Data Recovery Case File · Solid State & Flash · The Name Outlived the List
A Folder Is Itself a Record Pointing Elsewhere, and the Pointer Can Outlive the Target
Her enquiry contains two observations that together are almost a diagnosis. A stick holding old college work and current university work, where "the old college files are completely fine but the current uni files are just not there anymore" — and, precisely, "the folder name is still on the stick, but clicking into it shows it is empty." Both halves are structural: the age split and the surviving name point at the same thing.
| Media | USB flash drive holding material of two distinct ages — older content listing and opening normally; recent content absent with its containing folder still named and listing empty |
| Reported situation | Flash drive holding college material and current university material · older material listing and opening correctly · recent material no longer present · containing folder still visible by name · folder listing as empty on opening · final project work sought |
| Fault class | Directory records damaged for recently written content — parent entries retained while their contents lists are unreadable; file data regions substantially intact |
| Equipment used | Surviving folder entry distinguished from surviving folder contents · no repair or scan permitted on the device · imaged write-blocked at the block level before any interpretation · directory records reconstructed from residual copies and cross-referenced against allocation state · content carved by signature and matched to reconstructed names where possible |
The decode: why the name survives, and why age divides the two halves
What a folder actually is on a filesystem: a record like any other. Its entry gives the name and points at a location holding the list of what is inside — the name and the contents are two separate things in two separate places.
Why that explains exactly what she sees: one survived and the other did not. The entry naming the folder is readable, and the list it points at is not, which produces a folder that opens and shows nothing.
Why an empty folder is therefore encouraging rather than alarming: nothing says the files are gone. An unreadable list is a lost index, and the content it indexed is elsewhere on the device entirely.
Now the age split, which is the second finding: old material is fine and recent material is not. That is positional rather than coincidental.
Why writing later means writing elsewhere: space is allocated in order. Material added over time occupies regions the earlier material did not, so a region that has failed affects one period and not another.
Why flash devices produce this pattern particularly: wear is uneven. Regions written and rewritten most recently have had the most cycles, and structures updated on every change wear faster than files that were written once.
Why directory records are the most vulnerable thing on the device: they change constantly. Every save, rename and delete updates them, while the files themselves are written and left alone.
What that means for her prospects: good. The most heavily used structures failed and the least used data did not, which is the recoverable version of this fault.
Why no repair or scan must be run: those write. A consistency check rebuilds structures by writing new ones, and on a device with failing regions the write may not succeed — and it destroys the evidence a reconstruction uses.
What must happen now: the stick stays out. Every connection risks the device deciding to reorganise itself, and it has nothing left to gain from being plugged in.
On the bench
The surviving folder entry was distinguished from surviving folder contents — a folder's name and its contents list being separate records in separate locations, so a readable entry pointing at an unreadable list produces a folder that opens empty while the indexed content remains elsewhere on the device. The age split is positional: later material occupies regions earlier material did not, and directory structures, updated on every change, wear faster than files written once. Records were reconstructed from residual copies.
The outcome
The surviving entry distinguished from surviving contents, no repair or scan permitted, and directory records reconstructed from residual copies. Free assessment, one fixed written figure including VAT; on flash devices where content has been deleted or overwritten, the figure is payable upfront. The decode: a folder's name and its contents are two separate records in two separate places. Yours kept the name and lost the list — which is an index problem, not a missing-files problem.
A folder that opens and shows nothing
Leave the device unplugged and don't run any scan or repair — those work by writing new structures, which may not succeed on a device with failing regions and destroys what a reconstruction uses. Read the symptom as encouraging: a folder's name and its contents list are separate records in separate places, so a folder that opens empty has lost its index rather than its files. The age split points the same way — recent material sits in regions that have seen the most wear.
Leave it unplugged — call Cambridge Data Recovery on 01223 655015; the entry distinguished from its contents list, imaged write-blocked, directory records reconstructed from residual copies.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.