Data Recovery Case File · Trust, Practice & Honest Limits · An Answer That Branches

The Gap Is Not the Problem — What Happened During It Is

His enquiry describes a loss noticed long after the event. A folder of photographs and video from travelling, "deleted from about five years ago. I have no backup and have tried my own data restore but no good." Deleted content survives until something writes over it, and five years is only fatal if the drive was in use throughout them — which is the single question that decides whether this is possible.

The decode: the one question, and both answers

What deletion does: marks a directory entry as unused and releases the space for reuse. The content stays exactly where it was written, intact and unreferenced, and it remains there until something else is written into that space.

So what determines recoverability: not how long ago, but how much has been written since. Time itself does nothing — a deletion from a decade ago on a drive that was set aside is more recoverable than one from last month on a drive in daily use.

Why that surprises people: the intuition is that data decays, or that recovery gets harder as the trail goes cold. Neither is true, and the mental model does not match the mechanism.

Now the honest branch, and the first answer is the unwelcome one. If the drive has been in ordinary use for five years, the freed space has been written and rewritten many times over. Photographs and video are large, and the space they occupied is exactly the space the system reaches for first. Recovery in that case is very unlikely, and that should be said plainly rather than dressed up.

Why his own attempt supports that reading, if the drive has been used: consumer tools find deleted entries reliably. Finding nothing at all is consistent with entries long since reused, though it is also consistent with entries damaged rather than deleted.

The second answer, which is entirely different. If the drive was retired, replaced or set aside shortly after the deletion, the content is very likely still there. Unreferenced content on an unused drive does not go anywhere, and the five years count for nothing.

What makes this worth establishing rather than assuming: people frequently do not remember which. A drive that was replaced, a machine that was upgraded, a stick that went into a drawer — the details matter and they are not usually in the enquiry.

What can be done even in the pessimistic case: an assessment establishes how much of the drive has been written since, which is measurable. It costs nothing and it converts a guess into an answer.

On the bench

Subsequent write activity was established as the determining question before any assessment — deletion marking a directory entry unused and releasing space while leaving content in place, so recoverability is governed by what has been written since rather than by elapsed time. Occupied capacity and file dates were examined against the deletion period, continuous use over years reusing freed space repeatedly, particularly space vacated by large media files. Position was stated honestly before any charge.

The outcome

Subsequent write activity established as the determining question, occupied capacity examined against the period, and the position stated honestly. Free assessment, one fixed written figure including VAT — and no charge where the honest answer is that too much has been written. The decode: the five years are not the problem. Deleted content stays where it was until something writes over it, so what matters is whether that drive has been in use since — and that answer branches completely.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.