Deleted files & corruption · bench log · RDG-2025-2267
I Binned Them, and Then Left It Alone.
It came to him at a set of traffic lights, driving over to a client's office. A Thatcham bookkeeper had tidied up the memory stick before setting off, dragged one folder too many into the rubbish, and clicked straight past the box that asks whether you are sure. Gone with it: four VAT returns, every purchase invoice, a full year of ledgers. There is no copy of any of it anywhere
, as he put it. Then a second sentence, and it is the one that mattered: it has not gone into anything since — not once
. Glovebox, and then the telephone.
Same fault on yours? Tell us what it is doing.
0800 6890668
What actually caused it.
Nothing gets scrubbed when you delete. The index drops the filename, the clusters behind it are flagged as reusable, and every byte stays put until fresh data lands on top. For a mechanical disk that is the end of the explanation. Flash carries a second mechanism on top of that: a controller, which — once it has power — may go off and wipe blocks it has decided are spare. It asks no one, and it says nothing. Leaving flash alone therefore means more than not saving to it: the stick goes into no socket at all, anywhere. Thirty seconds settled this case, well ahead of anyone diagnosing the fault.
What this one needed on the bench.
How every job runs →| Bench tools | Its part in this job | Why it is here |
|---|---|---|
| PC-3000 Flash | A single complete read, taken before the controller could tidy anything | Reads the NAND direct, past the controller, against a maker-ID library kept current |
| R-Studio Technician | Restored the abandoned FAT32 records and followed the cluster chains behind them | Handles almost any file system, and puts an array back together off the images |
| UFS Explorer Professional Recovery | Cross-checked the rebuilt tree with a second tool, and read every document out of the image | Opens volumes other tools refuse: APFS, ReFS, XFS, ZFS and Btrfs |
What the bench did.
One read of the original, then leave it alone
One task was put to the stick and one only: a complete sector-by-sector read, producing an image. From there on, the work was done on the copy. The awkward part with flash that still powers up: no recovery tool can read a single byte until the device is awake, and it is that waking which sets the controller tidying. With an image on the shelf, the risk goes away.
The deleted entries stayed put
The bin was emptied and the stick then went into a glovebox and stayed there, which meant the directory table still held each deleted record intact — name, timestamp, cluster chain and all. Follow them and the folder returns as its owner remembers it. Carving by signature would have handed over identical bytes with the names, the dates and the shape stripped off, and nothing about this job called for that.
Nothing returns until it opens
Each of the four returns was opened and read from first page to last, and so were the invoices and the ledger exports. A byte count on its own proves nothing: a file can be exactly the right size and be nonsense inside. Not one of them was damaged. The books read as they had that morning.
What went back.
Back it all came: names, folders, timestamps, and the very sequence in which the work had been done. The quarter went in on time. Nothing about the job was clever, which is more or less the reason it is written up here. Half a minute of restraint decided it, and that is a decision anybody can make. Everything else was routine.
If this sounds like yours, start here.
More jobs on lost files and bad volumes.
If that sounds like yours, stop there.
Post it in as it is, switched off. Looking costs nothing, and you get one fixed figure in writing before any chargeable work begins — £250 + VAT for a card or stick, £300 + VAT for a single drive, from £500 + VAT for RAID and NAS. On most jobs, nothing is charged unless your data comes back.