Home / Case Studies / Scanned, Repaired, and Emptied
Flash, Sticks and Cards · case file

Scanned, Repaired, and Emptied

A trader on Leicester Market keeps his stock lists, supplier prices and a couple of years of accounts on a USB stick, which is portable, cheap and precisely the wrong place for the only copy of anything. It had been unreliable since he bought it. Windows offered to scan and repair it, he accepted, and afterwards the spreadsheets opened as empty files and the documents would not open at all. The repair had done what it was designed to do and that turned out to be the problem.

USB FlashCorruption / Filesystem
// the job in four lines
MediaA USB flash drive that had been unreliable since it was bought, then scanned and repaired by Windows. Since the repair its spreadsheets open with no contents and its documents will not open.
What was reportedUSB stick, unreliable from new, scanned and repaired through Windows, spreadsheets now open empty, Word documents will not open at all, stock lists and two years of accounts wanted back.
Fault classLogical, and made worse by a repair rather than by the original fault. The check rewrote the volume's structure to make it internally consistent, which meant truncating files whose recorded lengths it could not reconcile and detaching others entirely. The contents themselves were still in the memory.
On the benchRead behind a hardware write blocker so that nothing further could be written to it; imaged read-only through a controlled reader, with the real capacity of the memory verified against what the stick reported; the current structure parsed in R-Studio from the image, then the earlier directory entries the repair had superseded recovered from the space they still occupied; files rebuilt from those where they survived and carved by content signature in PhotoRec where they did not; every spreadsheet and document opened before the set was written to fresh media.
// reading the fault

Reading the fault

A repair pass is not trying to save your files. Its purpose is to leave the volume in a state a computer can use without tripping over, and it achieves that by resolving contradictions. A file whose recorded length disagrees with the space allocated to it gets the length rewritten, which is why a spreadsheet can end up opening as an empty document. Nothing has been deleted; the index has simply been made to say something different.

The material stayed exactly where it was. The blocks the repair marked as free still held the contents, because marking is bookkeeping and does not erase anything. That is the reason this was recoverable at all, and it is also why the single most important thing the trader did was to stop using the stick immediately afterwards instead of copying his next stock list onto it.

Unreliable since new is a diagnosis in itself. A stick that has never been dependable usually has a weak controller or memory sold as more capacity than it holds, which is common at the cheap end and is designed to look fine until the point where the writing wraps around and starts destroying earlier files. Checking the real capacity against the claimed one is part of the assessment for exactly that reason, and it changes what can be promised.

Running the repair a second time is the reflex to avoid. When files come back damaged, the natural response is to run the check again in the hope of a better result. Each pass writes another set of conclusions over the evidence the last one left, and after two or three there is very little to reconstruct from. He ran it once and stopped, which is the reason there was a job here rather than a condolence.

// bench work

Bench work

The stick went behind a write blocker and was imaged read-only through a controlled reader. The memory read consistently and reported its real capacity honestly, which ruled out the worst version of unreliable since new and meant the fault was confined to what the repair had done.

R-Studio was pointed at the image rather than the stick. The structure the repair had written was intact and wrong; the entries it had superseded were still sitting in the space they had always occupied and were recovered from there, which gave back the original lengths and the original names. Where an entry had genuinely gone, the file was carved by content signature instead. Every spreadsheet was opened and its last rows checked, since a spreadsheet that opens is not the same as a spreadsheet that is complete.

// what went back

What went back

The accounts came back in full and so did the stock lists, with the exception of two documents that had been open at the time the stick first misbehaved and were incomplete before any repair ran. The trader was shown which two rather than being handed a folder and a total.

Sticks and cards are £250 + VAT. This was logical throughout, with nothing opened and no chip lifted, so it ran under no fix, no fee and was invoiced after he had opened the spreadsheets himself. The stick went in the bin with his agreement, which is where a stick that was unreliable from the day it was bought belongs.

When Windows offers to scan and repair

On a drive holding the only copy of something, decline it. The offer is well meant and it is aimed at making the volume usable again rather than at preserving what is on it, and the two are not the same objective. If you have already accepted it and files have come back empty or unopenable, stop there: do not run it again, do not copy anything onto the drive and do not let a recovery tool save its results back onto the same device, since all three write over the material that is still recoverable. The same applies to the equivalent tools on a Mac and to the repair option in most third-party utilities. A stick that has been unreliable since it was new is telling you something plainly, and the correct response is a second copy somewhere else rather than a repair. Post it in something rigid and say what you ran and when, because knowing how many passes it has had changes what can be expected.

Is this your drive as well? Every file on this page began with somebody describing a noise or a message, and the route in is the same each time. Nothing is charged for finding out what has happened. That examination finishes two working days after the parcel is logged in — never sooner, because rushing it is how evidence gets destroyed — and it ends in one number, written down, which does not move afterwards. Where a single drive is recoverable it is generally back with you two to four working days later. How you pay turns on which kind of fault it is, and the wording does not vary across this network: no fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. So a deletion, a broken file system, a lost partition, a firmware or service-area repair all keep the guarantee — nothing comes back, nothing is owed. Opening a drive under laminar flow, rebuilding a board, lifting a memory chip, or anything that arrived wet or burnt does not: half the agreed figure is taken before the work, and the balance only if your files come home. The published figures run: £250 + VAT for a memory card, a USB stick or a pen drive; £300 + VAT for any one hard drive or SSD, NVMe included; £400 + VAT for a recorder disk or a BitLocker volume; from £500 + VAT for an array, a NAS or a server; and £800 + VAT for a forensic investigation that ends in a written report. Five bands, all of them public, and the only one outside the guarantee is the forensic work. On packing: if the storage is screwed inside a laptop, a tower, a Mac or a server, take it out and send the bare unit, because dismantling equipment is not work this bench does. Three things go the other way and travel complete — an external drive in its own case, a NAS, and a WD My Passport or My Book with its cable, since on those the key sits on the bridge rather than the disk. A Fusion Mac needs both of its drives, labelled. A RAID or a server sends its member disks only, numbered by bay, with the front of the chassis photographed first. Flash soldered onto a mainboard, as on Apple Silicon Macs and many thin laptops, cannot be taken in at all, and neither can phones or tablets. Post it tracked and insured to Cambridge Data Recovery, Compass House, Vision Park, Chivers Way, Cambridge CB24 9AD, or put your own courier on it; the Cambridge reception takes devices across the counter too, Mon–Fri 9:00am–5:30pm. Nothing is collected, and there is no shopfront in the county to call at. Freephone 0800 689 0668. Packing notes and the shipping form live here.
Start a free diagnostic

Each of these is a real enquiry, taken from a household or a business somewhere in Leicester or the surrounding county, with the name of the customer, the firm and anything else that would identify them taken out. What is left is the reasoning: what turned up, what had actually failed inside it, the method that fault required and the equipment it was worked on. One of the thirty-six is a job that was refused, and it belongs here every bit as much as the successes do.

// nearby on the shelf

Three more files along the same lines

See every case file →

Is this your drive as well?

Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.