Logical & corruption · bench notes · PLY-2025-0932
A Folder Full of Files, All of Them Zero.
The stick came out of a laptop in Camborne with a save still in progress — I did not wait, I just took it straight out
— and she gave it no more thought that day. Next morning the folder was still showing everything — the portfolio, both assignments, all the names in place, each size given as 0 bytes
, nothing at all in the type column, every entry recorded as a plain File
. She tried opening two of them. Her mentor on the ward told her to stop poking at it and get somebody to look
.
Sounds like yours? Talk it through.
0800 6890668
Why it happens.
FAT keeps its catalogue well away from the goods themselves. A short table records the name of each file, its type, its length and the cluster it begins at; the file sits somewhere further along the chip and takes no interest in whether that table is correct. Break into the table during an update and the record is left half-made — length zeroed, type gone. Her coursework, all the while, is still in its clusters, written exactly as it was. Windows repeats the table and does not question it, so a folder holding a whole term reports itself as empty.
The kit this job called for.
How the job runs →| The kit | What it did here | Why we keep it |
|---|---|---|
| PC-3000 Flash | Sector-by-sector read of the chip, taking the filesystem’s word for nothing | Bypasses the controller and reads the raw NAND, against a maker-ID library we keep up to date |
| R-Studio Technician | Rebuilt the damaged entries by working against FAT’s second copy | Reads nearly every file system, and rebuilds RAID sets from images |
| UFS Explorer Professional Recovery | File-signature carving where the entry itself was beyond help | Mounts what other software will not: APFS, ReFS, XFS, ZFS and Btrfs volumes |
How it ran.
Take the image before anything else happens
Put a flash stick under power and the controller sets off on its own errands — wear levelling, garbage collection — none of it concerned with which blocks a recovery is going to need. The first move, then, was a flat read of the whole chip onto bench disks. Once that existed, nothing done later could cost her a file.
Prefer the copy of the table that fared better
Every FAT volume keeps a second allocation table alongside the first, and the write that was cut short did not hurt both equally. Where the healthier of the two agreed with a directory entry still in one piece, the record went back complete: name, length and the whole chain of clusters. What comes back that way is the file itself, not a lookalike put together afterwards.
What was left had to name itself
A few entries could not be mended at all, so those files had to speak for themselves. The raw clusters are searched for a Word or PDF header, the bytes following it are joined back up in order, and a name goes on the result only where the header, or the first readable lines of text, will support one.
How it ended up.
Most of the portfolio arrived back under the names it had always had. A smaller batch had been carved, so those came with names the software had generated, and sorting through them took her an evening. Everything travelled home on a fresh stick, with one instruction attached: give it time to finish before it comes out of the socket.
Pages people open after this.
More on corrupt volumes and deleted files.
Seeing the same thing?
Leave it switched off and post it in. Nothing happens until the diagnosis, which lists what can still be read and what cannot.