Data Recovery Case File · Formatted & Logical Faults · The Tree Without the Fruit
Recovered Folders Pointing at Replaced Content Return Whatever Now Occupies Those Positions
This enquiry describes a recovery that half worked, and the half that failed is diagnostic. Installation media created by mistake on a 2TB data drive, where "I can recover folder structures, but all files seem to be corrupted — for example documents appear as gibberish." That combination has a specific cause: the records describing the files survived, and what they point at is no longer what they described.
| Media | 2TB external hard drive repartitioned as installation media — original directory structures recoverable; file content returning as unrelated data |
| Reported situation | Installation media created in error on a data drive · original content lost from the drive · folder structures subsequently recovered · recovered documents opening as unreadable data · image files also affected · recovery of usable content sought |
| Fault class | Directory records surviving with referenced content overwritten in part — recovered entries resolving to installer data; content beyond the written region retained and locatable by signature |
| Equipment used | Structural recovery distinguished from content recovery before any conclusion was drawn · drive imaged write-blocked at full physical capacity before any interpretation · installer footprint located and excluded from content reconstruction · directory entries cross-checked against the data they resolve to · content carved by signature independently of the recovered tree |
The decode: why the folders survived, and why what they point at does not match
What creating installation media wrote: a new partition table and a small volume. The tool defined a partition for the installation files and copied them into it, occupying the beginning of the drive.
Why the original directory records survived that: duplicates sit elsewhere. Filesystems keep backup copies of their key structures at other positions, and those frequently fall outside the region the installer used.
Why recovering them produces a convincing tree: the records are complete. Names, folders, dates and sizes are all present, because the records describing them were not overwritten.
What each record actually contains: a pointer. A directory entry says where a file's content begins and how far it runs — it does not contain the content.
Why that is the whole explanation: the pointers still work and the destinations changed. An entry pointing into the region the installer wrote now resolves to installer data, which is returned faithfully and is not the file.
Why the result is gibberish rather than an error: nothing detected a problem. The recovery read the requested length from the requested position and returned it, exactly as asked.
Why this is genuinely encouraging despite appearances: only part of the drive was written. An installer partition occupies a small fraction of a 2TB drive, so entries pointing beyond it resolve correctly.
Why he may not be seeing those: the check was not made. Testing a few files from the start of a tree samples exactly the region most likely to be affected.
How the two are separated properly: by mapping the footprint. The installer's written region is located on the image, and entries resolving into it are distinguished from those resolving outside.
Why carving is run alongside rather than instead: it does not depend on pointers. Content located by its own structure recovers regardless of what any directory entry claims, and the two results are reconciled.
On the bench
Structural recovery was distinguished from content recovery before any conclusion was drawn — filesystems keeping duplicate copies of key structures at positions frequently outside an installer's footprint, so a complete tree recovers with names, dates and sizes intact. Directory entries hold pointers rather than content, so entries resolving into the written region return installer data faithfully and without error. The footprint was located and excluded from content reconstruction.
The outcome
Structural recovery distinguished from content recovery, the drive imaged at full physical capacity, and entries cross-checked against what they resolve to. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: a directory entry is a pointer, not a container. Yours survived and part of what they point at was replaced — so the recovery returned installer data, faithfully, in your documents' names.
When the folders come back but the files are unreadable
Don't conclude everything is lost — test files from deeper in the tree, not just the first few. A directory entry is a pointer saying where content begins and how far it runs, not a container, so entries resolving into a region that was overwritten return whatever now occupies it, faithfully and without any error. On a large drive an installer footprint is a small fraction, so entries pointing beyond it resolve correctly. Sampling the start of a tree samples exactly the affected part.
Test deeper in the tree — call Cambridge Data Recovery on 01223 655015; structure distinguished from content, footprint located and excluded, carving run independently of the recovered tree.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.