Data Recovery Case File · Second Fixes & Trade Handoffs · Nobody Verified
An Empty Destination Drive Does Not Tell You Where the Files Went
Her enquiry describes a transfer that appears never to have happened. A laptop sent away for security software to be updated, returned running but unable to open files or reach the internet, then sent back with an external drive so the contents could be copied across — and "when they gave me back the external hard drive there was nothing on it. I don't even think the company had checked." Two questions need separating: what is on the laptop, and what happened to the drive.
| Media | Laptop returned in a non-functional state following software work, and an external drive supplied for transfer and returned empty — one specific file required |
| Reported situation | Laptop sent for security software to be updated · machine returned running but unable to open files or connect · machine returned to the same company with an external drive for transfer · external drive returned with no content present · owner doubting whether the transfer was verified · one specific file required |
| Fault class | Transfer not completed or not verified — source content status undetermined; destination drive to be examined for evidence of a partial or reversed operation |
| Equipment used | Source and destination assessed as separate questions · destination drive imaged write-blocked and examined for traces of a partial or deleted transfer · laptop drive removed and read independently of the machine · required file located by signature across both devices · content validated by opening |
The decode: two devices, and what each may tell us
Why the laptop is the more likely source: the files were on it, and nothing described suggests they were removed. A machine that runs but cannot open files or connect has a software problem, and a damaged installation does not erase user documents — it fails to reach them.
What that state most likely is: an interrupted or misapplied software change. Security software sits deep in a system, and an update that goes wrong can leave a machine running with essential components broken — which describes a laptop that starts, does nothing useful, and has no network.
Why that matters for her prospects: the drive inside is very likely intact and readable. Removing it and reading it directly bypasses the broken installation entirely, and the file she needs is probably sitting in her user folder untouched.
Why the empty external drive is worth examining rather than dismissing: empty is a result, and results have causes. A drive that received files and had them deleted looks different from one that never received anything, and imaging it settles which happened.
What the possibilities are: the transfer was never started; it was started and failed; it completed and the drive was subsequently cleared or reformatted. Each leaves distinguishable traces, and if content was written and then removed, it is very likely still recoverable from that drive.
Why that possibility is worth pursuing first: it is the quickest. Recovering deleted content from a drive that has had nothing written to it since is straightforward, whereas reading the laptop's drive requires the machine to be opened.
Why her suspicion that nobody checked is the substantive point: a transfer is not complete when a copy operation ends. It is complete when the destination has been compared against the source — and that step is what distinguishes a copy from a verified copy.
Why that step is skipped so often: a copy that reports success is convincing. Nothing prompts anyone to look, and the absence of an error is treated as evidence of a result — which is the same failure that appears throughout this archive in different clothes.
Why her narrow requirement helps considerably: she needs one file. A single known document is far easier to locate than a complete set, and it can be searched for by name, type and content across both devices.
What must not happen: nothing further written to the external drive, and no further attempts to use the laptop. Both are now potential sources, and both are degraded by use.
On the bench
Source and destination were assessed as separate questions — a machine running but unable to open files or connect indicating a damaged software installation rather than removed content, so the internal drive is likely intact and readable independently of the broken system. The destination drive was imaged and examined for traces of a partial or deleted transfer, a drive that received and lost content presenting differently from one that never received any, with deleted content recoverable where nothing has been written since.
The outcome
Source and destination assessed separately, the destination imaged and examined for traces, and the laptop drive read independently. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: an empty drive is a result with a cause. Whether it never received the files or received and lost them is determinable — and meanwhile your laptop's drive is very likely intact behind a broken installation.
When a transfer you paid for comes back empty
Stop using both devices and have the empty drive examined rather than dismissed — a drive that received content and had it deleted looks different from one that never received any, and if files were written and then removed they're usually still recoverable. Take some reassurance about the laptop: a machine that runs but can't open files or connect has a damaged software installation, which doesn't erase documents, so its drive read directly will probably hold what you need. The underlying lesson is that a copy isn't complete when the operation ends — it's complete when the destination has been compared against the source.
Stop using both — call Easy Data Recovery on 028 9002 0144; source and destination assessed separately, destination examined for traces of a partial or deleted transfer, laptop drive read independently.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.