Case file · Logical & corruption · MHD-2025-7117
I Deleted Them, Then Stopped.
Ahead of a client visit, a bookkeeper in Boyn Hill was clearing space on his stick. The wrong folder went into the bin, he accepted the prompt to empty it, and twelve months of work came out with it: the sales ledger, the purchase invoices, and four quarters of VAT. It dawned on me at the traffic lights
, he said, and those accounts only exist on that stick
. What he did next was important. The stick never met a socket again: it went in his glove box, and then he called us.
Much the same fault? Call us.
0800 6890668
In everyday terms.
The key factor that saved this recovery effort was a decision made within thirty seconds, before anybody even understood the issue. Deleting a file does not erase data; deleting a file merely removes the file from the list of files in that particular volume. When you delete a file, the volume's index (the place where the volume keeps track of all of its files) changes the status of the clusters behind it from being assigned to a file, back to being unassigned and available. However, the data itself remains there undisturbed until a later write (such as saving another file) claims that area of the flash media. A glovebox provides zero opportunity for any such write to occur. Additionally, flash devices carry an additional risk due to their internal controllers. Once a flash device is powered up, that controller may begin to consolidate blocks it now considers to be unused, without anything asking it to. So long as the flash device is kept away from every socket, not just preventing saves to the device, this type of risk can be avoided.
What the bench used here.
How a job is handled →| Tool | Why we used it | What it brings |
|---|---|---|
| PC-3000 Flash | Took a full read of the NAND without granting the controller time to tidy | Reads the NAND chips directly, matched against a maker-ID library that is kept up to date |
| R-Studio Technician | Restored the withdrawn FAT32 directory records together with their cluster chains | Its file-system coverage is wide and its array rebuilds hold up |
| UFS Explorer Professional Recovery | Crossed the recovered tree again under unrelated code, then read inside each document | Reads the awkward filesystems others stumble over: APFS, ReFS, XFS, ZFS, Btrfs |
The lab work.
The stick is read once and then set aside
Our only request to the stick was to perform a single sector-level scan to create a working image, and to use that image exclusively going forward. Recovery software pointed at the original flash has to power the device before it can read anything, and that alone may set the controller tidying up. With a working image created, the risk of the controller cleaning up the flash media is eliminated.
The directory survived, so we used it
Since the bin was emptied, no new data had been written to the stick. Therefore, the removed entries were all still present in the directory table, complete with names, timestamps and cluster chains. As such, recovering through these entries would restore the folder in its original configuration, the way its owner remembers it. In this case, carving based upon file signatures was never necessary. Using file signature-based carving simply strips the recovered files of names, dates and all structural information and leaves only the raw bytes.
It only counts once the figures reconcile
We opened and read through each of the invoices, each of the ledger exports and all four of the VAT returns. A document can take up the exact amount of space (bytes) that it should, and still be rubbish inside, so the file size alone settles nothing. None of them was corrupt. All of these documents read as though the deletion had never happened.
How the job closed.
Everything was recovered: the names, the folder structures, the dates and the chronological order in which the work was completed. That quarter's VAT return was filed with days to spare. There isn't anything special or creative going on here, which makes this case an excellent example of how important it is to make the right decision quickly (here, in the first half-minute) and then follow proper procedure for the rest.
More of the jobs we've closed.
Also on the Logical & corruption shelf.
Does any of that match your case?
Until you receive your diagnosis, don't decide anything: turn off the device, get a quote, then send it in, and allow the results of the diagnosis to determine what happens next.