External drives · erased volumes · ADR-2025-3674
One Prompt During Setup, and the Drive Was Empty.
A series of questions arise when setting up a brand-new Mac, and one of them relates to backing up. She pressed yes to erase the data without realising
what the 'yes' referred to, and as such the external hard drive which she had stored everything upon was completely blank. Following that, her instinct was sound: she haven't written over it since
. What happened next is where the situation became increasingly complicated. Applications to recover data (of the type that explicitly advertise themselves as being capable of recovering lost data) were downloaded/installed, and then subsequently run. Between them, the recovery applications that were utilised recovered some and most of the files now are not being possible to open
. The names of those that did successfully return, however, were not associated with any particular folder, but instead were scattered throughout in a random manner, and thus were located outside of the organised folders she had developed over the years. In essence, she queried as to whether this represented a viable solution, or whether an alternative option existed.
Same story on yours? Tell us what it does — the look is free.
0203 0868633
What failed, and why.
When an individual erases a storage device during a Mac's initial setup process, the operating system essentially writes a new, empty "description" over the old one. This new description indicates that the previously existing space is now available for writing. The erase does not go round the disk removing the information contained within the described space, so the actual content remains on the storage device. It exists in the exact same physical location it occupied prior to the erase, and it stays there until something fresh is written on top of it. That is why the decision to refrain from writing to the drive after the erase operation is the one that really matters, and she made it. The apps are a different issue altogether. They read what they can, utilise algorithms to guess at the rest, and then write out whatever they have assembled. These algorithms may correctly identify various pieces of data. However, they may also incorrectly identify other pieces of data. When incorrect identification occurs, the resulting output may contain accurate metadata (e.g., file name, size). However, it will lack any useful content. Furthermore, these outputs do not provide an indication of how much data actually resides on the drive. Instead, they represent an indication of how well a general-purpose algorithm was able to recover data unaided, and those two things are vastly different. Ultimately, the value lies in the physical drive she still had (as opposed to any potential output generated by the apps).
What the bench did with it.
The order of the job →| Equipment used | Its work on this job | The reason for it |
|---|---|---|
| DeepSpar Disk Imager 4 | The source drive was duplicated once in full, before any further demands were placed upon it. | Mapped the heads first, then imaged one face of a platter per pass, with every reset, timeout and the power itself kept under our own control |
| PC-3000 Data Extractor | Its condition was established first, so the copy was performed at a rate consistent with the capabilities of the source drive. | Instead of working around the drive's firmware and controller, it works with the two natively |
| UFS Explorer Professional Recovery | The erased Mac volume was read from the copy. All relevant folder structures were preserved wherever they had survived. | When other applications will not open it, this application will open APFS, ReFS, XFS, ZFS and Btrfs. |
What the bench did with it.
Work the drive, not the app's output
The files created by each application were set aside when the project started. These files document just one attempt and do not represent everything that is available. Thus, building on these files would have carried every incorrect assumption forward. A complete copy of the original drive was created first, in one full pass. After this initial copy was completed, every subsequent question was posed against the copy rather than the original drive.
Read what the erase left, not what it announced
An erase of this type leaves behind two types of data: the location or path (in whatever state) of the files which existed prior to the erase, and the actual content of the files. Both types of data were extracted from the copy. First, the descriptions (location/path/file etc.) were accessed/extracted, since this information provides the necessary links to restore photographs to their correct name and date. Second, any remaining file content that the descriptions could no longer locate was then extracted.
Structure is most of what a recovery is for
Returning a collection of numbered files does not equate to returning an organised body of work developed over many years. It was her organisational structure which she requested to be restored. In cases where descriptions (records) had survived for files, they were returned with their corresponding names, dates, and assigned folder locations. In cases where descriptions had not survived, the individual file contents were restored without their corresponding identifiers (names/dates/folders), and stored separately in order to prevent any file arriving under a name that was not its own.
What went home.
A considerable amount of information came back that the application programs could not recover, and most of it was placed in folders that she had created. All files were opened and examined prior to being sent to her, since having a file that will not open is exactly what she already had. The source drive was returned as she had left it. We determined the fee based upon the published pricing bands at £300 + VAT for a single drive, and confirmed this fee in writing prior to commencing any chargeable work.
Begin here if yours is doing the same thing.
Other desktop disks on the log.
Yours doing something similar? Power it down first.
Published prices are fixed. Memory cards and USB sticks are £250 + VAT. Any stand-alone drive is £300 + VAT. Drive configurations containing multiple disks (RAID, NAS or server) start at £500 + VAT. First assessments are always complimentary. Thereafter, data recovery charges are also fixed in advance and in writing, so you'll always know how much you owe before paying any money. Shut it down, get a quote first (by phone or with the form), then send it in or drop it off at our Guildford intake laboratory, Monday to Friday, 9am to 5:30pm (no appointment needed). On most jobs you only pay if we recover your data.