Data Recovery Case File · Solid State & Flash · The Wrong Target
Disk-Imaging Software Pointed at the Wrong Device
His enquiry described one of the fastest ways to lose data that exists, and it takes a single mis-click. A 64GB Kingston USB drive: "the issue was I was using disk-imaging software to create" a bootable device, and it wrote to this one instead. Tools of that kind exist to write a system image directly onto a drive, sector by sector, and they do it without asking twice. The good news is narrower than people hope and better than they fear — because a bootable image is usually far smaller than the drive it is written to, and what it overwrites is the beginning rather than the whole.
| Media | 64GB USB flash drive — overwritten by disk-imaging software intended for a different device; previous contents required |
| Reported situation | Disk-imaging tool used to create bootable media · wrong target device selected · image written directly to the drive · previous contents no longer accessible |
| Fault class | Partial sequential overwrite — filesystem structures and leading data replaced; later regions typically untouched |
| Equipment used | Drive removed from use immediately · imaged write-blocked (DeepSpar USB Stabilizer 10Gb) · overwritten extent measured · signature carving across all regions beyond the written range · files validated by opening |
The decode: what was actually overwritten, and why the rest survives
How these tools work: they write a complete disk image to a device sequentially from the start, replacing everything in their path — the partition structures, the filesystem, and the data that lay in those sectors. There is no filesystem-level operation involved and nothing is preserved. That is why they are effective for creating bootable media and why they are so destructive when aimed wrongly.
Why the damage is bounded: the crucial arithmetic. A bootable image is typically a few gigabytes; his drive is 64GB. The write stopped when the image ran out, which means everything beyond that point — potentially the great majority of the drive — was never touched. So the files that lived in the earlier portion are gone, and the files that lived beyond it are physically intact. What has certainly been destroyed is the filesystem, because that lives at the beginning: the index describing where everything is was in the first region written.
What that means for the result: recovery is by carving rather than reconstruction. With the filesystem overwritten there is nothing to rebuild, so files are identified by their own internal signatures across the untouched regions and written out. That returns the contents without folder structure, and usually without original filenames — photographs, documents and video come back, organised by type and date rather than by where they used to sit. On a working drive that is a good outcome; it is simply not the same as a clean rebuild.
The one thing that decides how much survives: how large the image was relative to the drive. A small bootable image on a large drive leaves most of it intact. A full-size image, or a tool configured to zero the whole device first, leaves nothing. That is established by measuring the written extent on an image of the drive, which is the first thing done.
What must not happen now: the drive must not be used, formatted, or written to again — including by another attempt at making bootable media. And it must not be booted from, because a live system writing to its own boot device consumes exactly the untouched space that holds his files.
The habit worth changing: disk-imaging tools list devices by size and label, and the wrong one is one click away. Unplugging every other removable device before writing is a five-second habit that eliminates the entire category.
On the bench
The drive was removed from use immediately and imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb. The overwritten extent was measured first — establishing exactly how far the image had written before it ended, since that single figure determines how much of the drive was never touched and therefore what can be expected. Signature carving then swept all regions beyond the written range, recovering files by their own internal structure since the filesystem describing them no longer existed. Every recovered file was validated by opening.
The outcome
The overwritten extent measured, the untouched regions carved and the surviving files validated and delivered. Free assessment, one fixed written figure including VAT; where a chip has to be removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone who has imaged over the wrong device: these tools write sequentially from the start and replace everything in their path, so the filesystem is certainly gone — but a bootable image is usually far smaller than the drive, and everything beyond where it stopped was never touched; recovery is therefore by carving, returning your files without folders or original names. Stop using the drive entirely, and never boot from it.
Wrote a disk image to the wrong drive
Unplug it and don't use it again — and take some encouragement from the arithmetic. Imaging tools write sequentially from the very start of a device, so they've certainly destroyed the filesystem, which lives at the beginning. But a bootable image is usually only a few gigabytes and your drive is much larger, which means everything beyond where the write stopped was never touched at all. Those files are physically intact and recoverable by carving — returning your documents, photographs and video identified by their own internal structure, though without folders or original filenames. Whatever you do, don't boot from the drive, because a running system writes to its own boot device and would consume exactly the untouched space holding your files. In future, unplug every other removable device before writing an image.
Stop using it now — call Newcastle Data Recovery on 0191 406 1051; imaged write-blocked, overwritten extent measured, untouched regions carved and every file checked by opening.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.