Data Recovery Case File · Second Fixes & Trade Handoffs · The Pattern Tells You What They Did

Getting Back Old Files and Not Recent Ones Means the Live Volume Was Never Read

His enquiry contains a result that explains itself once you look at it. A drive that failed just before a planned copy, where a retailer "did a standard data recovery but that only brought back a group of very old files and none of the photographs" — with around 1.5TB still missing. That combination is not bad luck: recovering long-deleted material while missing current files is the signature of a scan that carved remnants rather than reading the live filesystem.

The decode: what the pattern of results reveals about the method

What two different recovery methods return: reading the filesystem gives you the files as they are now, in their folders, with their names. Carving ignores the filesystem entirely and searches the raw contents for recognisable file openings — which finds things regardless of whether anything still refers to them.

Why carving characteristically returns old material: deleted files remain in unallocated space until overwritten. A signature scan finds them alongside anything else it recognises, so its results are frequently dominated by material the owner deleted long ago and had forgotten.

Why it can miss current files at the same time: a carve depends on finding recognisable openings in readable regions. If the areas holding the current material could not be read, nothing there is found — while older content sitting in regions that still read comes back perfectly.

What that tells us about his drive: parts of it are readable and parts are not, and the parts that failed are the parts in current use. That is a coherent picture rather than a mysterious one, and it points at localised read failure rather than total loss.

Why the live filesystem being unread is the key omission: the structures describing current files sit in specific locations. If those regions could not be read, no method that depends on them returns anything — and a carve, which does not use them, then returns only what it can find by pattern.

What is done differently: the drive is imaged first under capped timeouts, with difficult regions revisited across multiple passes rather than abandoned on a first failure. Regions a single-pass scan could not read frequently return data when approached repeatedly and patiently, and the filesystem structures are then reconstructed from whatever survives, including duplicates held elsewhere.

Why photographs specifically may still be reachable: even where structures cannot be rebuilt, image files carry recognisable openings. The earlier carve failing to find them suggests it could not read those regions rather than that they are absent — which is a different and more hopeful conclusion.

What is worth establishing about the earlier attempt: how many times the drive was powered, and whether anything was written to it. A software scan on a failing drive can run for many hours, and a drive with localised read failure spends that time retrying.

Why the timing detail is worth acknowledging: it failed just before the copy he had planned. That is the commonest moment for a loss to be discovered — not because copying causes failure, but because the intention to copy is when people last look.

On the bench

The recovery pattern was interpreted as carving of unallocated regions rather than filesystem reading — filesystem reading returning current files with names and structure, whereas signature carving searches raw content for recognisable openings and characteristically returns long-deleted material while missing current files whose regions could not be read, which indicates localised read failure concentrated in areas in active use. Imaging ran write-blocked under strict per-sector timeouts with difficult regions revisited across passes.

The outcome

The earlier pattern interpreted as carving rather than filesystem reading, the drive imaged under capped timeouts with repeated passes, and structures located from surviving copies. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: getting back old files and not current ones is diagnostic. It means a scan carved remnants from readable regions while the areas holding your photographs could not be read — which is localised failure, not absence.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.