Case file · Logical & corruption · MHD-2025-7117
I Deleted Them, Then Stopped.
A bookkeeper in Boyn Hill was clearing space on the stick ahead of a client visit. The wrong folder went into the bin, the prompt to empty it was accepted, and twelve months followed it out: the sales ledger, the purchase invoices, four quarters of VAT. It dawned on me at the traffic lights
, he said, and those accounts only exist on that stick
. What he did next is what mattered. The stick met no socket again — glovebox, then a call to us.
Much the same fault? Call us.
0800 6890668
In everyday terms.
What rescued this job was a decision taken inside half a minute, before anyone grasped the problem. Removing a file scrubs nothing: the volume's index withdraws the name and reclassifies the clusters behind it as available, while the bytes lie undisturbed until a later write claims that ground. A glovebox guarantees no such write. Flash carries a second hazard, because a memory stick has a controller of its own, and once powered that controller may start consolidating blocks it now regards as free, with nothing asking it to. Restraint on flash means keeping the stick away from every socket, not just refusing to save to it.
What the bench used here.
How a job is handled →| Tool | Why we used it | What it brings |
|---|---|---|
| PC-3000 Flash | Took a full read of the NAND without granting the controller time to tidy | Reads the NAND chips directly, matched against a maker-ID library that is kept up to date |
| R-Studio Technician | Restored the withdrawn FAT32 directory records together with their cluster chains | Its file-system coverage is wide and its array rebuilds hold up |
| UFS Explorer Professional Recovery | Crossed the recovered tree again under unrelated code, then read inside each document | Reads the awkward filesystems others stumble over: APFS, ReFS, XFS, ZFS, Btrfs |
The lab work.
The stick is read once and then set aside
Only one demand was made of the stick: a single sector-level sweep to produce a working image, and every step after that used the copy instead. Recovery software pointed at original flash has to power the device before it can read anything, which is itself what may set the controller tidying. Once the image exists, that hazard is out of play.
The directory survived, so we used it
No write had reached the stick after the bin was emptied, so the removed entries were all still present in the directory table, names and timestamps and cluster chains intact. Recovering through them returns the folder in the shape its owner remembers. Carving by file signature was never needed here; it yields the same bytes stripped of names, dates and any structure at all.
It only counts once the figures reconcile
Every invoice, every ledger export and all four VAT returns were opened and read through. A document can occupy exactly the number of bytes it ought to and still be rubbish inside, so file size settles nothing. None was corrupt. The books read as though the deletion had never happened.
How the job closed.
Everything returned: the names, the folder structure, the dates, the order the work was done in. That quarter's VAT return was filed with days in hand. Nothing ingenious appears in this case, which is rather its lesson — the right call was made in the first half-minute, and the rest was procedure.
More of the jobs we've closed.
Also on the Logical & corruption shelf.
Does any of that match your case?
Nothing needs deciding until the diagnosis is back: switch the device off, send it in, and let the findings settle it.