Data Recovery Case File · Formatted & Logical Faults · The Arithmetic Is Encouraging
Thirty-Two Gigabytes Written, Nine Hundred Untouched
Their enquiry states the problem and, without realising it, the reason for hope. "I didn't know installation media wipes whatever drive you download it onto, and it wiped like 300GB of photos from the last ten years. We were trying to get a copy of the system and didn't have a flash drive, so we used his external drive — and now it's reformatted for the 32GB and 899GB are just empty. Is there any way on the planet to get them back?" Those two numbers are the whole answer. Something wrote 32GB. Nothing touched the other 899.
| Media | 1TB external hard drive repurposed as installation media — repartitioned to approximately 32GB with the remaining capacity unallocated; approximately 300GB of photographs previously held |
| Reported situation | External drive used as the target for creating installation media · owner unaware that the process would repartition the device · approximately 300GB of photographs spanning ten years previously held · drive now presenting an approximately 32GB partition · remaining capacity reported as unallocated |
| Fault class | Repartition with a small installation footprint — the large majority of the medium unwritten; original structures recoverable from surviving copies |
| Equipment used | Drive removed from use and not booted from · imaged write-blocked before any reconstruction · written extent measured against capacity · original partition structure sought from the secondary copy at the end of the disk · signature carving across unallocated regions · images validated by rendering |
The decode: why unallocated is not erased
What the tool actually did: repartitioned the drive to suit installation media. It wrote a new partition table, created a partition of the size the installer needs, and copied the installation files into it. That accounts for the 32GB. Everything beyond that partition it simply left alone, because there was no reason to touch it and writing across 899GB would take hours to no purpose.
Why "unallocated" sounds worse than it is: the word describes what the new partition table says — that no partition claims that space. It does not describe the medium. The photographs are physically present across that region exactly as they were written, byte for byte. What has been lost is the description of them, and the description occupied a few kilobytes at the front of the disk.
Why the ratio is so favourable: compare this with the cases in this archive where somebody formatted and then reinstalled an operating system over the top — tens of gigabytes of system files, updates and caches written into the space the data occupied. Here the footprint is a single partition at the start and nothing else. Roughly nine-tenths of the drive was never written to at all.
What can be recovered, and how well: two routes, and the better one is worth trying first. Partition tables keep a backup copy at the far end of the disk, and a repartitioning tool does not always overwrite it — so the original layout can frequently be read from there, which brings the volume back with its folder structure and filenames intact. Failing that, photographs carry distinctive headers and are identified by signature across the unallocated region, returning images organised by type and date rather than in folders.
Why the warning did not land, and it is worth saying they did nothing stupid: the tool does warn that the target will be erased. But somebody borrowing a drive because they have no memory stick reads that as a formality about a device they are lending for an hour — the warning describes what will happen to the media, and it does not distinguish between a blank drive and one holding a decade of photographs. This is one of the most common losses in the whole subject.
What must not happen now: nothing further written to the drive, nothing installed from it, and it must not be booted from. Every one of those risks writing into the region that still holds everything.
On the bench
The drive was removed from use and not booted from. It was imaged write-blocked before any reconstruction, and the written extent measured against capacity — an installation partition of that size representing a small, concentrated footprint at the start of the disk with the remainder unwritten. The original partition structure was sought from the secondary copy at the end of the disk, which repartitioning tools do not always overwrite and which returns the volume with folders and filenames, with signature carving across the unallocated regions alongside. Images were validated by rendering.
The outcome
The written extent measured, the original layout sought from its secondary copy and the unallocated regions carved and validated. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, and the arithmetic is the answer: the tool wrote a partition of about 32GB and left the remaining 899GB alone, because writing across it would take hours to no purpose. Unallocated describes what the new partition table says, not what is on the medium. Your photographs are physically there.
Drive repartitioned by making installation media
Stop using it, don't install from it and don't boot from it — and take real encouragement from the numbers you've quoted. The tool wrote a partition of around 32GB, copied the installation files into it, and left the remaining 899GB completely alone, because writing across it would have taken hours for no reason. "Unallocated" describes what the new partition table says rather than what's on the disk: your photographs are physically present across that region exactly as they were written. What was lost is the description of them, which occupied a few kilobytes at the front. There's often a backup copy of the original partition table at the far end of the disk too, which can bring folders and filenames back intact.
Don't boot from it — call Guildford Data Recovery on 01483 901310; imaged write-blocked, written extent measured against capacity, original layout sought from its secondary copy and unallocated regions carved.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.