Data Recovery Case File · Formatted & Logical Faults · Old Resets Left More Behind
A Factory Restore of That Generation Reinstalled Over the Drive Rather Than Erasing It
His enquiry concerns a loss that is old enough to feel settled and is not. A laptop "reset to factory settings seven years ago", losing photographs held in an image application, on a machine that "hasn't been used a lot since but still works." Two details decide this: what a factory restore meant on a machine of that era, and how much has been written to the drive in the years since — and both are more favourable than the elapsed time suggests.
| Media | Laptop hard drive subjected to a manufacturer factory restore approximately seven years previously — machine remaining functional and lightly used since; photographic content sought |
| Reported situation | Laptop restored to factory settings by the owner approximately seven years previously · photographic content held in an image application lost in the process · machine remaining in working order · machine used only lightly in the intervening period · retrieval of the lost photographs sought |
| Fault class | Factory restore performed as reinstallation over an existing volume — prior content retained beyond the restored footprint; recoverability governed by writing performed since |
| Equipment used | Restore method established for the machine generation before prospects were assessed · machine removed from use immediately · drive removed and imaged write-blocked under strict per-sector timeouts · pre-restore structures recovered from residual copies outside the restored region · image content carved by signature and validated by opening at full resolution |
The decode: what that kind of restore did, and what the years since cost
What a factory restore of that generation consisted of: a reinstallation. A stored image of the original system was written back over the beginning of the drive, and the volume was marked as empty.
Why that is not an erase: it wrote a system, not zeroes. Only the region the restored image occupied was written to, and every region beyond it was left exactly as it was.
Why the proportion favours him: a system image is small. An operating system of that era occupied a modest fraction of the drive, while photographs accumulate across the whole surface.
Why modern equivalents would be far worse: they erase properly. Contemporary resets discard an encryption key or perform a full erase, which leaves nothing — his machine predates both.
Why the age of the machine is therefore an advantage: the method was cruder. The less thorough the reset, the more survives.
Now the years since, which is the real variable: use consumes what remains. Every file written since the restore lands in space the restore marked as available, which is where the photographs are.
Why light use is genuinely good news: less was written. A machine used occasionally over seven years has written a small fraction of what a daily one would.
Why the machine still working is the risk rather than the reassurance: a working machine invites use. Every start-up writes logs, updates and temporary files even when nothing is being done deliberately.
What that makes the urgent action: stop using it now. Seven years of light use has left a great deal intact, and continued use is the only thing still consuming it.
What is worth expecting honestly: a partial result. Photographs recovered this way usually come back without their names or folders, since the records describing them were in the region that was written over.
On the bench
The restore method was established for the machine generation before prospects were assessed — factory restores of that era writing a stored system image over the beginning of the drive and marking the volume empty, which leaves every region beyond the image untouched, unlike contemporary resets that discard an encryption key or erase fully. Use since is the governing variable, as writes land in space the restore marked available. Pre-restore structures were recovered from residual copies.
The outcome
Restore method established for the generation, the machine removed from use, and content carved from beyond the restored footprint. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: the age of that machine is in your favour. Its restore wrote a system image over the start of the drive rather than erasing it — and light use since is why so much is still there.
Content lost to a factory reset years ago
Stop using the machine now, even though it still works — that's the only thing still consuming what survived, since every start-up writes logs, updates and temporary files into the space the reset marked as available. Don't assume the years have settled it: a restore of that generation wrote a system image over the start of the drive rather than erasing anything, so the older and cruder the method, the more remains. Expect photographs back without their original names or folders.
Stop using it — call Cambridge Data Recovery on 01223 655015; restore method established for the generation, imaged write-blocked, content carved from beyond the restored footprint.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.