Data Recovery Case File · Portable Drives · The Count Is the Verification
Ten Files Is Almost No Damage at All
Her enquiry contains two numbers and both of them help. An external drive formatted by accident: "I didn't realise straight away and proceeded to save a new batch of around 10 pictures onto the reformatted drive. The drive only contained the raw pictures — 513 of them — and edit information from the catalogue. I'm not bothered about the ca"talogue. Ten files written afterwards is a negligible amount of overwriting, and knowing there were exactly 513 originals gives something almost nobody can provide: a way to verify the result.
| Media | External hard drive formatted in error — approximately 10 image files written afterwards; 513 raw photographs and an editing catalogue previously held |
| Reported situation | Drive formatted in error · mistake not noticed immediately · approximately 10 new images saved to the reformatted drive · 513 raw photographs previously held · editing catalogue previously held and not required · drive retained |
| Fault class | Index replacement with minimal subsequent write activity — content present; raw formats highly identifiable by signature |
| Equipment used | Drive removed from use · imaged write-blocked before any reconstruction · post-format write extent measured · previous filesystem structures located from surviving copies · raw-format signature carving alongside · recovered count reconciled against 513 |
The decode: why ten files barely matter, and why 513 does
What the format actually did: wrote a fresh empty index and marked the data area as available. It did not visit the photographs, which remain physically present exactly where they were written. That alone puts this among the more recoverable events in the archive.
Why ten subsequent files is negligible: the only thing that removes formatted data is new data written over it. Ten images occupy a tiny fraction of a drive holding 513 raw files — and new writes are generally laid down from the start of the available space, so their footprint is small and concentrated rather than scattered across everything. The overwhelming majority of that drive has not been touched since the format. Compare this with the cases here where somebody formatted and then reinstalled an operating system, and the difference is tens of gigabytes against a few hundred megabytes.
Why raw photographs are unusually good material: they are large, written contiguously, and carry distinctive manufacturer-specific headers. That means they are readily identified by signature even where no index survives — and being large, they are less likely to be fragmented. Where the previous filing structures can also be rebuilt from their surviving copies, they come back with original filenames and dates as well.
Why the count of 513 is genuinely valuable, and this is the part worth emphasising: almost nobody can say how many files they lost. A known figure converts "did we get everything?" into a question with an answer — 513 recovered means complete, 508 means five specific gaps to investigate rather than a vague unease. It should be quoted at the outset of any recovery where it is known, because it changes the acceptance criterion from an impression to a check.
One gentle note about the catalogue she is not worried about: that is her call and the raw files are the irreplaceable part. But it is worth knowing that the edits live in the catalogue and not in the raw files — so recovering the raws returns the unedited originals, and any developing work done on them is in the catalogue alone. If none of that editing matters, nothing is lost by the decision. If some of it does, the catalogue is worth recovering while the opportunity exists.
What must not happen: nothing further written to the drive, and no more files saved to it.
On the bench
The drive was removed from use. It was imaged write-blocked before any reconstruction, and the post-format write extent measured — approximately ten image files representing a negligible and concentrated footprint against the capacity, which is the figure determining what remains. Previous filesystem structures were located from their surviving copies to return original filenames and dates, with raw-format signature carving alongside, and the recovered count reconciled against the stated 513.
The outcome
The write extent measured, the previous structures rebuilt and the recovered count reconciled against the owner's figure. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: a format writes an empty index rather than erasing, so what matters is only what was written afterwards — and ten images against 513 raw files is almost nothing, concentrated at the start of the free space. Knowing the exact count is worth stating, because it turns completeness from an impression into a check.
Formatted a drive and saved a few files onto it before noticing
Stop using it now, and take some encouragement from the arithmetic. A format writes a fresh empty index and marks the space available — it doesn't visit your photographs, which are still physically there. The only thing that removes them is new data written over the top, and a handful of images is a tiny, concentrated footprint at the start of the free space rather than damage spread across everything. Compare that with someone who formatted and then reinstalled an operating system: tens of gigabytes against a few hundred megabytes. If you know how many files there were, say so — almost nobody can, and a known count turns "did we get everything" into a question with an answer. Raw photographs also carve exceptionally well.
Stop using it — call Guildford Data Recovery on 01483 901310; imaged write-blocked, post-format write extent measured, structures rebuilt and the recovered count reconciled against yours.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.