Deleted files & corruption · bench log · NTG-2025-2267
I Emptied the Bin, and Then Touched Nothing.
The realisation arrived at a set of lights on the way over to a client. Before setting off, a Hinckley bookkeeper had tidied the memory stick up. One folder too many went into the rubbish, and the box that asks if you are sure got clicked straight through. Four VAT returns went with it, every purchase invoice, a whole year of ledgers. Not one page of it exists anywhere else
, he said. Then came the sentence that decided the job: nothing has been plugged into it since, not even once
. Glovebox, then the telephone.
Yours doing the same? Say what it is up to — looking is free.
0115 8220606
What went wrong, and why.
Deleting scrubs nothing away. Out goes the filename from the index, the clusters behind it are marked as reusable, and every byte remains until something fresh gets written over it. On a mechanical disk that is the whole explanation. Flash puts a second mechanism above it: a controller which, given power, may take itself off and erase blocks it has decided are spare. Nobody is asked and nothing is announced. So leaving flash alone is a bigger instruction than simply not saving to it: no socket at all, anywhere, ever again. Thirty seconds decided this case, long before anybody diagnosed a thing.
The bench work this one took.
How the work runs →| Kit on the bench | What it did on this job | Why we reach for it |
|---|---|---|
| PC-3000 Flash | One complete read, taken before the controller had the chance to tidy up | Reads the flash at chip level, bypassing the controller, matched to a maker-ID library we keep current |
| R-Studio Technician | Put the released FAT32 records back, then followed the cluster chains they point at | Rebuilds an array off the images, and reads almost any file system |
| UFS Explorer Professional Recovery | Ran a second tool over the rebuilt tree to confirm it, then read each document out of the image | Reads APFS, ReFS, XFS, ZFS and Btrfs where other tools give up |
What happened on the bench.
Read the original once, then hands off
A single task went to the stick: one complete sector-by-sector read, producing an image. From then on the work happened on the copy. The awkward thing about flash that still powers up is that no recovery tool can read a byte until the device is awake, and waking it is what starts the controller tidying. With an image already on the shelf, that risk disappears.
The deleted entries were still where they had been
Emptying the bin, then leaving the stick in a glovebox, meant the directory table still carried every deleted record whole: name, timestamp, cluster chain, the lot. Follow those and a folder comes back looking the way its owner remembers it. Signature carving hands back the same bytes without a name, a date or a shape attached to any of them, and this job never called for that.
Nothing leaves until it opens
Every one of the four returns was read through, first page to last, and the invoices and ledger exports with them. A byte count settles nothing on its own: a file may be exactly the right size and still be nonsense inside. Damage appeared in none of them. The books read exactly as they had read that morning.
What was returned.
Back came the names, the folders, the timestamps, and the working sequence itself. That quarter went in on time. Cleverness had no part in this job, which is roughly why it appears here: thirty seconds of restraint settled it, and anybody at all can make that decision. The rest was routine.
Start here if the same thing is happening to yours.
Other jobs about missing files and unreadable volumes.
Sounds like yours? Switch it off before anything else.
£250 + VAT covers a card or a USB stick; a single drive is £300 + VAT; RAID and NAS start from £500 + VAT. Nothing is charged for the first look, and a fixed figure reaches you in writing before any chargeable work begins. Switch the device off, leave it alone, and post it in. On most jobs, no data back means no fee.