Data Recovery Case File · Formatted & Logical Faults · Not a Deletion Problem

The Scan Failing Is the Finding

Her enquiry contains a sentence that reads as an excuse and is actually a diagnosis. Having accidentally deleted photographs and video transferred from her phone, and having run recovery software without success: "I have just received my laptop back from a retailer who said they have not been able to complete the scan on the hard drive, which has prevented them successfully restoring the data." That is not a failure to try. A scan that cannot complete is telling you the drive cannot be read — which means this was never primarily a deletion problem, and explains why nothing anybody ran could find anything.

The decode: what an incomplete scan means, and the order that fixes it

What a recovery scan does: reads the entire surface of the drive, looking for file signatures and index remnants in every region including the free space where deleted files sit. It is by definition a full-surface read.

So what it means when one cannot finish: the drive could not be read all the way through. Somewhere in that surface are regions that return errors, take too long, or cause the operation to stall — and the software, which is not designed to handle that, gives up or hangs. The scan failing is a report about the drive, not about the deletion.

Why that reframes the whole case: she has been treating this as a deletion and it is a deletion on top of a failing drive. That explains everything else. Her own software found nothing because it could not reach the regions where the deleted files live. The retailer's attempt failed for the same reason. Both outcomes are consistent, and neither says anything about whether the photographs survive.

Why the order matters so much, and this is the useful part: you cannot recover deleted files from a drive that cannot be read. The correct sequence is the reverse of what everybody attempts. Image first, then recover. The drive is captured with per-sector timeouts — each difficult sector given a strict budget and deferred rather than allowed to stall, with weak regions revisited on later passes — producing a complete image file. Recovery software is then run against the image, where every scan completes reliably because an image is an ordinary healthy file with no failing regions in it.

Why that also protects her: each full-surface scan attempted so far has been hours of sustained reading of exactly the failing areas, repeatedly, on a drive that is already struggling. Imaging once and working from the copy means the drive is read carefully a single time and then set aside.

The instruction now: stop using the laptop entirely. Deleted files survive only until their space is reused, and a machine in daily use writes continuously — while every further scan is more load on a drive that has already shown it cannot sustain one.

On the bench

The machine was removed from use immediately, since deleted content survives only until its space is reused and each further scan is hours of sustained reading on a drive that has already failed to sustain one. The Atola Insight Forensic assessed error rates to establish how the failing regions were distributed. The drive was imaged write-blocked under per-sector timeouts with weak regions revisited on later passes, and recovery was performed against the image rather than the drive — where scans complete reliably because an image is an ordinary file. Files were validated by opening.

The outcome

The drive imaged under timeout control and recovery run against the image, with files validated by opening. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose recovery scan could not complete: that sentence is a diagnosis rather than an excuse. A scan reads the entire surface, so one that cannot finish means the drive cannot be read through — which explains why no software has found anything, and it is a statement about the drive rather than the deletion. Image first, then recover from the image.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.