Data Recovery Case File · Formatted & Logical Faults · Public Devices Write Back
The Machine She Plugged Into Had Its Own Ideas
Her enquiry identifies the culprit without quite believing it. Files lost from a memory stick which she believes came "from me reformatting the card. This circumstance came about after I spent this afternoon scanning my work in on one of the university printers. When I plugged the memory stick I was scanning onto back into my computer" the files were gone. She very likely did not reformat anything — the scanner did, and shared machines doing that to removable media is commoner than almost anybody realises.
| Media | USB flash drive used with a shared multifunction scanning device — contents absent following the session; format suspected by the owner |
| Reported situation | Stick used to receive scanned work on a shared institutional multifunction device · session completed · stick connected to the owner's own computer afterwards · previous contents no longer present · owner uncertain whether she performed a format |
| Fault class | Index replacement performed by a third-party device — content present pending overwrite; scanned output likely the only subsequent write |
| Equipment used | Stick removed from use immediately · post-format write extent measured against capacity · imaged write-blocked (DeepSpar USB Stabilizer 10Gb) · previous filesystem structures recovered from surviving copies · files validated by opening |
The decode: what a shared machine actually is
What people assume a printer or scanner is: a peripheral. Something that receives a job and produces an output, with removable media treated as a passive destination it writes a file to.
What it actually is: a computer with its own operating system, its own storage handling, and a configuration set by whoever administers it. It makes decisions about media it is given, and those decisions were made by somebody else with different priorities.
What such machines commonly do: format media whose filesystem they do not recognise or cannot write to reliably, because a device that cannot complete a job is a support call. Write their own folder structure. And on institutional deployments, clear media after each session — a privacy measure, configured deliberately so that one user's scans are not left for the next person to find. That last setting is well-intentioned and it treats your stick as scratch space.
Why she cannot be sure what happened: because the device did it without a prompt she would remember, or with one worded as part of preparing the media. Her uncertainty is the normal experience, and blaming herself for a format she does not recall performing is the common outcome.
Why the position is nevertheless good: a format writes a fresh empty index and marks the space available — it does not visit the files. The only thing that removes them is data written afterwards, and on this stick that is the scanned work from that session: a modest quantity relative to the whole device. So the great majority of her earlier content should be physically present.
What must happen now: the stick comes out of use entirely. Not for further scanning, not for carrying anything, and certainly not back into a shared machine.
The practical lesson, which is not "avoid printers": keep a dedicated stick for public machines, holding nothing you would miss. Never put your only copy of anything into a device configured by somebody else — a library scanner, a print shop, a hotel terminal, a photo kiosk. They all write, and none of them announce it.
On the bench
The stick was removed from use immediately, shared multifunction devices formatting unrecognised media, writing their own folder structures, and on institutional deployments clearing media after each session as a privacy measure. The post-format write extent was measured against capacity — only subsequent writing removing content, which here is the scanned output alone. The stick was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, previous filesystem structures recovered from surviving copies, and files validated by opening.
The outcome
The write extent measured against capacity, the stick imaged and the previous structures recovered from their surviving copies. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront. The decode: you probably did not do this. A shared scanner is a computer with its own configuration, and such machines routinely format media they cannot write to reliably, add their own folders, or clear media after each session as a privacy setting. A format writes an index rather than erasing.
Media emptied after use in a shared machine
Take the stick out of use entirely and don't put it back into anything, least of all another public device. You very probably didn't format it. A library or office multifunction machine is a computer with its own operating system and a configuration set by an administrator, and such devices routinely format media whose filesystem they can't write to reliably, write their own folder structures, or clear media after each session as a deliberate privacy measure. None of that announces itself in a way you'd remember. The encouraging part is that a format writes an empty index rather than erasing, so only the scanned output was written over your files. Keep a dedicated stick for public machines.
Stop using it — call Guildford Data Recovery on 01483 901310; write extent measured against capacity, imaged write-blocked, previous structures recovered from their surviving copies.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.