Logical & corruption · bench log · CDF-2025-1117
I Emptied the Bin, Then Froze.
It hit him at the lights, on the way out to a client. A bookkeeper in Cathays had been tidying the stick before he set off, had dragged one folder too many into the bin, and had clicked the prompt that empties it. Gone: a year of sales ledger, purchase invoices and four quarters of VAT. Nothing else anywhere has a copy of that
, he said. Then came the thing that won the case — I never plugged it into anything after that
. Glovebox, then the phone.
Does that match yours? Call us.
0800 6890668
Why that happens.
Nothing gets wiped when you delete. The index forgets the name and marks those clusters as free space; the bytes lie exactly where they were until something else is written over them. On a hard disk that is the whole story. Flash has a second layer to it. A memory stick runs a controller of its own, and once it has power that controller may start clearing out blocks it now thinks are spare — unasked, and without telling anyone. So with flash, leaving well alone means keeping it away from a socket, not just declining to save anything to it. This one was won in the half-minute before anybody had worked out what had gone wrong.
What we used on this one.
Every step, in order →| The tools | What it did here | Why it helps |
|---|---|---|
| PC-3000 Flash | Pulled the NAND off in one go, before any housekeeping could start | Bypasses the controller to read the NAND itself, against a manufacturer-ID library kept up to date |
| R-Studio Technician | Restored the FAT32 entries that had been dropped, and the chains they pointed to | Reads nearly every file system, and rebuilds arrays you can rely on |
| UFS Explorer Professional Recovery | Checked the rebuilt tree again on a second tool, then opened every document by hand | Reads the volume formats that defeat most software: APFS, ReFS, XFS, ZFS, Btrfs |
How it went.
Touch the original once, and that is it
The stick was asked for one thing only: a sector-by-sector read that gave us a working image. Everything afterwards ran against the copy. Aim a recovery tool at flash that is still alive and it must first bring the device up to read even one byte, and bringing it up is what sets the housekeeping going. Once the image exists, that danger is behind you.
The old names were still in the table
Because nothing had been written to the stick after the bin went, each deleted record was still sitting in the directory table — name, timestamp and cluster chain all present. Follow those records and the folder comes back arranged the way its owner pictures it. Carving by file signature would have turned up the same bytes stripped of their names, dates and structure, and there was no call for it here.
Open every file, read every return
Every one of the four VAT returns was opened and read, and so was each invoice and each ledger export. A file can be precisely the right size and still be rubbish inside, so a byte count on its own tells you nothing. None of them was damaged. The books came back looking as though the bin had never been near them.
Signing it off.
Everything returned: the names, the folders, the dates, even the sequence the work had been done in. That quarter's return was filed on time. Nothing here is clever, which is rather the point. The whole thing turned on the first thirty seconds and a choice anyone could have made; the rest was procedure.
Pages people often read next.
More on corruption and lost files.
Is that what yours is doing?
Power it down, get it to us, and hold off on any decision until the diagnosis says what can still be read.