Data Recovery Case File · Desktop Externals & Aging Drives · The Installer Only Needed a Little
Creating Install Media Writes a Small Partition and Leaves the Rest of the Drive Alone
His enquiry describes a mistake with a much better outlook than its description suggests. Boot media written to an external drive to perform a fresh installation, which "has formatted over the original data and has been converted" to installation media "with 32 gigabytes of storage" — and he would like the original files back. The reported capacity is the clue: an installer needed a fraction of that drive, and it only wrote to the fraction it needed.
| Media | External hard drive repartitioned as operating system installation media — presenting approximately 32GB where the original capacity was substantially larger; original content sought |
| Reported situation | External drive selected as the target for creating installation media · media creation completed · drive subsequently presenting as approximately 32GB · original content no longer visible · restoration of the original files and capacity sought |
| Fault class | Partition table replaced with a small installer volume — original content beyond the installer partition physically retained and unreferenced |
| Equipment used | Reported capacity treated as evidence of a small written footprint · drive removed from use before any examination · imaged write-blocked at full physical capacity rather than at the reported size · original partition boundaries reconstructed from filesystem signatures beyond the installer region · directory structures recovered from residual copies and content carved where they did not reconcile |
The decode: why the capacity figure is the good news
What creating installation media actually does: writes a new partition table and one small volume. The tool defines a partition large enough for the installation files and copies them into it.
Why the drive now reports a smaller size: the system is reading the new table. Capacity as reported is a description rather than a physical property, and the description now says thirty-two gigabytes.
Why the rest of the drive is still there: nothing addressed it. The tool wrote only within the partition it created, leaving every region beyond it exactly as it was.
Why that makes the proportion so favourable: the footprint is tiny. On a drive of several terabytes, an installer partition occupies a small percentage, and the great bulk of the original content has not been written over.
What was genuinely lost: whatever occupied the beginning. The original partition table and the content in the first thirty-two gigabytes were overwritten, and that region is not recoverable.
Why losing the table matters more than losing the content there: it described everything. Without it, nothing knows where the original volume began or ended, which is why the drive appears to have lost everything.
How the boundaries are recovered: from the filesystem itself. A volume leaves recognisable structures at its start and duplicates elsewhere, and those identify where it began independently of any table.
Why imaging at physical capacity is essential rather than incidental: the reported size is wrong. Any tool trusting the drive's stated thirty-two gigabytes would capture only the installer and none of the content.
Why his instinct to convert it back is the wrong order: restoring the drive means writing to it. Recreating the original partition writes a new table, and the content should be extracted before anything is written.
What must not happen meanwhile: no use of the installer and no reformatting. Booting from it writes temporary data, and a full format would reach the regions that are currently intact.
On the bench
Reported capacity was treated as evidence of a small written footprint — media creation writing a new partition table and one volume sized for the installation files, so a drive presenting as 32GB has been described rather than erased, with regions beyond the installer partition untouched. The original table and the content within that first region are the genuine loss. The drive was imaged at full physical capacity rather than at the reported size, which any tool trusting the stated figure would miss.
The outcome
Reported capacity treated as evidence of footprint, the drive imaged at full physical capacity, and boundaries reconstructed from filesystem signatures. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: the figure is the reassuring part. An installer needed thirty-two gigabytes and wrote thirty-two gigabytes — everything past that is exactly where you left it.
A drive turned into installation media by mistake
Don't boot from it and don't reformat it to get the capacity back — booting writes temporary data, and a full format would reach the regions that are currently intact. Read the reduced size as good news: capacity is a description rather than a physical property, and the installer wrote a partition table plus one small volume, leaving everything beyond it untouched. The real loss is the original table and whatever occupied that first stretch. Extract the content before restoring the drive, not after.
Don't reformat it — call Cambridge Data Recovery on 01223 655015; capacity read as footprint evidence, imaged at full physical size rather than the reported one, boundaries reconstructed from filesystem signatures.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.