Cause of loss · files that have vanished
Stop using the machine and let us know which drive the file was on; the second of those settles most of this. When you delete a file on a hard drive, you remove the reference from the index and put the clusters on the free list. Those bytes remain in the clusters until some other file needs the space (this could take weeks). On an SSD, it doesn't work like that. TRIM tells the controller to clear those cells and it does so unprompted, usually before you have worked out what to do. We go into both types further down. The look is free, and the figure is £250 + VAT for a card or stick, £300 + VAT for a drive.
An engineer answers, and looking is free
0800 6890668
| What you notice | What is likely wrong | What happens next |
|---|---|---|
| Vanished completely, and there's nothing in the Recycle Bin either | It didn't reach the bin: you used Shift+Delete, a memory card, a stick, or the file was over the size limit | Put nothing else on it |
| Too big for the bin to hold | Windows removed it instantly; it was never held by the bin | The contents are normally still there |
| File missing from a camera card or USB stick | There is no way for a card or stick to keep deleted files, so they are immediately removed from the index | Remove the card and don’t go any further with it |
| The lot went after a sync | OneDrive or similar has copied across a deletion made on another machine | Check that service's own online bin first |
| A folder you use daily, suddenly empty | Either someone deleted it, a sync went wrong, or you're in a second user profile | Switch it off before you start hunting |
| It's an SSD, and the file is gone | The controller received the TRIM signal and clears those blocks in seconds | Power it down now |
A case number is assigned to your device when we receive it. An engineer then finds the real fault (free) before anything else occurs; you will be advised clearly of what will be returned and what will not, along with a single written price. Charges cannot begin until you have read this and accepted.
A PC left running writes to its own disk throughout the day without asking anyone: thumbnail caches, browser files, an update unpacking itself in the background. Those writes land wherever there's free space, and the space your file used now counts as free. This is why the disk is removed and imaged.
When the index remains intact, the names, dates and folders come back with the contents. When it is lost, each file must be carved out of the image individually, based on the signature its file type begins with.
A number in a report does not constitute evidence. Instead, the recovered files are opened and examined, and anything you have flagged as important is checked separately.
You look at the file list first and make a decision about what to do. We will never invoice anything until you have said yes, and in most cases you only pay if we recover your data. All of the information that we recover will be put on new media purchased by us specifically for this job, and our company pays the cost of postage back to you. The case stays open on the bench until you tell us the files open on your own machine.
With one keystroke, you could be working to entirely different clocks. Data on a hard disk stays put for long periods, often years, and only goes when another file claims the space it occupies. Perform the same keystrokes on an SSD (a WD Blue, a BarraCuda) and TRIM can have those cells cleared in mere minutes. The same keystrokes produce two vastly different results. That is why the opening question here is about the drive and not the file itself, and why a free diagnosis can tell you where you stand on day one.
A single keystroke erased a whole year's worth of bookkeeping from the office machine of a Woodley trade counter, along with the bin. Imaging was done the day it arrived, the index was rebuilt from the image and not the original, and the folder returned intact, filenames and dates included.
What decides the answer is not the file itself but which type of storage it was on. A hard drive keeps the contents in the same sectors until something else needs that space, and most jobs of that kind are successful. Where TRIM is running on an SSD, the drive empties those blocks by itself, often before you have even shut the machine down.
On a hard disk, no. Shift+Delete simply bypasses the recycle bin; the clusters are released either way and the bytes remain where they were written. The recycle bin was always a convenience, never a safeguard.
No. Delete something on a USB stick or memory card and Windows removes it instantly, without holding anything back. In most cases, the data itself remains in the flash, and it is the flash our tools read (the physical chips, not the directory).
Because the drive cleans up after itself. With TRIM, the file system tells the drive which blocks are finished with, and the drive empties them before the next write comes along. You get no indication on screen at all. That is why the window is minutes on an SSD and can be weeks on a hard disk.
There is no charge for the look. You then receive a list of the files that opened, those that did not, and a fixed amount to complete the job. Keep it switched off until you have received that in writing.