A retail unit at Birstall keeps its product photography, supplier invoices and price lists on a 1TB external drive. Tidying it up one evening, the owner found what looked like two copies of the same folder tree and deleted one of them, which turned out to be the only set rather than the spare. He noticed within the hour, unplugged the drive, and did not touch it again. Somebody had told him the files would still be there. That somebody was right, and the reason is entirely down to what he did next.
| Media | A 1TB external drive in daily use by a small retail business, from which a working folder was deleted in the belief that it was a duplicate. The drive has not been connected since. |
| What was reported | External 1TB drive, a folder deleted in the belief it was a duplicate copy, it was in fact the only set, nothing done to the drive since, product photography and supplier documents wanted back. |
| Fault class | Logical, and caught at the best possible moment. Deletion removes a file's entry from the index and marks its space available; it does not remove the contents. With nothing written to the drive afterwards, that space had not been reused and the records describing it were largely intact. |
| On the bench | Read behind a hardware write blocker so that no operating system could allocate anything on it; surface health confirmed before imaging; imaged in a single pass with the original set aside afterwards; the deleted records recovered from the image in R-Studio and each file rebuilt by following its own fragment list; the small number whose records had been reused carved by content signature and flagged separately; everything opened in the software that created it and written to fresh media. |
Deleting removes the address, not the contents. A filesystem is an index and a large area of space. Deleting a file crosses out the index entry and marks the space it occupied as available for the next thing that needs it. The material stays exactly where it was written until something else is put on top of it, which is why a deletion noticed quickly is one of the most recoverable events there is.
Unplugging it was worth more than any software he could have bought. The one thing that destroys deleted material is new material landing on it, and a drive in use writes constantly without being asked: thumbnails, indexes, temporary files, the operating system's own housekeeping. Every hour a drive stays in service after a deletion is a chance for something to be written into the space in question. He removed that risk entirely within an hour.
Following the record beats guessing at the shape. Because the drive had been left alone, most of the deleted entries survived, and each one still listed the fragments its file was written across. Rebuilding from that list gives back the document as it was. The alternative, when the record has gone, is to find the start of a file by its signature and estimate where it ended, which works acceptably on small photographs and poorly on anything large or layered.
The same story on an internal SSD would have ended differently. Solid-state storage in a machine is told to discard the blocks behind a deleted file, and once the controller has acted on that instruction there is nothing left to follow and nothing left to carve. It is worth saying plainly, because the advice for a spinning external drive and the advice for the disk inside a laptop are the same advice with two different outcomes.
The drive went behind a write blocker before it was connected to anything, which meant it could not be mounted, indexed or written to by an operating system that thought it was helping. It profiled healthy and imaged in one pass, after which the original was set aside and every subsequent step happened on the copy.
R-Studio recovered the deleted records out of the image, and the great majority of the folder came back with its structure and its file names intact rather than as a list of numbers. Around forty files had lost their records and were carved by signature instead; those were checked individually and the ones that opened correctly were kept apart from the ones that did not.
The product photography came back complete, along with the invoices and the price lists, which mattered more to the owner than he had expected because a supplier had queried an old figure the same week. The forty carved files were returned in their own folder with an explanation, and about thirty of those opened normally.
One disk is £300 + VAT. This was logical from beginning to end, with nothing opened and no circuit touched, so it ran under no fix, no fee and the invoice followed the files rather than preceding them.
Stop using the drive that moment, and if it is an external one, unplug it. Do not copy anything off it first, do not empty or examine the recycle bin, and do not install a recovery program onto the drive you are trying to recover from, which is a surprisingly common way of overwriting the very files being looked for. If you do run something yourself, run it from a different disk and never let it save its output back onto the source. On a machine's internal drive the calculation is different and more urgent: shut the computer down rather than leaving it idling, because idle machines write more than people think. Then send it. The examination is free, closes two working days after the drive is booked in, and tells you what proportion is still there before you commit to anything.
Each of these is a real enquiry, taken from a household or a business somewhere in Leicester or the surrounding county, with the name of the customer, the firm and anything else that would identify them taken out. What is left is the reasoning: what turned up, what had actually failed inside it, the method that fault required and the equipment it was worked on. One of the thirty-six is a job that was refused, and it belongs here every bit as much as the successes do.
The format prompt is what a computer offers when it has run out of ways to read a volume
A repair pass keeps the files and throws away the arrangement, which is the part people miss
When every machine fails in the same way, the machines have already been ruled out
Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.