Case notes · Logical & corruption · EDR-2025-3117
A Year-End Tidy That Went One Folder Too Far.
Tidying his stick at year-end, a self-employed bookkeeper from Yeovil sent a whole client's folder to the bin and emptied it
— twelve months of invoices, workings and VAT returns, when the stick is the only place those accounts live
. Then came the valuable part: he pulled it from the port, put it in a drawer, and rang us instead of experimenting.
Sound familiar? Talk to us.
0800 6890668
In plain English.
A delete is bookkeeping, not destruction. The filesystem crosses the entry off its ledger and marks those clusters spendable; the contents sit exactly where they were until something new claims the ground. His drawer kept that from ever happening. Flash brings one extra trap worth knowing about: a stick's controller can quietly recycle freed blocks whenever it has power, without the computer asking — so real restraint means leaving the thing unplugged altogether, not merely saving nothing more to it. A drawer, as it happens, is the textbook.
The tools this job took.
See how your case runs →| System | The part it played | Why we rate it |
|---|---|---|
| PC-3000 Flash | Captured the stick's contents while giving its controller no chance to tidy | Reads the memory chips themselves, matching each one against an up-to-date identification library |
| R-Studio Technician | Raised the crossed-off FAT records complete with their runs of clusters | Handles most filesystems; dependable RAID reassembly |
| UFS Explorer Professional Recovery | Gave the tree a second, independent pass and proof-read each document inside | Handles the harder filesystems well — APFS, ReFS, XFS, ZFS and Btrfs |
On the bench.
One read, then the original goes back in the drawer
The only thing ever asked of the stick was a single low-level pass to produce a working image; every tool after that ran against the copy. Aim recovery software at original flash and the mere act of powering it can start the housekeeping you are trying to outrun. The image takes that gamble off the table entirely.
The ledger survived — so read it, don't dig
With nothing written since the mistake, the deleted records still lay in the file table carrying their names, dates and cluster runs. Recovering through those records hands back a folder that looks exactly as it did before the bin was emptied. Carving by signature was never needed — that route returns the same bytes as a mound of untitled, undated documents.
A file isn't back until it opens and adds up
Every invoice, ledger export and VAT working was opened and read, because a document can occupy its full length on disk and still be scrambled inside. None was. Twelve months of a client's bookkeeping behaved as though the folder had never gone.
How it ended.
The client year returned whole — names, folders, dates, the lot — and the filing deadline was met with days in hand. No heroics feature in this entry, which is precisely the point: he spent his first thirty seconds wisely, and everything else followed from that.
More like this in the casebook.
More cases filed under Logical & corruption.
Sound like your drive?
Every case here points the same way: power the device down, take the free diagnosis, then make your decision.