Data Recovery Case File · Second Fixes & Trade Handoffs · Establish What Was Done
Taken In Slow, Returned Empty
His enquiry is frustrated and entitled to be. A laptop taken in for repair "as it was running slow. They reset all the system but in turn lost all my data. They have tried twice to recover the data and failed and I am so frustrated at this data loss." Two attempts by the people who caused it, both unsuccessful, and he is now looking elsewhere. Before any recovery is discussed there are two facts to establish, and both are things only that shop can tell him — because what was actually done determines whether this is straightforward or serious, and one of them may mean the data was never on the drive he has.
| Media | Laptop internal drive — system reset performed during a third-party repair for performance problems; user data no longer present; two unsuccessful recovery attempts by the same party |
| Reported situation | Machine taken in for performance problems · system reset performed during the repair · user data no longer present afterwards · two recovery attempts made by the repairer without success · machine returned to the owner |
| Fault class | Data loss through a third-party reset or reinstallation — extent determined by the operation performed and by writes since; original drive status to be established |
| Equipment used | Nature of the operation and drive history established before assessment · machine removed from use immediately · drive imaged write-blocked before any reconstruction · previous filesystem structures located and rebuilt on the image · signature carving alongside |
The decode: the two questions, and why they decide everything
First question — what operation was actually performed? The answer changes the outlook enormously and the shop knows it. A reset that keeps files would not have caused this. A reset that removes everything or a clean reinstallation writes a new filesystem and tens of gigabytes of system files across the drive, replacing structures and consuming space. A full format is worse again. And a secure erase is final. These are very different operations with very different outcomes, and "they reset the system" covers all of them. He should ask, plainly and in writing, what was run.
Second question, and this one can transform the case — is it the same drive? Machines taken in for slowness are frequently upgraded, and replacing a mechanical drive with a solid-state one is the standard remedy for exactly that complaint. If the drive was swapped, his data is not on the drive in the machine at all — it is on the original, which the shop may still have, may have wiped for reuse, or may have disposed of. That single question can turn an expensive reconstruction into a request to have the old drive returned, and it is asked far too rarely.
What their two failed attempts tell us: less than it appears. General repair shops run consumer recovery software, which scans for signatures and works well on a simple deletion and poorly on a drive that has had a new operating system written across it. Their failure indicates the tool was unequal to the situation, not that the data is gone.
The instruction that matters now: stop using the machine, today. Everything depends on the old content still being physically present, and a laptop in daily use writes continuously — updates, caches, logs, temporary files — into precisely the space it occupies. If the drive is solid-state, this is more pressing still, because the controller clears space marked free during its own housekeeping.
What is genuinely recoverable: where a reset or reinstall wrote a new filesystem over an old one, the previous structures frequently survive in part — filesystems keep backup copies of their key structures at known positions away from the start of the volume, and a new installation does not necessarily disturb them. Where they can be located, files return with folders and names. Where they cannot, carving recovers content by signature without names or organisation.
On the relationship with the shop: worth keeping civil and worth keeping open, because they hold the two answers that matter and possibly the original drive.
On the bench
The nature of the operation and the drive's history were established before assessment — specifically whether a reset preserving files, a reset removing everything, a reinstallation or a format had been performed, and crucially whether the drive in the machine was the original, since a swapped drive means the data is elsewhere entirely. The machine was removed from use immediately, the drive imaged write-blocked before any reconstruction, and the previous filesystem structures located and rebuilt on the image from their surviving backup copies, with signature carving alongside.
The outcome
The operation and drive history established first, the machine taken out of use and the previous structures rebuilt from the image. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose repair returned an empty machine: ask two questions in writing. What operation was run — a reset keeping files, a reset removing everything, a reinstall and a format are very different. And is this the same drive, because machines taken in for slowness are routinely upgraded, and if yours was swapped your data is on a drive the shop may still hold. Stop using the machine today.
Repair that came back with your data gone
Ask the shop two things in writing before anything else. First, exactly what operation was performed — a reset that keeps files, a reset that removes everything, a clean reinstall and a full format are very different, and "we reset it" covers all of them. Second, and this one can change everything: is the drive in the machine the original? Laptops taken in for slowness are routinely upgraded to a solid-state drive, and if yours was swapped then your data was never on the drive you have — it's on the old one, which they may still have. That question turns an expensive reconstruction into a request for your property back, and it's asked far too rarely. Meanwhile stop using the machine today, because it writes continuously into the space your files occupy.
Ask whether it's the same drive — then call Newcastle Data Recovery on 0191 406 1051; operation and drive history established first, imaged write-blocked, previous structures rebuilt from the copy.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.