Data Recovery Case File · Trust, Practice & Honest Limits · This May Not Be Our Job
A File Lost Inside an Application Is a Different Problem From a Failed Drive
Her enquiry describes an urgent loss on a machine that is entirely healthy. A university assignment being written when she "hit the wrong key and lost the document", with no automatic copy saved, nothing in the recycle bin, and a deadline in days. Nothing here is broken — and the honest answer is that most of what can be done costs nothing and can be done today, before anyone is asked to quote for anything.
| Media | Laptop internal drive in normal working order — a single document lost during editing; no automatic copy retained; deletion record absent |
| Reported situation | Document being edited in a word processor · content lost following an unintended keystroke · no automatically saved copy present · no synchronised copy present · document not in the deletion folder · machine otherwise functioning normally · deadline within days |
| Fault class | Application-level content loss with storage unaffected — recoverability governed by whether the content ever reached the disc and by continued use since |
| Equipment used | Application recovery locations checked before any storage work was proposed · machine removed from use immediately · drive imaged write-blocked at the block level before any interpretation · temporary, autosave and cache locations searched from the image · document fragments carved by signature and reconstructed from partial content |
The decode: what to check first, at no cost, and what determines the rest
Why this is worth saying before anything else: she may not need a recovery lab. A working machine with a missing file has several places to look that cost nothing, and they should be exhausted first.
What the first of those is: the application's own recovery location. Word processors keep working copies in a temporary folder that is separate from the document and separate from the deletion folder, and it survives a great many losses.
Why she may have missed it despite checking: it is not where documents live. Recovery copies sit in hidden application folders under a different name entirely, so looking where the file was saved finds nothing.
Why the message about not being synchronised is informative: it reports a specific absence. It means no cloud copy exists, which removes one option and does not affect the local ones.
Now the harder question, and it decides everything: did the content ever reach the disc? A document being typed lives in memory, and only becomes recoverable once something writes it down.
Why that is not as bleak as it sounds: writing happens more often than saving. Applications write working copies periodically without being asked, and the operating system writes memory to disc under pressure.
What makes those copies findable: they are ordinary files. Once written, a temporary copy can be located by its structure even after it has been deleted.
Why the urgency works against her in a way she may not expect: continued use overwrites. Temporary files sit in space the system treats as freely reusable, and a machine in daily use consumes it quickly.
Why that is the single most important thing to act on: the machine should stop being used. Every hour of work on that laptop reduces what is recoverable, which is difficult advice with a deadline approaching.
What the practical compromise is: work elsewhere. Another machine, or a phone, lets the assignment continue while the laptop is left alone.
On the bench
Application recovery locations were checked before any storage work was proposed — word processors retaining working copies in hidden temporary folders separate from both the document's location and the deletion folder, which is why checking where the file was saved finds nothing. Recoverability then depends on whether content reached the disc, which occurs through periodic automatic writes and memory paging rather than only through saving. Temporary and cache locations were searched from a write-blocked image.
The outcome
Application recovery locations checked first, the machine removed from use, and temporary locations searched from a write-blocked image. Free assessment, one fixed written figure including VAT; where nothing is recovered, nothing is charged. The decode: nothing on your laptop is broken, and the first places to look cost nothing. What matters most is that the machine stops being used — temporary copies sit in space the system reuses freely.
A document lost while you were writing it
Stop using that laptop and work on something else meanwhile — temporary copies sit in space the system reuses freely, so every hour of use reduces what's recoverable. Before paying anyone, check the word processor's own recovery location: it keeps working copies in a hidden application folder under a different name, separate from where you saved the document and separate from the recycle bin, which is why looking in the obvious places finds nothing. That check costs nothing and often ends the matter.
Check the free options first — call Cambridge Data Recovery on 01223 655015; application locations checked before any storage work, machine taken out of use, temporary locations searched from a write-blocked image.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.