Logical & corruption · case file · MHD-2025-6932
The Names Are There; the Files Say 0 Bytes.
Waiting on the stick were a portfolio and two assignments. It had been unplugged in Bracknell the previous afternoon — I pulled it out while it was still saving
— and by morning every name was there, every size read 0 bytes
, and the type column had gone blank, calling each one a plain File
. Her ward mentor’s stop clicking and let someone look at it
came after several hopeful tries.
Much the same fault? Call us.
0800 6890668
In everyday terms.
On a FAT volume the index and the contents live apart. One small table records each file’s name, attributes, size and first cluster; the bytes themselves lie further along the chip and know nothing of that table. Cut the power while an entry is being updated and the record is left half finished, its size field zeroed and its type field empty, although not one cluster of her coursework has moved. Windows then reports what the table tells it, faithfully, which is how a folder that is entirely full comes to be described as containing nothing.
What the bench used here.
How a job is handled →| Tool | Why we used it | What it brings |
|---|---|---|
| PC-3000 Flash | Took a complete low-level image of the chip, ignoring every claim the filesystem made | Reads the NAND chips directly, matched against a maker-ID library that is kept up to date |
| R-Studio Technician | Reassembled the damaged records against the second allocation table FAT keeps | Its file-system coverage is wide and its array rebuilds hold up |
| UFS Explorer Professional Recovery | Header-signature carving for records that could not be mended | Reads the awkward filesystems others stumble over: APFS, ReFS, XFS, ZFS, Btrfs |
The lab work.
Secure a full copy before anything else is attempted
A flash controller housekeeps on its own initiative whenever the stick is powered, with no notion of which clusters a recovery still needs. The opening move was therefore a plain sector-by-sector read onto bench storage. With that fixed copy in hand, nothing tried afterwards could take a file away from her.
Rebuild from the healthier of the two tables
FAT keeps its allocation table in duplicate, and the interrupted write had damaged one copy more than the other. Wherever the sounder copy agreed with a surviving directory entry, the record could be restored entire: name, length and cluster chain in one piece. A file returned that way is the file itself, not an approximation of it.
The remainder had to identify themselves
A small number of records were past mending. For those, the file itself supplied the evidence: a Word or PDF signature located in the raw clusters, the data behind it reassembled in sequence, and a filename attached only where the header or the first lines of text justified one.
How the job closed.
The greater part of the portfolio opened under its own filename without complaint. A smaller set arrived with carved names and needed sorting by hand. Everything went home on a fresh stick, with one habit changed: the drive light has to settle before anything is unplugged.
More of the jobs we've closed.
Also on the Logical & corruption shelf.
Does any of that match your case?
Nothing needs deciding until the diagnosis is back: switch the device off, send it in, and let the findings settle it.