Case record · Logical & corruption · SDR-2025-0932
My Folder Turned Into Zero-Byte Files.
The warning signs were unremarkable: the sockets on that hub have been loose for months
, then the notice everybody ignores at least once — disk not ejected properly
. Payment fell due next time the stick went in. A term of teaching material now listed as 0 byte
Unix Executable
items opening onto nothing.
Seeing the same thing yourself?
0800 6890668
The translation.
Zero bytes and an absurd file type is the filesystem getting its own paperwork wrong, not the data leaving the building. In FAT, a directory entry holds only the name, size, attributes and the number of the opening cluster; the bytes of the file itself sit elsewhere on the media entirely. Yank a stick mid-write and those entries can be left half-finished — size and type fields scrambled, while the clusters carrying the actual content are never touched. macOS then reports faithfully what it finds, which is gibberish, so the file looks empty.
Kit used on this job.
What happens in a case →| Platform | Its role in this case | Why we use it |
|---|---|---|
| PC-3000 Flash | Read the stick at a low level, underneath the muddled filesystem | Pulls data straight from memory chips, with a current library that identifies them automatically |
| R-Studio Technician | Reconstructed the broken FAT entries from the structures that survived | Wide filesystem support, with RAID rebuilds you can trust |
| UFS Explorer Professional Recovery | Signature-led recovery for the entries that were past mending | Handles the difficult filesystems better than most — APFS, ReFS, XFS, ZFS, Btrfs |
In the lab.
Copy the stick before anyone opens that folder again
Every time a stick in this condition goes back into a socket, its controller may decide to tidy up precisely the clusters that matter. So the first move was a low-level read, which produced a settled copy — and once that exists, every experiment afterwards is free.
Mend the directory entries that still survive
FAT holds its allocation table twice over, and the damage had not landed in the same places on each. Wherever the intact copy gave enough to work from, the mangled entries were built back — names, sizes and cluster chains returned, and the files along with them.
Carve what remains by its own signature
A small number of entries were beyond mending. Those files came back by their internal shape instead: documents recognised from their format signatures, reassembled out of the cluster chains, then given likely names again wherever the evidence justified one.
The result.
The coursework folder came back, its files opening as they should and most of them under the names they were given. A powered hub has since replaced the loose sockets that set the whole thing off.
Similar cases on the index.
Other cases in Logical & corruption.
Does this sound like your own drive?
The rule holds as in every case above: switch it off, and let a free diagnosis come before any decision.