Deleted files & corruption · bench log · HUL-2025-1117
I Deleted Them, Then Left It Alone.
It caught up with him at a red light, halfway to a client's office. A bookkeeper in Beverley, he had been tidying the stick before he left, had dragged an extra folder in with the rubbish, and had confirmed the prompt that empties the bin. Gone with it: twelve months of ledgers, the purchase invoices, and four VAT returns. There is no copy of that anywhere else
, he said. Then the line that saved the job — it never went near a socket after that
. Glovebox, then phone.
Sounds like yours? Ring us.
0800 6890668
What causes it.
Nothing is scrubbed when you delete. What happens is that the index forgets the filename and flags those clusters as free. The bytes are untouched, lying where they have always lain, until something else is written across them. That is the whole story on a spinning disk. Flash has a second layer. Every memory stick carries a controller, and give that controller power and it may set about clearing blocks it has decided are now free — nobody asked it to, and it tells nobody. So with flash, doing nothing means keeping the thing out of every socket, not simply not saving to it. Thirty seconds decided this job, before anyone had even worked out what was wrong.
The tools this one needed.
The steps we follow →| The gear | What this one did | Why we have it |
|---|---|---|
| PC-3000 Flash | Took a single full read of the stick, ahead of any controller housekeeping | Goes round the controller and reads the NAND itself, matched to a maker-ID library kept current |
| R-Studio Technician | Brought back the dropped FAT32 records and the cluster chains behind them | Handles almost any file system, and puts RAID sets back together |
| UFS Explorer Professional Recovery | Checked the rebuilt tree with a second tool, then read every document off the copy | Opens the volume formats most tools cannot: APFS, ReFS, XFS, ZFS, Btrfs |
The stages.
Read the original once, then leave it alone
The stick was given exactly one job: a full sector-by-sector read that produced an image. Everything after that happened on the copy. Flash that still powers up is the trap. Recovery software has to bring the device to life before it can read a single byte, and bringing it to life is what starts the housekeeping. With the image made, that risk is behind you.
The deleted entries were still there
Since the bin was emptied and the stick then left alone, every deleted record still stood in the directory table — the name, the timestamp, the cluster chain, all of it. Follow those and the folder returns in the shape its owner has in mind. Carving by file signature would have produced the same bytes with nothing attached to them — no names, no dates, no structure — and there was no reason to resort to it.
Nothing goes back until it opens
All four returns were opened and read through. So were the invoices, and so were the ledger exports. A file can carry precisely the right byte count and still be gibberish inside, so size on its own proves nothing. Not one of them was damaged. The accounts looked exactly as they had that morning.
How it finished.
All of it returned — the filenames, the folder structure, the timestamps, even the order in which the work was done. The quarter went in on time. Nothing here was clever, and that is more or less the point of the case. It hung on the first half-minute and on a decision anyone is capable of making. After that it was routine.
What people read after this.
More cases of corruption and deletion.
Is yours doing the same?
Turn it off. Send it to us. The diagnosis comes first. It says which files are still readable and which are not.