, and neither can phones or tablets. Post it tracked and insured to Cambridge Data Recovery, Compass House, Vision Park, Chivers Way, Cambridge CB24 9AD, or put your own courier on it; the Cambridge reception takes devices across the counter too, Mon–Fri 9:00am–5:30pm. Nothing is collected, and there is no shopfront in the county to call at. Freephone 0800 689 0668. Packing notes and the shipping form live here.
Start a free diagnostic

Each of these is a real enquiry, taken from a household or a business somewhere in Leicester or the surrounding county, with the name of the customer, the firm and anything else that would identify them taken out. What is left is the reasoning: what turned up, what had actually failed inside it, the method that fault required and the equipment it was worked on. One of the thirty-six is a job that was refused, and it belongs here every bit as much as the successes do.

// nearby on the shelf

Three more files along the same lines

See every case file →

Is this your drive as well?

Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.