Data Recovery Case File · Second Fixes & Trade Handoffs · Wrong Blocks, Right Size

The Recovery Succeeded and the Files Do Not Work

His enquiry described an outcome that feels like bad luck and is usually something more specific. A family accidentally deleted important documents: "I have managed to recover them using a consumer recovery application, but the files seem to be corrupt. They're documents and PDFs. Would this be something you are able to repair?" The instinct is to ask for the recovered files to be mended. That is almost always the wrong direction. Files that come back corrupt have generally been assembled incorrectly rather than damaged — which means the material to work from is the original drive, not the broken output, and the original must not be disturbed.

The decode: why the output is broken, and where the real material is

What consumer tools actually do: when the index describing a deleted file is gone, they scan for recognisable file signatures and assemble whatever follows into a file. That works well when a file was stored in one continuous run. It fails when the file was fragmented — stored in several pieces scattered across the drive — because the tool has no reliable way to know which pieces belong together or in what order. So it takes the start of the file and appends whatever follows it physically, producing something of roughly the right size, with a valid beginning, containing other files' data partway through.

Why that presents exactly as corruption: the application opens the file, reads a valid header, starts parsing, and hits contents that make no sense. It reports the file as corrupt, which is true of the output and says nothing about the original. The data on the drive may be entirely intact and simply have been collected wrongly.

Why repairing the output is the wrong approach: repair tools work by discarding whatever they cannot parse and salvaging the rest, so repairing a misassembled file at best returns the fragment before the join. The correct move is to go back to the source and recover properly — using the filesystem's remaining index records and journal history to establish where each file's pieces actually were, rather than carving blind. That is the difference between a tool guessing at fragmentation and a reconstruction that knows the answer.

The urgent instruction: stop using the source. Everything above depends on the deleted content still being physically present, and every hour that machine runs writes something — updates, caches, logs, temporary files. If the drive is a solid-state one, this is more pressing still, because the controller erases blocks marked as free during its own housekeeping. The recovered files should also be kept: they establish which files existed and what they were called.

The encouraging part about these formats: both are structured containers rather than flat data. Modern word-processor documents are compressed archives holding the text as a separate component, so even where a container is incomplete the text can frequently be extracted directly. PDFs carry an internal cross-reference table that can often be rebuilt from the objects still present. Partial recoveries in these formats are frequently more useful than they first appear.

On the bench

The source drive was removed from use immediately, since everything depends on the deleted content remaining physically present and a running machine writes continuously. It was imaged write-blocked before any further recovery. Recovery then worked from the filesystem's remaining index records and journal history rather than carving blind — establishing where each file's fragments actually sat, which is precisely what a signature scan cannot know and what produces misassembled output. Document containers were validated by opening, and internal text extracted directly where a container remained incomplete.

The outcome

The source imaged before anything else, files reconstructed from index and journal records rather than carved, and every document validated by opening. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose recovered files will not open: they were probably assembled wrongly rather than damaged — consumer tools scan for file signatures and append whatever physically follows, which works for files stored in one run and fails for fragmented ones, producing a valid header followed by another file's contents. So don't repair the output; go back to the source, which likely still holds the data intact. Stop using that drive now, and keep the broken files as a record of what existed.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.