A researcher’s Sony Vaio suddenly showed folders full of random symbols instead of file names, with some files refusing to open and Windows asking to format the drive — years of research at risk, no backup. Gibberish filenames are almost always good news in disguise: the index that stores the names is corrupt, not the files themselves. We imaged the drive, rebuilt the index, and recovered the data with its real names.
A researcher sent in a Sony Vaio laptop whose hard drive had turned strange: file and folder names were showing as random symbols and nonsense strings, some files threw “corrupt file” errors or wouldn’t open, and Windows had started prompting to format the drive. On it were years of research — documents, datasets, notes and reports — with no backup. Faced with the format prompt they did the right thing and declined it, then sent the drive to us. Alarming as garbled filenames look, they usually point to a very recoverable problem.
Here’s the reassuring part. On an NTFS drive, a file’s name and its data are stored separately: the name lives in the file system’s index (the Master File Table, in each file’s record), while the actual contents sit elsewhere on the disk. When part of that index is damaged — by bad sectors landing on the MFT, or an interrupted write scrambling directory records — the bytes that spell out the filenames get misread, and what you see is random symbols or mojibake instead of “thesis-chapter-3.docx”. Crucially, that’s corruption of the label on the drawer, not the contents inside it. In the great majority of cases the file data is completely intact; it’s only the index describing it that has been scrambled — which is exactly why gibberish names, alarming as they look, are one of the more recoverable faults.
The diagnosis confirmed it: file-system corruption, not physical failure. The drive still spun and read normally, with only some bad sectors sitting on the areas that held file-location data — enough to scramble the index and trigger the format prompt, but nothing wrong with the mechanics. A format at that point would have been a disaster: it would have laid down a fresh, empty index over the damaged one, discarding the very records needed to restore the real filenames and folder structure. Declining it, and stopping use of the drive, kept everything recoverable.
The drive was cloned sector by sector to healthy storage through a write blocker, with the imaging tools set to read around the bad sectors gently rather than labour over them, capturing the full contents safely. All work then happened on the image. To fix the names, the MFT was analysed and rebuilt: intact file records were parsed directly to recover their correct names and the map to their data, and where the primary records were damaged they were restored from the MFT’s mirror copy ($MFTMirr) and from the surrounding structure. That re-established the directory tree and reconnected the scrambled entries to the right files, so the research came back with its proper names and folders rather than as a heap of anonymously-numbered files.
With the index rebuilt, the researcher’s data was extracted — the Word documents, spreadsheets and PDFs, the specialised datasets, and the project notes and reports — and any files that had partially run through the bad sectors were repaired at file level. Every file was checked to open and read correctly before sign-off, and the complete set, a full recovery, was written to a fresh external drive and returned. The advice we shared is worth remembering the next time a drive shows scrambled names: it usually means the data is fine and the index is damaged, so don’t format the drive when prompted — stop using it and get it recovered, because the format is often the only thing that would have actually lost the files.
Sector imaging through a write blocker with bad-sector handling · NTFS MFT analysis and rebuild · recovery of file names from file records and $MFTMirr · directory-tree reconstruction · file-level repair and verification. All work in-house at our Belfast lab.
Garbled names usually mean your files are fine and the index is damaged — but don’t format the drive if Windows asks, as that’s what can actually lose them. Stop using it and send it in for a free, no-obligation diagnostic. We’ll tell you what can be recovered and put a fixed price in writing before any work starts, and on most jobs it’s no fix, no fee. UK-wide by post, or drop it to us in Belfast.
Usually not. On NTFS the filename and the file data are stored separately, so scrambled names mean the index that holds the names is corrupt — not the files themselves. The data is typically intact, and rebuilding the index restores the correct names and folders. The main thing is to avoid formatting the drive, which would discard the records needed to fix it.
No, not if you need the data. Formatting writes a fresh, empty index over the damaged one, throwing away the very records that would restore your real filenames and folders. Decline the prompt, stop using the drive, and have it recovered — the files are usually still there behind the corruption.
Usually the names too. By rebuilding the file system’s index from the intact records and its mirror copy, files come back with their original names and folder structure in most cases. Where a particular name genuinely can’t be recovered, the file’s contents can still be recovered by their type — so you don’t lose the data even if a few names can’t be restored.