Data Recovery Case File · Formatted & Logical Faults · Accepting Was the Cost

The Repair Made It Worse

This enquiry came from a parent on a student's behalf and describes a sequence that takes about thirty seconds. "She had inserted the stick into the university computer today and it alerted her with an error message saying that she needed to 'fix' her USB, which she attempted to do. Now she is unable to access any of her work, as a new error message informs her 'you need to for'"mat it. An error, an offer to fix, an acceptance, and a worse error. The stick had a problem before she pressed anything — but the repair is what turned an unreadable volume into one demanding to be erased.

The decode: what the fix did, and why the second error is worse

What a repair operation actually is: not an inspection. It reads the filing structures, forms a conclusion about what they should look like, and writes that conclusion back to the device. On a volume with minor inconsistency that works well and is exactly what the tool is for. On a volume that is genuinely damaged, the conclusion is drawn from unreliable information and then written over the real structures — so the tool replaces a damaged description with a wrong one, and discards whatever it could not account for.

Why the second message is worse than the first: the original error meant the system found something it could not interpret. The new one means the system now finds nothing usable at all. Between those two states, the only thing that happened was the repair. A repair that fails leaves things largely alone; a repair that runs to completion on damaged structures is the destructive outcome — and it is the one that looks like it worked.

Why she cannot be blamed for accepting: the prompt is worded as help, it appears at the moment of the problem, and on a shared institutional machine people are conditioned to accept prompts because the alternative is usually being locked out of something. A student in a library with work due is exactly the person that dialogue catches. The prompt is the trap, not the person.

The instruction now: refuse the format, take the stick out, and do not put it into another machine that might prompt again. Every insertion into a managed or shared computer risks another automatic offer.

Why the outlook is still reasonable: neither the original fault nor the repair overwrote the coursework itself. Filesystem operations act on small structural regions; the documents sit in the data area, untouched. Recovery works from an image, using pre-repair structures where they survive and carving by signature where they do not — which returns documents, though possibly without their original names.

The three free checks first, and they matter given the deadline: the university's own network storage, since work saved there is unaffected; any cloud account the documents touched, checked through its web interface for version history; and email, because coursework drafts sent to a tutor or to herself are complete documents. Any of those beats a recovery on speed.

The point worth carrying: when a shared machine offers to fix removable media holding something that matters, the answer is to eject and take it elsewhere.

On the bench

The format was refused and the stick removed from use, since every insertion into a managed machine risks another automatic repair offer. It was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb before any reconstruction. Pre-repair structures were located where they survived — filesystems maintain backup copies of key structures away from the primary ones, and a repair frequently rewrites only the primary set — with signature carving alongside for what the tool had discarded. Files were validated by opening.

The outcome

The format refused, the stick imaged before any reconstruction and pre-repair structures recovered where they survived. Free assessment, one fixed written figure including VAT; where a chip has to be removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone offered a repair on removable media: those tools do not inspect and advise. They decide what the structures should look like and write that back — which works on minor inconsistency and is destructive on real damage, because the conclusion comes from unreliable information. Refuse the format now, and check the network drive, cloud version history and emailed drafts first.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.