Data Recovery Case File · Solid State & Flash · Copy Before You Investigate

One System Declined and the Other Did Not

His enquiry contains the problem and, without his realising it, the solution. A stick used on the same desktop machine for years: "on Saturday I discovered that it was no longer readable and was not even appearing in the file manager. I have an old machine running a different system. I transferred the stick there and was able to see the full contents." Something can read it right now — which makes the next hour more important than any diagnosis, and the difference between the two machines is explicable rather than mysterious.

The decode: why systems disagree, and the instruction that follows

Why one machine sees it and the other does not: not because one is broken. Operating systems implement filesystems differently, and they differ most in how much inconsistency they will tolerate. One may refuse to mount a volume whose structures do not fully validate — declining rather than risking further damage, which is a defensible choice. Another may mount the same volume anyway, working around what it finds, and present the contents. The stricter system is not failing; it is refusing.

What that tells us about the stick: the hardware works, the memory reads, and the filing structures are damaged but not destroyed — because a volume too far gone would not mount anywhere. That is the recoverable combination, and it is confirmed by the fact that one host lists everything.

Why the instruction is urgent and simple: a working route exists at this moment and there is no guarantee it persists. Inconsistent structures get worse with use, the tolerant system may fail to mount it next time, and the stick's underlying condition is unknown. Everything should be copied to the second machine's internal storage now, in priority order, before anything else is attempted. Not investigated, not repaired, not diagnosed — copied.

The principle worth taking generally, because it recurs throughout this archive: when anything can read your data — a different computer, a different operating system, a camera, a printer, an old laptop in a cupboard — that is the moment to act. The instinct is to work out why the usual machine stopped, and it is the wrong order. Understanding costs time that access may not have.

What must not be run on either system: both will offer to help. The stricter one will propose a repair or a format for a volume it cannot mount; the tolerant one will offer to scan and fix errors it has noticed. Both write their conclusions back, and doing that to structures currently good enough to read is how a working route is closed permanently.

What if the copy is incomplete: where individual files fail to open or copy, they are left for imaging rather than retried repeatedly — a stick reading inconsistently should not be made to work on the same regions over and over.

On the bench

Copying was prioritised over diagnosis while access persisted, a working route on one host being a temporary condition rather than a stable one. No repair or verification utility was permitted on either system — the stricter host offering to repair or format a volume it will not mount, and the tolerant host offering to scan and fix errors it has noticed, with both writing conclusions over structures currently good enough to read. Where copying was incomplete, the stick was imaged write-blocked and structures reconstructed on the image, with files validated by opening.

The outcome

The readable contents secured while the route was open, and the remainder taken from an image with structures rebuilt on the copy. Free assessment, one fixed written figure including VAT; where a chip has to be removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: systems differ in how much filesystem inconsistency they tolerate, so one refusing to mount while another lists everything is a difference in strictness rather than a second fault. Your hardware works and the structures are damaged but not destroyed. Copy everything now, while something can read it.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.