Data Recovery Case File · Formatted & Logical Faults · Located, Not Retrieved

Software Can Find a File's Name and Still Not Have Its Contents

Her enquiry describes a partial result that needs interpreting. A folder of work deleted — she is unsure whether by removing files from a synchronised folder or by emptying the bin — with no restore point available, where "the files are located but I can't open them." Finding and opening are separate achievements, and software reporting a file by name has established that a record survives, not that the content behind it does.

The decode: why a file can be found and still be empty

What deletion actually does: marks the record describing a file as unused and releases the space its content occupies. Two separate things are affected — the record and the region — and they are in different places on the drive.

Why the record often survives longer: directory areas are small and are reused when new files are created. Content regions are large and are reused as soon as anything needs space, so on a working computer the content is displaced faster than the record describing it.

What that produces: exactly her result. Software reads a surviving record, reports the file by name and size, attempts to retrieve the content from the position the record gives — and finds something else there, because that space has been written to since.

Why the files then will not open: what is recovered is whatever now occupies those regions. The recovered file has the right name and the wrong contents, which an application refuses as corrupt.

Why that is worth understanding rather than retrying: running more software will find the same records and retrieve the same regions. The limitation is not the tool, and a different one will produce the same list of unopenable files.

What can still work, and it is a different approach entirely: searching the raw content for recognisable file structures rather than following directory records. Documents have identifiable openings, so a copy that survives somewhere else on the drive is found without reference to the entry that no longer points at it correctly.

Why word-processing documents are reasonable candidates: applications frequently write temporary and autosave copies in separate locations during editing. Those copies were written at different times and occupy different regions, so one may survive where the primary file's region has been reused.

Why the synchronised folder question matters practically: if the deletion happened within a folder linked to an online service, that service very likely retains deleted items and previous versions for a period. That route is independent of the drive entirely and is checked in minutes — and it is the most promising thing available.

Why the missing restore point is less important than it seems: that feature protects system configuration rather than documents. Its absence has cost her little, and it would not have held the folder in any case.

What must not happen now: continued use of the computer. Every hour of ordinary running writes into the space her documents occupied, and the position is deteriorating for as long as it stays on.

On the bench

Located-not-openable results were interpreted as surviving records with displaced content — deletion affecting both the descriptive record and the content region separately, with directory areas being small and content regions large and reused sooner, so software reads a surviving record and retrieves whatever now occupies the referenced position, producing files with correct names and unusable contents. Carving was performed against the image independently of directory records, and synchronised service version history identified as a parallel route.

The outcome

The results interpreted as surviving records with displaced content, the device removed from use and imaged, and carving performed independently of directory records. Free assessment, one fixed written figure including VAT. The decode: finding a file and having its contents are different achievements. The record describing it survived in a small area while the space holding the content was reused — so what came back has the right name and whatever now occupies that position.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.