Data Recovery Case File · Portable Drives · Seeing Is Not Mounting

A Scan Reads the Device; Mounting Requires Trusting It

Her enquiry describes a contradiction that is not one. Two external drives that stopped working after a system problem and a crash mid-copy: "I can see the volumes on them — and the data, with a scan — but am unable to get the drives to mount on any device or copy the data." Those two facts are entirely consistent, and taken together they describe one of the more recoverable positions in this archive — because a scan finding everything means the content is there and only the acceptance is missing.

The decode: two operations that sound the same

What mounting actually is: an act of acceptance. The system reads the filesystem's descriptors, checks that they are internally coherent, checks the flag recording whether the volume was closed cleanly, and only then agrees to present it as a place files can be read from and written to. Mounting is conditional, and the system refuses whenever the conditions are not met — because presenting a volume it cannot trust risks writing into a structure it has misread.

What a scanning tool does instead: reads the device directly, sector by sector, and reconstructs what it finds from the evidence. It does not ask whether the volume is consistent, does not check the clean-closure flag, and does not need the system's permission. It is reading; mounting is agreeing.

So what her observation actually establishes: that the content is present, that the directory structures are largely intact, and that the filesystem is in a state the operating system will not accept. That is a very good position. A scan finding files means there are files to find — which is not true of the cases in this archive where the data area itself is damaged.

Why both drives failed together: both were mounted when the host crashed during a copy. Outstanding writes were lost on both, structures were left mid-update on both, and neither was marked as cleanly closed. One event, two casualties — which is also why the fault is logical rather than physical, since a crash does not damage hardware.

Why the answer is not to make them mount: the ways to achieve that all involve writing — running a repair, resetting the clean flag, or letting the system fix what it thinks is wrong. Each writes conclusions drawn from half-finished information over the structures a rebuild would use. The answer is to read them without mounting, which is what her scan is already doing and what imaging does properly.

What must not happen: no repair utility, on either platform, on either drive. Both systems will offer.

Why she cannot simply copy from the scan: most scanning tools can export what they find, and for a small amount that is a legitimate route. For two full drives it is slow, it works through the device repeatedly rather than once, and it produces output without folder structure. Imaging first and reconstructing afterwards is faster and returns the folders.

On the bench

No further mount attempts were made and no repair was permitted on either platform, the routes to forcing a mount all involving writes over the structures a rebuild depends on. Both drives were imaged write-blocked before any reconstruction — a scan reading the device directly and reconstructing from evidence, where mounting is conditional acceptance requiring coherent descriptors and a clean-closure flag, so content located by scanning confirms the data is present. Structures were rebuilt on the images from their surviving copies and files validated by opening.

The outcome

Both drives imaged before any reconstruction and the structures rebuilt from their surviving copies onto independent media. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: mounting is an act of acceptance — the system checks the descriptors are coherent and the volume was closed cleanly, and refuses otherwise. A scan reads the device directly and asks none of that. So seeing your data in a scan while nothing will mount means the content is there and only the acceptance is missing.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.