Case record · Logical & corruption · SDR-2025-1117
I Erased the Files and Stopped.
The slip itself was unremarkable — I deleted the wrong folder, spreadsheets and letters both
off a memory stick, the only copies anywhere, never copied onto the office PC
. What she did next was not: nothing further was written to the stick, she ejected it properly, and then she left it alone. Entirely.
Seeing the same thing yourself?
0800 6890668
The translation.
Deleting does not shred anything; it merely revokes a file's status. The directory entry is flagged as free and the clusters go back into the pool, but the bytes stay exactly where they always were until something writes over them. Her restraint meant nothing ever did. One quirk applies to flash in particular: a modern controller can tidy up in the background and genuinely wipe released blocks, so 'stop using it' has to mean stop giving it power, not merely stop saving to it — and that is what she did.
Kit used on this job.
What happens in a case →| Platform | Its role in this case | Why we use it |
|---|---|---|
| PC-3000 Flash | Read the memory at a low level, writing nothing and waking no housekeeping | Pulls data straight from memory chips, with a current library that identifies them automatically |
| R-Studio Technician | Retrieved the erased directory entries along with their cluster chains | Wide filesystem support, with RAID rebuilds you can trust |
| UFS Explorer Professional Recovery | Checked the output independently and confirmed each document's inner structure | Handles the difficult filesystems better than most — APFS, ReFS, XFS, ZFS, Btrfs |
In the lab.
Copy it first, even when the case looks easy
The stick was read through once, low level, to produce a working copy. That is not ritual on a plain deletion: point a recovery tool at the original media and you can set off exactly the housekeeping that erases what you came for. Working from the copy takes that risk off the table.
Use the surviving entries, don't carve blind
Since not one byte had gone on since the deletion, the erased directory entries were all still sitting there with their cluster chains unbroken. Working from those entries hands back files with the names, folders and dates they had — carving by file signature would have returned identical content as a heap of nameless documents.
Nothing counts as recovered until it opens
Every spreadsheet and letter was opened and read through, because an Office file can be entirely present on disk and still be broken inside. Each one was fine, which is what you expect when nothing has overwritten anything.
The result.
All of it came back, every file opening properly, with the original names and folder layout still in place. The dullest job described anywhere on this site, and rightly so — a routine loss, a level-headed response, a routine result.
Similar cases on the index.
Other cases in Logical & corruption.
Does this sound like your own drive?
The rule holds as in every case above: switch it off, and let a free diagnosis come before any decision.