Data Recovery Case File · Formatted & Logical Faults · The Backup That Made the Installer

Two terabytes wearing a 31.9GB disguise: the installer's footprint mapped honestly, the old volume rebuilt behind it — and the restore completed with the very image the accident had buried

She prosecuted herself in the first line — "in a moment of stupidity, I reformatted my external Toshiba 2TB Canvio when I loaded Windows installation media onto it" — and this page's first duty is to enter a defence. The drive contained "my only backup of a laptop image (that I was trying to restore), as well as many other files" — the recursion that gives this case its title: the backup consumed in manufacturing the tool meant to use it. The aftermath she described precisely: "currently the drive is partitioned and only shows up as an installer volume with a total capacity of 31.9GB." Her priority, stated like a project brief: "the system image, so I can use it to restore my laptop — a folder about 250GB in size." Could it be helped? Yes — and the decode below explains the two numbers her enquiry turns on: why a media-creation tool shrinks a 2TB drive to exactly 31.9GB, and how few of those two thousand gigabytes the installer actually touched.

The decode: the shrink, the footprint, and the defence her opening line deserved

The 31.9GB riddle, solved: the media-creation tool doesn't merely copy an installer — it repartitions the target into a small volume of a fixed, compatibility-driven size (a shade under 32GB, the ceiling of the old filesystem it uses), and declares the rest of the drive to nobody. Her 2TB didn't shrink; it was re-described: a small new front room built at the drive's entrance, with one thousand nine hundred and change gigabytes of the old house standing behind an unmarked door. Every tool that reports "31.9GB total" is reading the new description, not the old territory.

The footprint, sized honestly: what actually got written is the front room's furniture: fresh partition records, the small volume's structures, and the installer's payload — single-digit gigabytes, laid down at the drive's start where her oldest-placed files once began. That is the honest loss zone, and the ledger below itemises it. Everything beyond — including, by the arithmetic of a 250GB image set on a 2TB drive, the overwhelming bulk of her backup — sat untouched: structures orphaned, contents intact. And her one decision after the accident was the case-winning one: she stopped, described the state precisely, and wrote in. No rescue tools, no second format, no "fixing." The front room stayed small.

The defence, entered formally: "a moment of stupidity" describes a tool that presents a list of drives, accepts one click, and converts a terabyte-class backup into an installer with a warning most humans have been trained by a thousand dialogs to click through. These files have decoded that reflex before, and the verdict stands: the trap is systemic. The archive's working rule, offered in place of her self-charge: installers get made on expendable sticks, never on drives that hold anything — a rule that exists precisely because careful people keep landing here without it.

The recovery: the old world rebuilt behind the front room

The full two terabytes were imaged write-blocked, and the installer's footprint mapped to its exact sector boundaries — the honest loss zone fixed before promises were made. Behind it, the original volume's structures were reconstructed from their surviving records, and the old drive stood up on the image: folders, names, dates. Her priority ran first: the system-image folder, all ~250GB, extracted and — because a backup is only as good as its restore — verified as a set, its internal catalogue checked complete and consistent, before the other files followed behind it. The front-of-drive ledger closed kindly: the overwritten zone had held early-placed material duplicated elsewhere in her estate; nothing named was lost to the installer.

On the bench

The drive was fixed in evidence first — imaged write-blocked on the Atola TaskForce 2 — and the archaeology ran on the copy. OSForensics mapped the installer's small modern footprint against the ghost of the former partition table, carved the boundary between the two eras, and the original volume's structures were reconstructed on the image beneath the installer's thin overwrite. The 31.9GB riddle resolved exactly as decoded: a small new world sitting on a large old one, the old one still substantially present once something knew to look underneath.

The outcome

The system image delivered verified — and then, the ending this case was owed: used, her laptop restored from the very backup the accident had buried, completing the errand that started everything. The remaining files followed on new media. Free assessment, one fixed written figure including VAT, no recovery, no fee. Her opening self-verdict was formally returned unendorsed, with the archive's substitute finding attached: a good backup habit, one systemic trap, and a recovery that closed the loop.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.