Data Recovery Case File · Solid State & Flash · The Coursework on the Stick

The ghost in the recents list: why Word can name a file it cannot open — the two real homes her coursework might have, the stick and the autosaves both hunted, and the deadline met on paper

The enquiry arrived with a father's urgency and every useful detail intact. His daughter's end-of-year coursework — one specific piece, two weeks of work — saved to a Toshiba memory stick for carrying between home and school computers. This evening: "the file has simply disappeared." And the haunting detail: on her MacBook, in the Word desktop app, "the document she wants is able to be seen — but not able to open: 'This document has been deleted or is not currently accessible.'" Could we help, at any available opportunity. Two decodes below, then the plan. First: what that Word entry actually is — a ghost that proves the file existed and names where it lived, without holding a byte of it. Second, the genuinely hopeful part: a document worked on for two weeks in Word has two possible homes, and the second one — the autosave trail on the MacBook itself — is the one most people never think to search.

The decode: the ghost, the two homes, and the practice that caused it

Why Word lists a file it cannot open: the recents list is a menu of pointers, not a store of documents. Word remembers the names and locations of what you've opened — nothing more — so when the underlying file goes, the entry lingers: a signpost to a demolished address. Clicking it makes Word follow the pointer, find nothing, and report exactly the message she saw. The ghost is disheartening to look at but genuinely useful to a recovery: it confirms the document existed, names its exact path on the stick, and timestamps the last sessions — a witness statement, if not a rescue.

Home one — the stick: "simply disappeared" from a memory stick means one of the familiar pair: the file deleted (a mis-tap, a cleanup, a move that didn't complete) or the stick's filesystem corrupting around it. Either way the archive's constant applies: the document's data is very likely still on the flash, unlisted — deleted entries recoverable, corrupted directories rebuildable — provided the stick stops being used now. Every further save onto it risks landing on the very sectors the coursework occupies; the stick's job, as of this evening, is to sit still.

Home two — the autosave trail: and here is the hope most households never search. A document edited across two weeks of Word sessions leaves traces on the editing machines themselves: AutoRecovery files (Word's crash insurance, quietly snapshotting open work), temporary working files, and cached versions — scattered in tucked-away system folders on the MacBook, invisible to casual browsing, frequently surviving long after sessions end. These aren't guaranteed, and an autosave may trail the final version by a session — but for a two-week document, the trail is often rich, and a recovered autosave from the last evening's work can be the difference between resubmitting and re-typing. The professional plan therefore hunts both homes at once — the stick for the file, the MacBook for the trail — and delivers the best surviving version, clearly identified.

The practice, gently corrected for afterwards: working directly from a stick — editing the live file on flash that's unplugged and re-plugged daily — is the riskiest common habit in student computing: one removal mid-save corrupts the only copy. The safe rhythm costs nothing: work on the computer, copy to the stick for transport, and let the cloud or a second folder hold a third version. Two weeks of work should never have exactly one home with legs.

On the bench

Both homes were hunted in parallel. The stick was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, its deleted entries recovered and the document carved by signature from the image — the path named by Word's ghost checked first. The MacBook was imaged on the Atola TaskForce 2 and OSForensics swept the autosave territory: AutoRecovery stores, temporary files, cached versions — every surviving snapshot of the coursework gathered and dated. The candidates were compared, the most recent complete version identified, opened, and read through for integrity — then delivered, with the timescale that had been put in writing at assessment kept, and the deadline still ahead of her.

The outcome

The coursework recovered — best surviving version verified open and complete — and delivered against the written timescale, with the exam calendar intact. Free assessment, one fixed written figure including VAT; on cards and sticks where content has been deleted or overwritten, the figure is payable upfront. The decodes, left for every student household: Word's recents list is a menu of ghosts — proof of existence, not a copy; a vanished document has two possible homes, the stick and the autosave trail, and the second is searched far too rarely; the stick must rest from the moment of loss — and coursework deserves three homes before it ever deserves a deadline.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.