The cause · files that are no longer where they were
Stop using the machine. Then find out what kind of drive held the file, because that answer governs nearly everything else. On a hard disk a delete does two small things: the name comes off the index, and the clusters it used are marked reusable. The contents are undisturbed until some later file claims that space, which may not happen for weeks. An SSD behaves differently. TRIM passes the controller a list of the blocks it no longer needs, and the controller empties them unbidden, often before anybody has decided anything. Both are set out below. A card or a stick costs £250 + VAT, a drive £300 + VAT. The first look costs nothing, and on most jobs the bill only arrives with the files.
Put it to an engineer — the first look costs nothing
0203 0868633
| How it shows itself | The usual reason for it | Where that leaves you |
|---|---|---|
| It is not in the Recycle Bin either | The bin never held it — a memory card, a stick, a Shift+Delete, or an oversized file | Stop anything else being written |
| Over the size the bin accepts | Windows deleted it on the spot, and the bin was never involved | The contents are usually untouched |
| Absent from a camera card, or from a USB stick | Cards and sticks carry no bin, so the entry goes at once | Slide it out, and then let it be |
| It all went after a sync | OneDrive or the like has carried over a deletion made elsewhere | Check that service's own deleted items |
| A folder used daily, now empty | Deleted by somebody, a sync that misfired, or a second profile | Power it down before you search |
| An SSD, and the file has gone from the list | TRIM has reached the controller, and freed blocks empty in seconds | Pull the power out now |
A case number goes on it the day the parcel lands, and an engineer settles what has truly failed before anything else happens — free of charge, and first in the order of work. Back to you come two things together: a straight note of what is liftable and what is not, plus one figure, fixed and written down. Accept it, or decline and owe us nothing.
A machine that stays switched on keeps writing to its own disk all day, unprompted: thumbnails being cached, browser files, an update quietly unpacking. Every one of those writes lands wherever space is available, and the space your file occupied now counts as available. So the disk leaves the machine and gets imaged.
Where the index has survived, filenames, dates and the folder structure return together with the data. Where it has not, each file is pulled from the image on its own, identified by the signature its format starts with.
A count on a report proves nothing. Recovered files are opened here and looked at, with anything you named as important checked separately.
What was recovered is listed for you first, and only then does a bill exist. Approve the list and it is invoiced; turn it down and it is not — and where nothing has come back, most jobs carry no charge whatever. Recovered data travels home on fresh media bought in for your job, with the postage at our end. Your case is not closed until you have read those files on a machine of your own.
One keystroke, two completely different clocks. Bytes written onto platters can sit there for years and go only when a later file claims the room. Do the same over an SSD and TRIM may have emptied those cells before the kettle has boiled. Identical action, opposite outcome — which is why this bench asks about the drive before it asks about the file, and why the free look answers that on day one.
A single keystroke cleared a year of bookkeeping from the office machine at a Camden joinery firm, bin included. An image was made the day it arrived, the index was reassembled from that image rather than from the disk, and the folder returned entire with its filenames and dates.
The answer belongs to the medium, not to the file. On platters, what was written sits in its sectors until some other file needs the space, and these jobs mostly end well. An SSD with TRIM enabled clears the freed blocks by itself, and it often does that before the machine has even been shut down.
Not on a hard disk. Shift+Delete only misses out the bin; both routes hand back the same clusters, and what sits in them does not move. The Recycle Bin was a convenience, never a safeguard.
There is not. Answer the prompt on a memory stick, or on a camera card, and it is done there and then, with nothing held in reserve. What was written is normally still down at flash level, and flash level is where our tools work — the chips themselves, not the directory sitting on top.
Because it keeps its own house. TRIM lets the file system announce which blocks it no longer wants, and instead of waiting for a new write the controller clears them in advance. None of that shows up anywhere you can see. An SSD leaves you minutes; a hard disk can leave you weeks.
Looking at it is free. Back comes a list of what opened and what did not, together with a single price to finish, set down in writing while you are still free to say no. On most jobs an invoice only follows the data. Until that list reaches you, leave the drive switched off.