Data Recovery Case File · Formatted & Logical Faults · Two Steps, Compounded

The Second Step Was the Expensive One

His enquiry describes an ordinary problem solved into a much bigger one. A laptop with a boot configuration error that would not start and a recovery partition he could not reach: "I tried to reboot after downloading the installer to a USB drive and accidentally formatted the drive. I have since reinstalled the system and attempted the recovery tool with little success." The format was a mis-click anybody could make. The reinstallation afterwards is what changed the arithmetic — and understanding why matters, because the same sequence happens constantly and the second step is always optional.

The decode: what each step did, and what the arithmetic leaves

What the format alone would have cost: very little, in the scheme of things. A quick format writes a fresh empty index and marks the data area available — it does not visit the data. Had he stopped there, essentially everything would have been recoverable, and the previous filing structures could very likely have been rebuilt from their backup copies, returning files with folders and names intact.

What the reinstallation did: the real damage. A full installation writes a new partition structure, a new filesystem, and tens of gigabytes of system files — and then updates, page files, caches and logs on top. All of that goes into space the format had marked as free, which is precisely where his data was. The format made the space available; the installation used it.

Why the arithmetic still matters, and this is the encouraging part: an installation occupies a bounded amount — typically twenty to forty gigabytes with everything that follows it, and installations write from the beginning of the free space outward. On a drive substantially larger than that, the region beyond what was written was never touched by either step. So the question is not whether anything survives but how much of the drive lies beyond the installed footprint, and on a large drive that can be most of it.

Why files in that region come back without names: the original index was replaced by the format and the region holding the replacement was overwritten by the installation. So recovery there is by carving — files identified by their own internal signatures and written out, organised by type and date rather than by folder. That is a real result and it is not a clean rebuild.

Why the vendor recovery tool found little: those tools look for a filesystem to repair or perform a generic scan, and both were replaced. Their failure reflects the tool rather than the prospects.

The instruction that matters most now: stop using the machine, today. It has a working installation on it, which means it is writing continuously — updates, telemetry, caches, temporary files — into exactly the space his remaining data occupies. Every day of use costs some of it. If the drive is solid-state this is more pressing still, because freed space is cleared by the controller unattended.

The lesson for anyone about to make installation media: unplug every drive except the target, and read the drive letter and the size twice. The tools list devices by capacity and label, and the wrong one is one click away.

On the bench

The machine was removed from use immediately, since a working installation writes continuously into precisely the space the surviving data occupies. It was imaged write-blocked before any reconstruction, and the installation extent measured against total capacity — establishing how far the new system had written from the start of the drive, since that single boundary determines how much lies beyond it untouched. Previous structures were located beyond the written region where they survived, signature carving swept the unwritten areas, and files were validated by opening.

The outcome

The machine taken out of use, the installed extent measured and the untouched regions carved and validated. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone who formatted and then reinstalled: the format alone costs very little, because it writes an empty index and marks space available without touching the data. The installation is what spends it, writing tens of gigabytes into exactly that space. But installations write from the start outward and occupy a bounded amount, so on a large drive most of it may lie beyond the footprint. Stop using the machine today.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.