Data Recovery Case File · Mac & Apple Ecosystem · Disconnect the Other Devices
Stop the Synchronisation Before Anything Else
His enquiry describes a careful migration with one wrong assumption. Helping his wife erase an old desktop replaced by a new one: "much of her data, including the most critical data, was stored in either cloud service, and also on the desktop on her local machines. She also uses a laptop, a phone and a tablet. Critical data has been erased. I'm hoping that you will be able to recover this data from the drive in the old machine." The drive is the last place to look, not the first — and there is something that should be done in the next few minutes, before any of it.
| Media | Desktop internal hard drive erased during a planned migration — critical data believed replicated to cloud services and not confirmed present; several synchronised devices in use |
| Reported situation | Old desktop machine erased during a planned changeover · data believed held in cloud services and on the local desktop · critical data found to be absent afterwards · owner using several additional synchronised devices · recovery sought from the erased drive |
| Fault class | Deliberate erasure with synchronised replicas at risk of propagating the deletion — account-side and secondary-device routes taking precedence |
| Equipment used | Secondary devices isolated from synchronisation before assessment · cloud account deleted-items and version history checked through web interfaces · secondary device local caches examined · erased drive imaged write-blocked where account routes did not resolve it |
The decode: the urgent step, then the order to search
The urgent step, and it should happen now: disconnect the laptop, phone and tablet from the network, or at minimum turn off synchronisation on each. Those devices may still hold local copies of the erased material — and the moment any of them syncs, it will faithfully apply the deletions and remove its own copy. Every hour they stay connected is a chance for the last surviving replicas to be tidied away. This is worth doing before reading any further.
Why that risk exists: synchronisation propagates deletions as diligently as it propagates files. A folder removed on one machine is removed everywhere, because the service's job is to make every device match. That is the property this archive keeps returning to — a copy that updates automatically is the same copy in two places — and it is exactly what makes a sync arrangement a poor backup.
The first place to search, and it costs nothing: each cloud service's deleted items area, checked through its website rather than through any application. Services retain deleted files for a defined period — commonly thirty days — precisely for this. If the erase propagated, the files are very probably sitting there right now, restorable with a click. That window is running.
The second: version history on those same services, which retains previous versions of files independently of the deleted-items area and is frequently the better route where files were changed rather than removed.
The third: the secondary devices themselves, once isolated. A laptop that has not been opened since before the migration may hold a complete local copy of everything, and copying it off while it is offline is the simplest resolution available.
Why the erased drive is last, honestly: what an erase leaves depends entirely on which kind was performed. An erase that only rewrites the directory structures leaves everything recoverable; one that writes across the whole disk does not; and on solid-state storage a secure erase is quick and final. The type used is knowable — and it should be established before the drive is treated as the main hope, because the account routes are faster, free, and more likely to return complete files with names intact.
The lesson for the migration itself: confirm data is present on the new machine by opening it, not by assuming it synced. Keeping the old machine intact for a month costs nothing but a shelf.
On the bench
Secondary devices were isolated from synchronisation before assessment — those devices potentially holding the last surviving local copies, and any sync propagating the deletions and removing them. Cloud account deleted-items areas and version history were checked through web interfaces rather than applications, retention being time-limited and the window running. Secondary device local caches were examined once offline, and the erased drive imaged write-blocked only where the account routes did not resolve it.
The outcome
The synchronised devices isolated first, the account-side routes searched within their retention window and the drive imaged only where those did not resolve it. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, and the thing to do immediately: disconnect every other synced device, because they may hold the last local copies and syncing will delete them. Then check each service's deleted-items area through its website — retention is usually about thirty days and the window is running.
Data erased during a migration that was meant to be synced
Turn off synchronisation on every other device right now — the laptop, the phone, the tablet — or disconnect them from the network. They may hold the last local copies of what was erased, and the moment any of them syncs it will faithfully apply the deletion and remove its own copy. Do that before anything else. Then check each cloud service's deleted-items area through its website rather than an app, because services retain deleted files for a limited period, usually around thirty days, and that window is running. Check version history too. The erased drive is the last resort rather than the first, and what it holds depends entirely on which kind of erase was performed — worth establishing before treating it as the main hope.
Stop your other devices syncing now — then call Guildford Data Recovery on 01483 901310; devices isolated before assessment, account routes checked within retention, drive imaged only if needed.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.