Data Recovery Case File · Helpers, Family & Community · The Honest Question
"Am I wasting my time — or is it a pointless exercise?": partly, and no — the difference between re-running consumer tools and asking the deeper structures, answered with a ledger
His enquiry was the competent helper's incident report, right down to the forensic detail. The managing director's notebook "seems like it was reset — all his data was gone. I found a $sysreset folder on the C: drive, so assume that's what happened: a Windows reset." Correct assumption — that folder is the reset process's own leavings, and finding it is proper detective work. Then the rescue attempt and its result: "I recovered his files using some software, but none will open — all seem to be corrupt. Tried various software to try and repair them but no joy." The stakes: "around a year's worth of work… around 4GB in Excel/Word files that he's never backed up." And then the question that earns this enquiry its place in the archive, asked without ego: "Am I wasting my time — do you know of any tools that could help repair them, or is it a pointless exercise?" Honest questions deserve honest answers, so here is the whole of it: re-running consumer tools — yes, at this point, wasted time. The exercise itself — no, not pointless, because the deeper structures haven't been asked yet. And some of that year is likely gone regardless, which this page will say plainly rather than at the end of an invoice.
| System | Windows notebook, post-reset — a year of the managing director's Excel and Word files (~4GB) unbacked-up at the moment of the sweep; $sysreset artefact identified by the enquirer |
| Reported attempts | Consumer recovery software run: files listed and extracted, none open · multiple repair utilities attempted on the corrupt output: no improvement · machine's subsequent use not extensive |
| Fault class | Mass deletion with partial overwrite — a reset's reinstall re-using freed space beneath the recovered filenames |
| Equipment used | Full write-blocked imaging · deep-structure analysis: journals, shadow-copy remnants, application autosave and temporary locations · overwrite mapping per file · itemised recovery of intact generations |
The decode: why the recovered files were corpses with correct names
What a reset actually does: it deletes the user's world and then immediately reinstalls an operating system into the freed space — thousands of fresh files written in the same hour as the mass deletion. It is the double blow that makes this genre harsh: not deletion followed by merciful idleness, but deletion followed by a construction crew.
Why his recoveries wouldn't open: his software did what such software does — read surviving name-and-location records and copied out the clusters those records pointed to. But some of those clusters had already been re-used by the reinstall. The result is the signature corpse of the partially-overwritten file: right name, plausible size, wrong bytes — original content stitched to fresh strangers' data at the seams. Office documents make it worse: they are structured containers, and one alien chunk breaks the parsing of the whole. Which also acquits his repair tools honestly: repair utilities fix structure around surviving content. They cannot regrow content that was overwritten — nothing can, and any tool or lab claiming otherwise has left engineering for fiction.
Why the exercise isn't pointless: because listed-names recovery is the shallowest layer, and a reset's construction crew doesn't rebuild everywhere. Beneath it live the filesystem's journals and index mirrors, remnants of shadow copies, and — richest of all for exactly his file types — the autosave and temporary locations where office applications squirrel away generations of working documents in places a reset's writes may never have touched. The honest position before assessment: the recoverable fraction is genuinely unknowable from outside — which is precisely what free assessment under no-recovery-no-fee is for. Asking costs nothing; re-running carvers costs hope.
The recovery: the deep structures asked, the ledger kept per file
The notebook's drive was imaged write-blocked, and the analysis ran on the copy — mapping, for the year's named documents, exactly which clusters had survived and which the reinstall had claimed. From the deeper layers came the genuine article: intact autosave generations of the current working files, recoverable shadow-copy fragments, and a substantial population of documents whose clusters the construction crew had simply never reached. Each candidate was opened and tested, not just carved and counted — the difference his first experience makes vivid.
The outcome
An itemised, honest ledger in two columns: recovered-and-verified — the majority of the year, including recent generations of the workbooks the managing director cared most about — and named-but-overwritten, listed plainly so nothing was left ambiguous. Delivered with a short plain-English note for the MD and the technical detail for the helper who sent it in. Free assessment, one fixed written figure including VAT, no recovery, no fee. His question deserved a straight answer at the start; his boss's data deserved the deep pass; both got what they deserved.
Machine reset by accident — recovered files won't open
Stop using the machine immediately: every boot and browse writes into exactly the space the missing files need. Read "recovered but corrupt" correctly — it means partial overwrite, and no repair utility regrows overwritten bytes, so further consumer passes spend risk for nothing. The deeper structures — journals, shadow remnants, application autosaves — are a different question and often a kinder one. And the year-without-backup lesson lands gently but permanently: work that would hurt to lose twice deserves to exist twice.
The deeper structures haven't been asked yet — call Edinburgh Data Recovery on 0131 202 0491; honest itemised ledger, one written figure, no recovery, no fee.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.