Deleted files & corruption · bench log · PLY-2025-1117
I Deleted Them and Then Stopped Touching It.
It struck him at a set of lights, halfway across to a client's office. Before leaving, the Tavistock bookkeeper had been tidying up the stick, had dragged one folder too many in with the rubbish, and had clicked past the warning that empties the bin. Away with it went four VAT returns, all the purchase invoices, and a year of ledgers. Nothing anywhere else holds a copy
, he told us. Then the line that saved the job: I have not plugged it into a single thing since
. Glovebox, then telephone.
Sounds like yours? Talk it through.
0800 6890668
Why it happens.
Deleting scrubs nothing. The index simply forgets a filename and marks those clusters as available. Meanwhile the bytes sit exactly where they have always sat, undisturbed until something new is written across them. On a spinning disk that is the whole of the story. Flash adds a second layer to it. There is a controller in every memory stick, and once that controller has power it may take it upon itself to erase blocks it now considers free — nobody asks it to and it announces nothing. So on flash, leaving well alone means keeping it out of every socket there is, and not merely refraining from saving to it. Half a minute decided this job, before anybody had even established what the fault was.
The kit this job called for.
How the job runs →| The kit | What it did here | Why we keep it |
|---|---|---|
| PC-3000 Flash | One full read of the stick, taken before the controller could do any tidying | Bypasses the controller and reads the raw NAND, against a maker-ID library we keep up to date |
| R-Studio Technician | Recovered the discarded FAT32 records and the cluster chains they pointed at | Reads nearly every file system, and rebuilds RAID sets from images |
| UFS Explorer Professional Recovery | Checked the rebuilt tree against a second tool, and read each document out of the image | Mounts what other software will not: APFS, ReFS, XFS, ZFS and Btrfs volumes |
How it ran.
Read the original once, then put it down
One task was asked of the stick: a full sector-by-sector read yielding an image. From that point on, only the copy was touched. The trap here is flash that still powers up. Before recovery software can read one byte it has to wake the device, and waking the device is exactly what starts the tidying. Once an image exists, the risk has gone.
The deleted entries had not moved
The bin had been emptied and the stick then left alone, so every deleted record was still standing in the directory table: name, timestamp, cluster chain, everything. Follow those and what comes back is the folder as its owner remembers it. Signature carving would have handed over the very same bytes stripped of their names, their dates and their shape, and nothing here made that necessary.
Nothing leaves here until it opens
All four returns were opened and read from beginning to end. The invoices too, and the ledger exports. Byte counts prove nothing on their own: a file can carry precisely the right size and be nonsense inside. None of them was damaged. The books read just as they had that morning.
How it ended up.
Everything came back — names, folders, timestamps, and even the order the work had been carried out in. The quarter was filed on time. There was nothing clever about any of it, and that is more or less why it is written up. The whole thing turned on thirty seconds and on a decision within anyone's reach. The rest was routine.
Pages people open after this.
More on corrupt volumes and deleted files.
Seeing the same thing?
Leave it switched off and post it in. Nothing happens until the diagnosis, which lists what can still be read and what cannot.