Data Recovery Case File · Formatted & Logical Faults · One File Is a Clue
A Single File, and a Machine Since Reset
Her enquiry describes a narrow loss with wide consequences. Her son's computer was affected by malicious software and "he lost his coursework as it was corrupted — only that file. He has downloaded it onto a USB stick. We have had the school tech support and computer teacher look at it and it is unrecoverable. He has cleaned and reset his computer and it is clear." Two things stand out. Only one file corrupting is unusual and informative — and resetting the computer, which felt like the responsible cleanup, removed the place most of the remaining answers were kept.
| Media | USB flash drive holding a single corrupted coursework document — source computer subsequently reset; school IT assessment completed without result |
| Reported situation | Computer affected by malicious software · a single coursework document corrupted with other files unaffected · document copied to a USB stick · assessed by school technical staff and a subject teacher without success · source computer since cleaned and reset · academic deadline in prospect |
| Fault class | Isolated file corruption with the source system no longer available — container reconstruction and alternative-copy routes indicated |
| Equipment used | Alternative copies identified before work on the corrupted file · stick imaged write-blocked · document container examined and internal components extracted directly · recovered text validated by opening |
The decode: what one file means, and where else it lives
Why a single corrupted file is worth noticing: malicious software that damages documents does not usually pick one. Encrypting ransomware works through everything it can reach; general corruption from a failing system is scattered. A single file damaged while everything around it is fine points more strongly at something else — most often that the file was open and being written when the system was interrupted. A document open in an application during a crash, a forced shutdown or a malware-triggered restart is precisely the file that ends up truncated or half-written, because it is the only one being modified at that moment.
Why that is a hopeful reading: a partly written document is a container with intact components inside it, not an encrypted or overwritten one. Modern word-processor documents are compressed archives holding the text as a separate internal component, so where the container itself is damaged the text can frequently be extracted directly even though nothing will open the file normally. That is a different and more successful technique than the repair function the school will have tried.
What the reset cost, said without reproach: cleaning an infected machine is the right instinct and the advice everyone gives. But the computer held the places a lost document most often survives — the application's autosave and recovery folders, temporary working copies, and the previous versions of the file itself. A reset removes all of them. The order that would have helped is to recover first and clean afterwards, which nobody thinks of at the time and which is worth knowing for anyone reading this before it happens to them.
Where to look now, and all of these are free and quick: any cloud account the document was ever saved to, checked through its web interface, which keeps server-side version history independently of the machine. Email — a draft sent to himself, to a teacher for feedback, or to a group is very often the complete document, and coursework is emailed more than people remember. The school network home drive, if work was ever saved there. And any printout, which will not restore a file but establishes what was written.
The thing to do today, separately from any recovery: tell the school. Institutions and exam boards have procedures for technical loss affecting coursework, and a factual note now is worth far more than an explanation after a deadline.
On the bench
Alternative copies were identified before any work on the corrupted file — cloud version history through the web interface, emailed drafts, and the school network home drive — since each returns a complete document and a reconstruction cannot better that. The stick was imaged write-blocked, and the document container examined with its internal components extracted directly rather than repaired: modern documents are compressed archives holding the text separately, so text is frequently recoverable from a container nothing will open. Recovered text was validated by opening.
The outcome
The alternative routes checked first, the stick imaged and the document's internal components extracted directly. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone who has lost one file to a corruption: a single damaged document with everything else intact usually means that file was open and being written when the system was interrupted — which leaves a partly written container rather than an encrypted one, and modern documents hold their text as a separate internal component that can often be extracted directly. Check cloud version history through a browser and search your email for drafts. And tell the school today.
One corrupted file with everything else fine
Search your email before anything else — coursework gets sent to teachers for feedback or to yourself as a working copy far more often than people remember, and an emailed draft is a complete document. Then check any cloud account through its website rather than the desktop app, since services keep server-side version history independently of your machine, and check the school network drive. The pattern is actually encouraging: malicious software that damages documents doesn't usually pick one, so a single corrupted file with everything around it intact usually means that file was open and being written when the system was interrupted. That leaves a partly written container, and modern documents keep their text as a separate internal component that can often be pulled out even when nothing will open the file. Tell the school today.
Check your email and cloud history first — then call Newcastle Data Recovery on 0191 406 1051; alternative copies identified before any charge, stick imaged write-blocked, document components extracted directly.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.