Logical & corruption · case notes · CDF-2025-0932
The Names Survived; the Sizes Did Not.
She pulled the stick out of a laptop in Caerphilly halfway through a save — I didn’t wait for it, I just yanked it
— and thought no more about it that afternoon. Next morning the folder still listed the lot: the portfolio, both assignments, every name where she had left it, every size reading 0 bytes
, the type column blank and each entry described as a plain File
. She double-clicked a few of them, hopefully. Then her ward mentor told her to put it down and let somebody look
.
Does that match yours? Call us.
0800 6890668
Why that happens.
A FAT volume keeps its stock list somewhere other than its stock. A short table holds the name of each file, what kind of file it is, how long it runs and which cluster it starts from; the bytes themselves sit further along the chip, indifferent to whether that table is right. Cut the power partway through an update and the record is left half-written — the length zeroed, the type gone — while her coursework stays in its clusters, untouched, exactly as it was written. Windows reads the table out and does not argue with it. So a full folder is announced as an empty one.
What we used on this one.
Every step, in order →| The tools | What it did here | Why it helps |
|---|---|---|
| PC-3000 Flash | Read every sector of the chip, believing nothing the filesystem claimed about it | Bypasses the controller to read the NAND itself, against a manufacturer-ID library kept up to date |
| R-Studio Technician | Put damaged entries back by comparing them with the second copy of FAT | Reads nearly every file system, and rebuilds arrays you can rely on |
| UFS Explorer Professional Recovery | Carved by signature wherever an entry could not be mended | Reads the volume formats that defeat most software: APFS, ReFS, XFS, ZFS, Btrfs |
How it went.
Copy the whole chip before anything is touched
Give a flash stick power and its controller sets about housekeeping — wear levelling, garbage collection — with no notion of which blocks a recovery is leaning on. So the first move was a flat read, sector after sector, onto bench disks. With that copy in hand, nothing tried afterwards could cost her a file.
Use whichever copy of the table came off best
FAT keeps two copies of the allocation table, and the interrupted write had treated one worse than the other. Wherever the healthier copy agreed with a directory entry that had come through, the record could be rebuilt in full — the name, the length, the whole chain of clusters. Files brought back that way are the originals, not something assembled to resemble them.
The rest had to identify themselves
A few entries were past mending, so those files had to announce what they were. A Word or PDF header spotted in the raw clusters, then the bytes behind it stitched back in sequence, and a filename put on only when the header or the first readable lines justified it.
Signing it off.
The bulk of the portfolio opened under its original name. A smaller heap came back carved, under machine-made names, and she spent an evening putting those in order. It all travelled home on a new stick, with one instruction: let the light finish before you pull it out.
Pages people often read next.
More on corruption and lost files.
Is that what yours is doing?
Power it down, get it to us, and hold off on any decision until the diagnosis says what can still be read.