Case file · Logical & corruption · MKD-2025-4932
Pulled Out While the File Was Still Writing.
Half four, a Bedford library closing up, and I tugged it out while the file was still writing
. Next morning the names were all there and every one read 0 bytes
, with the type column showing a bare File
. Her ward mentor’s leave it alone and get it looked at
arrived after a few hopeful clicks. Waiting on it: a portfolio and two assignments.
Same fault? Start here.
0800 6890668
Without the jargon.
A file that still has a name but claims to be empty has lost its paperwork, not its contents. FAT keeps a directory table — name, flags, size, starting cluster — in one place, and the file’s actual bytes somewhere else entirely. Interrupt the stick while that table is mid-update and the entry is left half written: size set to nought, type field blank, while the clusters holding her essays sit untouched further along the chip. Windows only ever repeats what the table claims, so it will describe a full folder as empty and mean every word of it.
The kit this job needed.
See how a job runs here →| Kit | Why it was used | What it gives us |
|---|---|---|
| PC-3000 Flash | Read the stick out sector by sector, paying no attention to what the filesystem claimed | Pulls data straight off the flash chips, matching each part to a constantly updated ID library |
| R-Studio Technician | Put the broken entries back together using the spare copies FAT maintains | Copes with almost any file system; dependable array rebuilds |
| UFS Explorer Professional Recovery | Signature carving for the small number of entries beyond mending | Ahead of the pack on difficult filesystems: APFS, ReFS, XFS, ZFS, Btrfs |
What happened on the bench.
Take a complete copy before anything else happens
Every time a stick is remounted its controller may start tidying, and its idea of tidy takes no notice of which clusters a recovery still needs. So the first move was a straight sector read onto the bench. Once that frozen copy existed, nothing anyone tried afterwards could cost her a file.
Rebuild from whichever spare table survived
FAT holds two allocation tables, and the interruption had not hurt both equally. Where the healthier table and the surviving directory entries told the same story, whole records went back together — name, size and cluster chain as one piece. That is the difference between handing back a file and handing back a guess.
The rest had to speak for themselves
A handful of entries could not be mended. Those files were found by their internal markers instead — Word and PDF headers picked out of the clusters, the contents stitched back in order, and names restored only where a header or the opening lines gave real grounds for one.
The outcome.
Most of the portfolio opened normally under its proper name. A smaller group came back with carved names and had to be sorted by hand. The lot went onto a new stick, and she now waits for the light to stop blinking before anything gets pulled out.
Other jobs from the casebook.
Also filed under Logical & corruption.
Does that sound like your device?
One lesson runs through the lot: cut the power, let us look for free, then decide with the facts in hand.