Data Recovery Case File · Portable Drives · It Appeared and Was Never Committed
A Folder Shown on Screen Is Not Necessarily a Folder Written to the Disk
His enquiry captures a specific and unsettling experience. A new folder created on an external drive and filled with pictures and videos from a tablet, where "despite the folder looking like it was there at the time, I can no longer find it." What appeared on screen was the system's own view of what it intended to write — and if that intention was never completed to the disk, the folder existed in the display and not on the drive.
| Media | External hard drive used for family photograph storage — recently created folder and copied content not present on subsequent access |
| Reported situation | External drive used for family photographs · new folder created on the drive · pictures and videos copied to it from a tablet · folder visible at the time · folder not locatable subsequently · owner not technically experienced · content sought |
| Fault class | Write not committed to media or structure loss following an incomplete write — cached directory state displayed without corresponding disk update |
| Equipment used | Displayed folder state distinguished from committed disk state · drive imaged write-blocked before any search · directory structures examined for partial or orphaned entries · signature carving targeted to photographic and video content · source device identified as a possible surviving copy |
The decode: how something can be visible and not written
What happens when files are copied: the system does not write each one to the disk the moment it appears. It holds changes in memory and commits them to the drive in batches, because that is far faster — and while they are held, the display shows them as though they were already stored.
Why that is normally invisible and safe: the writes follow within moments, and ejecting a drive properly forces everything outstanding to be committed before the drive is released. The gap between appearing and being written is usually too short to matter.
What can happen in that gap: if the drive is removed, loses power, or is disconnected before the outstanding writes complete, the changes held in memory are lost. The folder was real on screen and never reached the disk, which is exactly the experience he describes.
Why this feels so much like a fault: he saw the folder, so it existed. The display was accurate about what the system was doing and not about what the drive contained — a distinction nobody should be expected to know about, and one that produces a loss that seems impossible.
The second possibility, which presents identically: the writes did complete, and the directory entry describing the folder was subsequently lost or damaged. In that case the content is on the drive but nothing points at it, and it is found by searching for the files themselves rather than for the folder.
Why the difference matters for prospects: if the writes never happened, there is nothing on the drive to recover and the content was never there. If they happened and the entry was lost, the pictures are present and findable — and the two are distinguished by examining the drive rather than by reasoning about it.
Why the source device is the most important thing to check first: the pictures came from a tablet. Unless they were moved rather than copied, they may still be on it — and the cheapest recovery available is the copy that never left the original device.
What should be done before anything else, on both: the drive comes out of use, and the tablet should not have anything deleted from it. If the pictures are still on the tablet, they are safe only while nobody tidies it up.
What the search on the drive involves: the drive imaged first, then examined for orphaned entries and for the photographs themselves by signature. Pictures and videos carry recognisable openings and are located without any folder structure at all.
On the bench
Displayed folder state was distinguished from committed disk state — copy operations being held in memory and committed to media in batches while the display reflects intended rather than stored content, so disconnection or power loss before completion discards the outstanding changes. The alternative, a completed write whose directory entry was subsequently lost, leaves content present but unreferenced. Directory structures were examined for partial or orphaned entries and carving targeted to photographic and video content.
The outcome
Displayed state distinguished from committed state, the drive imaged before any search, and carving targeted to photographic and video content. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: what you saw was the system showing what it intended to write. Copies are held in memory and committed in batches, so a disconnection before that completes loses them — and the display was accurate about the intention, not the disk.
A folder you saw on screen that is no longer on the drive
Check the device the files came from first — if they were copied rather than moved, the originals may still be there, and that's the cheapest recovery available. Don't delete anything from it meanwhile. What happened on the drive is that copy operations are held in memory and written to the disk in batches, while the display shows them as though already stored, so a disconnection or power loss before that completes discards them. Always eject a drive properly rather than unplugging it, since ejecting forces outstanding writes to complete. If the writes did finish and only the folder entry was lost, the pictures are still findable.
Check the source device first — call Easy Data Recovery on 028 9002 0144; displayed state distinguished from committed state, imaged before any search, carving targeted to photographic and video content.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.