Data Recovery Case File · Trust, Practice & Honest Limits · What You Pressed Is Checkable
Whether a Recovery Screen Was Allowed to Write Is Established From the Drive, Not From Memory
This enquiry carries a worry that deserves a direct answer. A laptop with a cracked screen that powers on but cannot get past a system recovery screen, holding family photographs, where they add: "I hope that I have not inadvertently wiped any drives while trying to get beyond the recovery screen." That uncertainty is resolvable rather than something to live with — what was written to the drive is readable from the drive, whatever anyone remembers pressing.
| Media | Laptop internal hard drive — machine halting at a system recovery screen; recovery options navigated by the owner with outcomes uncertain; content unused for several years |
| Reported situation | Laptop with a cracked display · machine powering on · machine halting at a system recovery screen · recovery options navigated by the owner in attempts to proceed · owner uncertain whether any destructive option was accepted · family photographs sought · machine not used for several years prior |
| Fault class | Start-up failure with uncertain intervention history — whether restoration or erasure was performed determinable from on-disk evidence; content regions retained unless a destructive option completed |
| Equipment used | Intervention history established from on-disk evidence rather than from recollection · machine removed from use immediately · drive removed and imaged write-blocked before any interpretation · filesystem timestamps and structure ages examined to date any writing · content carved by signature and reconciled against recovered records |
The decode: what those screens offer, and how the question is settled
Why the worry is reasonable rather than excessive: the options sit together. A recovery screen presents harmless choices alongside destructive ones, often on the same menu and in similar language.
What the harmless ones do: nothing much. Start-up repair, diagnostics and system restore write little or nothing to user content.
What the destructive ones do: exactly what they say. A factory reset or a reinstall writes a fresh system and marks the volume available.
Why the difference is not always clear at the time: the wording is gentle. Options described as refreshing or restoring a machine can mean either, depending on the system.
Now why the uncertainty does not matter: the drive records it. Anything written leaves timestamps and structures whose ages can be read, and a reset performed last week is obvious against content from years ago.
Why that is a definite answer rather than an inference: the evidence is direct. Either recent system structures exist or they do not.
Why the years of disuse help considerably: the contrast is stark. A machine untouched for years has nothing recent on it except whatever was done in the past few days.
Why even a completed reset would not end matters: a reset writes a system, not zeroes. On a machine of that generation the old content remains beyond the region the new installation occupies.
Why the cracked screen is irrelevant to all of it: it is a separate fault. A damaged display does not affect the storage, and the machine reaching a recovery screen proves it is working well enough.
What must happen now: no further attempts to get past the screen. Whatever has or has not been accepted so far, the next option accepted may be the destructive one.
On the bench
Intervention history was established from on-disk evidence rather than from recollection — recovery screens presenting harmless options such as start-up repair and diagnostics alongside destructive ones in similar language, so uncertainty is common. Anything written leaves timestamps and structures whose ages are readable, and a machine unused for years provides stark contrast. Even a completed reset writes a system rather than zeroes. Filesystem timestamps and structure ages were examined to date any writing.
The outcome
Intervention history established from the drive, the machine removed from use, and structure ages examined to date any writing. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: you do not have to remember what you pressed. Anything written leaves dated structures, and on a machine untouched for years the contrast is unmistakable.
If you are not sure what you agreed to on a recovery screen
Stop trying to get past it — whatever has or hasn't been accepted so far, the next option might be the destructive one. Then set the worry down: it's answerable from the drive rather than from memory, because anything written leaves timestamps and structures whose ages can be read, and on a machine unused for years recent activity stands out unmistakably. Even a completed reset writes a system rather than zeroes, leaving older content beyond it.
It is checkable — call Cambridge Data Recovery on 01223 655015; intervention history established from on-disk evidence rather than recollection, structure ages examined to date any writing, assessment free either way.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.