Data Recovery Case File · Formatted & Logical Faults · Find Out What, Then When
Nothing Is Broken, So Something Took Them Away
His enquiry contains no fault at all. An external drive holding family photographs: "the drive is fully functional and it stored a lot of family photos. Unfortunately, although the drive is still fully functional, it appears the pictures have all gone. I'm not sure if th"ey were deleted or something else happened. A working drive with missing content is not a repair question — it is an investigation, and what removed them determines both whether they can come back and whether it will happen again.
| Media | External hard drive functioning normally — photographic content no longer present in expected locations; cause of removal not established |
| Reported situation | Drive operating normally with no fault reported · family photographic content previously stored · content no longer present · cause not known to the owner · no error or failure symptom described |
| Fault class | Content removal on healthy media — deletion, synchronised removal, relocation or visibility restriction to be distinguished before recovery |
| Equipment used | Drive disconnected from any synchronising client before assessment · hidden content and volume-level deletion stores enumerated first · reported capacity compared against visible content · deletion timing established from remaining metadata · imaged write-blocked before any recovery of removed content |
The decode: the five things that remove files from a healthy drive
First, and cheapest to rule out — they are still there and not shown. Content can be hidden by an attribute, or sitting in a folder whose permissions refuse the current machine. Revealing hidden items and checking folder access costs nothing and resolves a meaningful share of these.
Second — a volume-level deletion store. Deleting from an external drive frequently moves items to a hidden folder on that same volume rather than removing them, where they remain until it is emptied. The photographs may be intact, on the drive, in a folder nothing displays.
Third — the number that settles a great deal. Compare reported used space against what is visible. If capacity is still consumed, the content is physically present and this is a visibility or indexing problem rather than a loss. If the drive reports itself as largely empty, something genuinely removed the files.
Fourth — a synchronising client. If any cloud or backup service treated that drive as a synchronised location, a deletion performed on another device propagates to it automatically. This is the explanation people never consider, because nobody deleted anything on the drive itself — and it matters urgently, because a client still running will do it again to whatever is restored.
Fifth — a storage-management or tidy-up utility. Tools that free space by removing or relocating older content are increasingly built into systems and enabled by default. They report what they have done, usually somewhere nobody looks.
Why establishing which one happened comes before any recovery: deleted content survives until something overwrites it, so a healthy drive that has been unused since is in good shape. But recovering files onto a drive that is still synchronised is putting them somewhere they will be removed again — so the client is disconnected first, not afterwards.
What must stop meanwhile: using the drive. A working drive invites continued use precisely because nothing seems wrong, and every write reduces what can be recovered.
On the bench
The drive was disconnected from any synchronising client before assessment — a synchronised location propagating deletions performed elsewhere, and a client still running removing whatever is restored. Hidden content and volume-level deletion stores were enumerated first, deletion from external media frequently relocating items to a hidden folder on the same volume. Reported capacity was compared against visible content, consumed space indicating the files are physically present. Deletion timing was established from remaining metadata, and the drive imaged write-blocked before any recovery.
The outcome
Any synchronising client disconnected first, hidden and deleted stores enumerated, capacity compared against content and the drive imaged before recovery. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: a working drive with missing files is an investigation rather than a repair. Compare used space against what you can see — if capacity is still consumed, the photographs are physically there. And check whether anything was synchronising that drive.
Working drive whose files have disappeared
Stop using it, then check three things in order. Reveal hidden items and look for a deletion store on the volume itself, because deleting from an external drive often moves things to a hidden folder rather than removing them. Compare the reported used space against what you can see — if capacity is still consumed, your photographs are physically present and this is a visibility problem rather than a loss. And find out whether any cloud or backup client treated that drive as a synchronised location, because a deletion made on another device propagates automatically and nobody deleted anything on the drive itself. That last one matters most: disconnect any such client before recovering anything, or it will remove the files again.
Disconnect any sync client first — then call Guildford Data Recovery on 01483 901310; hidden and deleted stores enumerated, capacity compared against content, imaged before any recovery.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.