Data Recovery Case File · Formatted & Logical Faults · An Unaccounted Interval
The First Question Is Whether the Drive Is Still Yours
His enquiry contains a gap nobody can fill in. A laptop "has been stolen, but I have already got it back — however, when I am powering on, only the firmware appears, which says there is no booting device." Between the theft and the return, somebody had the machine and did something with it — and before any question about recovery can be answered, it has to be established what is actually inside the case.
| Media | Laptop internal storage following theft and recovery of the machine — host reporting no bootable device; interval unaccounted for |
| Reported situation | Machine stolen and subsequently recovered by the owner · powering on normally · firmware reporting no bootable device present · period in third-party possession unaccounted for · original contents required |
| Fault class | Storage state unknown pending physical verification — removal, substitution and erasure all consistent with the reported symptom |
| Equipment used | Physical presence and identity of the storage verified before any other work · serial and capacity checked against the owner's records · written extent measured where the original medium was confirmed · imaged write-blocked before any reconstruction |
The decode: three possibilities behind one message
What the firmware is reporting: that it looked for something to start from and found nothing. That single message is consistent with three quite different situations, and it cannot distinguish between them.
First — the drive was taken out. Storage is the most easily resold component in a laptop and the quickest to remove, and a machine recovered without it will report exactly this. If the bay is empty, nothing further applies and the question becomes whether the drive is anywhere.
Second — the drive was replaced. A machine prepared for resale is frequently fitted with a cheap replacement so that it appears complete. If the drive inside is not his, then his contents are elsewhere and this one holds somebody else's, or nothing.
Third — the original drive is present and was wiped. The commonest preparation for resale is to erase the machine and install a fresh system, and where that was started and not finished, a drive can be left with nothing bootable on it. This is the only one of the three that is a recovery case, and it is a good one.
So the first action is not diagnostic, it is physical: open the machine and look. Is there a drive. What capacity does it report. Does the serial match any record he has — a receipt, a warranty registration, an old system report. Ten minutes with a screwdriver settles which of the three situations this is, and nothing sensible can be said before that.
Why the third possibility is genuinely hopeful: a wipe performed for resale is almost always a quick one — an installer told to erase and start again, writing a fresh filesystem and a system image. That writes a bounded amount and leaves the rest of the surface untouched, so a large drive substantially wiped in that way still holds the great majority of its previous contents.
What decides how much: how far any installation got. A machine wiped and left is a better position than one wiped, reinstalled, and used for a month.
What must not happen meanwhile: no attempt to reinstall a system to make the machine usable again. That is the natural next step for a laptop that will not boot, and on the one hopeful scenario it writes over exactly what is being sought.
On the bench
Physical presence and identity of the storage were verified before any other work — an absent drive, a substituted drive and an erased original all producing the same firmware message, which cannot distinguish between them. Serial and capacity were checked against the owner's records. Where the original medium was confirmed, written extent was measured, a resale wipe typically writing a bounded quantity and leaving the remaining surface untouched. Imaging ran write-blocked before any reconstruction.
The outcome
The storage physically verified and identified before any other work, with the written extent measured where the original was confirmed. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: that message covers three situations — the drive removed, the drive replaced, or the original wiped. Only the third is a recovery, and it is a good one, because a resale wipe writes a bounded amount. Open the machine and check the serial first.
Recovered machine that reports no bootable device
Open it and look before anything else — that message covers three quite different situations and can't distinguish between them. The drive may have been removed, since storage is the quickest component to take and the easiest to resell. It may have been replaced with something cheap so the machine looks complete. Or it may be your original, wiped for resale. Check whether a drive is present, what capacity it reports, and whether the serial matches any record you have — a receipt, a warranty registration, an old system report. Only the third case is recoverable, and it's a good one, because a resale wipe writes a bounded amount. Don't reinstall anything.
Check what's actually inside — then call Guildford Data Recovery on 01483 901310; storage verified and identified before any work, written extent measured, imaged before any reconstruction.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.