Data Recovery Case File · Solid State & Flash · A Backup That Removed the Original
Moving Files Between Devices Leaves No Copy Behind, Which Is Not What Backing Up Means
Her enquiry describes an operation that did the opposite of what she intended. Wanting "to back up some of my files on a USB, however they somehow moved to it instead" — and the stick now asks to be reformatted, which would remove university work she needs. The word somehow is doing a lot of work, and the answer is that moving and copying are both offered, are easy to confuse, and one of them leaves nothing behind.
| Media | USB flash drive holding academic work transferred rather than copied from a computer — host prompting for reformatting; no second copy existing on the source |
| Reported situation | Files intended to be copied to a flash drive as a backup · operation performed as a move rather than a copy · originals no longer present on the source computer · flash drive subsequently not readable · host prompting for the drive to be reformatted · prompt declined · academic work sought |
| Fault class | Volume descriptor unreadable with content regions retained — drive holding the only instance of the material by virtue of the transfer having been a move |
| Equipment used | Absence of a source copy established before scope was set · reformatting declined and the device removed from use · imaged write-blocked at the block level before any interpretation · volume structures recovered from residual copies · content carved by signature and validated by opening |
The decode: how a copy becomes a move, and what the prompt actually reports
Why both operations exist and look alike: they are the same gesture. Dragging a file to another location performs one or the other depending on where it is going and which keys are held.
Why the outcome differs entirely: one deletes the source. A copy leaves the original in place; a move removes it once the transfer completes.
Why nothing announced it at the time: both report success identically. A completed move and a completed copy end the same way, with files present at the destination.
Why that turned a backup into a transfer: she has one instance rather than two. The stick stopped being a copy of anything the moment the originals were removed.
What that changes about the case: there is nowhere else to look. Most enquiries begin by establishing what exists elsewhere, and here the answer is nothing.
Why the originals may nonetheless be partly recoverable: deletion removes references. Files removed from the source computer remain in its free space until overwritten, so that machine is a second front worth pursuing.
Why that is worth acting on quickly: a computer in daily use overwrites. The source machine should be left alone as well as the stick.
Now the prompt on the stick, which is less alarming than it reads: it reports one thing. The host reached the device and could not interpret the structure identifying the filesystem.
Why declining it was the decisive action: reformatting writes. It creates a fresh empty filesystem over the descriptor that locates everything.
Why the descriptor being small is the good news: the content is elsewhere on the device. A few hundred bytes determine recognition, and her work sits well beyond them.
On the bench
Absence of a source copy was established before scope was set — moving and copying being the same gesture, determined by destination and modifier keys, and reporting completion identically, so a move that removed the originals left a single instance rather than a backup. Files deleted from the source nonetheless remain in its free space until overwritten, making that machine a second avenue. Volume structures were recovered from residual copies.
The outcome
Absence of a source copy established before scoping, reformatting declined, and structures recovered from residual copies. Free assessment, one fixed written figure including VAT; on flash devices where content has been deleted or overwritten, the figure is payable upfront. The decode: a move and a copy are the same gesture and report success identically — one just removes the original. Leave the source computer alone too, because your files are still in its free space.
When a backup turned out to move rather than copy
Stop using the source computer as well as the drive — the originals were deleted rather than destroyed, so they remain in that machine's free space until something overwrites them, and a computer in daily use does that quickly. Decline the reformatting prompt: it reports only that a small descriptor couldn't be interpreted, and accepting it writes over the structure that locates everything. In future, check that files are still at the source before assuming a backup happened.
Leave both devices alone — call Cambridge Data Recovery on 01223 655015; absence of a source copy established before scoping, reformatting declined, structures recovered from residual copies.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.