From the bench · Logical & corruption · MKD-2025-5117
I Only Twigged at the Traffic Lights.
A Bletchley bookkeeper was making room on the stick before a client visit. One wrong folder went to the bin, he took the prompt that empties it, and a year went with it: sales ledger, purchase invoices, four VAT returns. I only twigged at the traffic lights
, he told us, and that stick is where those accounts live
. Then the useful part. It met no port again — glovebox, then a phone call.
Same fault? Start here.
0800 6890668
Without the jargon.
Deleting is an accounting entry, not a shredder. The filesystem strikes the name off its list and marks those clusters as spare; the contents stay put until a later write spends that ground. His glovebox made sure nothing ever did. Flash adds a wrinkle people rarely hear about: given power, a stick's controller may go tidying freed blocks on its own initiative, with no instruction from the computer at all. So restraint means leaving it out of every socket, not merely declining to save anything new. Which is, as it turns out, what a glovebox is for.
The kit this job needed.
See how a job runs here →| Kit | Why it was used | What it gives us |
|---|---|---|
| PC-3000 Flash | Pulled a complete read while denying the controller any housekeeping time | Pulls data straight off the flash chips, matching each part to a constantly updated ID library |
| R-Studio Technician | Brought back the struck-out FAT32 directory entries, cluster chains and all | Copes with almost any file system; dependable array rebuilds |
| UFS Explorer Professional Recovery | Walked the same tree again with different code, then checked inside every document | Ahead of the pack on difficult filesystems: APFS, ReFS, XFS, ZFS, Btrfs |
What happened on the bench.
One read only, then the original is put away
The stick was asked for exactly one thing: a single low-level pass to build a working image. Everything afterwards ran on the copy. Point recovery software at live flash and the act of powering it can trigger the very housekeeping you are racing. Work from an image and that risk is simply not in the room.
The list was still there, so we read it
Nothing had been written since, so the deleted entries still sat in the directory table with names, timestamps and cluster chains attached. Recover through those and the folder comes back looking the way he left it. Signature carving was never on the table: it returns identical bytes as a heap of nameless, dateless files with no folders round them.
Recovered means it opens and the totals agree
Each invoice, each ledger export, each VAT return was opened and read. A file can measure the right size on disk and still be nonsense inside, so size proves nothing. Nothing was scrambled. A year of one client's books behaved as if the bin had never been emptied.
The outcome.
The year came back entire: filenames, folder layout, dates, the running order, all of it. The quarter's VAT return went off with days to spare. There is no cleverness anywhere in this entry, and that is rather the point. He got the first half-minute right, and everything after that was just process.
Other jobs from the casebook.
Also filed under Logical & corruption.
Does that sound like your device?
One lesson runs through the lot: cut the power, let us look for free, then decide with the facts in hand.