Data Recovery Case File · Trust, Practice & Honest Limits · Two Jobs, One Order
Retrieving What Matters and Destroying What Does Not Are the Same Task in Sequence
Her enquiry has two objectives that people usually treat as unrelated. An old machine she is "considering disposing of", where she wants to "protect the old photos stored on it plus wipe any personal data", and cannot remember the password to do either — on a computer "not been used for at least the last six years." Both objectives are served by the same access, and the forgotten password prevents neither.
| Media | Desktop computer of an earlier generation, unused for approximately six years — sign-in credentials not known; photographic content sought and secure erasure required before disposal |
| Reported situation | Machine considered for disposal · photographic content sought before disposal · secure removal of personal data required · sign-in credentials no longer known · machine unused for approximately six years · guidance and indicative cost requested |
| Fault class | Access controls rather than storage fault — drive readable independently of sign-in; erasure to be performed after extraction and verified |
| Equipment used | Ownership confirmed before any examination · sign-in restriction distinguished from volume encryption · drive removed and imaged write-blocked, bypassing host sign-in entirely · content listed and photographic material extracted and validated · drive erased across its full address range afterwards with erasure verified by sampling |
The decode: why the password stops neither task, and what wiping actually requires
What a sign-in password does: restricts a running system. It prevents someone using that installation and operates entirely within the operating system.
Why it does not protect the drive: content is not transformed. Files are written in ordinary readable form, so removing the drive and reading it elsewhere bypasses the password completely.
Why that is relevant to her second objective as much as her first: it cuts both ways. The password that stops her reaching her photographs also fails to protect anything from whoever receives the machine.
What would change that: volume encryption. A machine of that generation is unlikely to have had it enabled, and it would be established rather than assumed.
Why the order is fixed: extraction first. Erasure is irreversible, so everything wanted must be retrieved and verified before anything is destroyed.
Now what wiping actually means, which is where most people go wrong: a format is not an erase. Formatting writes a fresh empty filesystem and marks the capacity available, leaving the content physically present for anyone to recover.
Why deleting files is weaker still: it removes references. A deleted file's content remains exactly where it was until something writes over it.
What a genuine erasure requires: writing across the whole capacity. Every addressable region is overwritten, which takes hours on a large drive and is the only method that leaves nothing.
Why verification matters rather than being a formality: partial erasure is common. Regions the drive has remapped may not be reached, and sampling afterwards confirms what was actually written.
What the alternative is if she prefers certainty: keep the drive. A machine can be disposed of without its storage, and a removed drive can be destroyed physically — which costs nothing and removes the question entirely.
On the bench
Sign-in restriction was distinguished from volume encryption — a sign-in password restricting a running installation while leaving files in ordinary readable form, so removing the drive bypasses it and equally means it protects nothing from a future owner. Extraction preceded erasure, which is irreversible. Formatting writes a fresh filesystem and marks capacity available without removing content, whereas genuine erasure overwrites every addressable region and was verified by sampling.
The outcome
Ownership confirmed, content extracted and validated before anything was destroyed, and the drive erased across its full address range with erasure verified. Free assessment, one fixed written figure including VAT. The decode: the password stops neither job. It restricts a running system and never touches the disc — which also means it protects nothing from whoever receives the machine, and a format would not either.
Before disposing of an old computer
Get what you want off first, then erase — the order matters because erasure is irreversible. Don't rely on a format or on deleting files: a format writes a new empty filesystem and marks the space available while leaving your content physically present, and deletion only removes the reference. A genuine wipe overwrites every addressable region and takes hours. Your forgotten password protects nothing either, since the drive can simply be read elsewhere. Simplest option: keep the drive and dispose of the machine.
Extract, then erase — call Cambridge Data Recovery on 01223 655015; sign-in distinguished from encryption, content extracted and validated first, erasure written across the full address range and verified.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.