Logical & corruption · case file · BHD-2025-9117
I Binned It, Then Left It Alone.
He got as far as the traffic lights before it landed. A bookkeeper in Selly Oak had been tidying the stick up before he went out to see a client, had sent one folder too many to the bin, and had taken the prompt that empties it. Out went a year: sales ledger, purchase invoices, four quarters of VAT. That stick is the only place any of it lives
, he told us. Then he did the one thing that saved the job — I never put it back in anything
. Glovebox, then the phone.
Sounds like yours? Give us a ring.
0800 6890668
What that means.
Deleting a file erases nothing. The index drops the name and re-labels the clusters as available; the bytes themselves sit where they were until something new is written on top of them. That is the whole of it on a hard disk. Flash adds a second problem. A memory stick has its own controller, and the moment it gets power that controller can begin tidying blocks it now believes are spare, without being asked and without telling anyone. So on flash, leaving something alone means keeping it away from power altogether, not simply refusing to write to it. This case was won in the thirty seconds before anyone understood the problem.
What did the work here.
The order of the work →| Equipment | The job it did | What it adds |
|---|---|---|
| PC-3000 Flash | Read the NAND out whole before the controller had a chance to tidy | Goes straight to the NAND chips, checked against a maker-ID library that is kept current |
| R-Studio Technician | Put back the deleted FAT32 directory entries and the cluster chains behind them | Broad file-system support, with RAID rebuilds that can be trusted |
| UFS Explorer Professional Recovery | Walked the recovered tree a second time on different software, then opened each document | Handles the file systems other tools give up on: APFS, ReFS, XFS, ZFS, Btrfs |
What we did.
One pass at the original, and no more
Only one thing was asked of the stick: a sector-by-sector read that produced a working image. Every step after that used the copy. Aim recovery software at flash that is still live and it has to bring the device up before it can read a byte, and that power-up is precisely what sets the controller tidying. With an image in hand, that risk is gone.
The names were still there, so we kept them
Nothing had been written to the stick since the bin was emptied, so every deleted entry was still sitting in the directory table with its name, its timestamp and its cluster chain intact. Work through those entries and the folder returns in the arrangement its owner has in his head. Signature carving would have found the same bytes with the names, the dates and the structure all stripped off, and it was not needed.
Every file opened, every quarter checked
The VAT returns, all four of them, were opened and read; so was every invoice and every ledger export. A file can be exactly the size it should be and still be junk on the inside, so the byte count proves nothing at all. Not one was damaged. The books looked as if nobody had ever touched the bin.
How it closed.
It all came back — names, folders, dates, and the order the work had been done in. The return for that quarter went in on time. There is nothing clever in this case, and that is rather the point of it. The job was decided in the first thirty seconds, on a decision anybody could have made; everything after that was procedure.
Other pages worth a look here.
Others under Logical & corruption.
Is yours behaving the same way?
Switch the device off, post it in, and decide nothing until the diagnosis comes back to tell you where you stand.