Data Recovery Case File · Portable Drives · Absent or Never Present
Content Missing From a Drive Is Either Lost or Was Never Written, and Those Differ Entirely
Her enquiry assumes a loss, and the first question is whether there was one. A drive posted internationally which "doesn't have any of the film footage that was initially transferred" from a friend's camera, with advice that it "may have been damaged en route." Damage in transit is one explanation and an incomplete transfer is another — and they leave completely different traces, which is why the drive is examined before anything is assumed.
| Media | External drive transported internationally by post — expected film content not present; drive otherwise accessible; transfer performed by a third party before despatch |
| Reported situation | Film footage transferred to an external drive by a third party · drive posted internationally to the recipient · expected content not present on arrival · transit damage suggested as the explanation · content described as substantial work · recovery sought |
| Fault class | Expected content absent with cause undetermined — transit damage and incomplete transfer producing distinguishable on-disk evidence |
| Equipment used | Absence assessed for evidence of prior presence before any recovery route was chosen · imaged write-blocked at the block level before any interpretation · allocation state and residual directory records examined for traces of a completed transfer · surface condition assessed for impact and read-instability consistent with transit damage · content carved by signature across unallocated regions |
The decode: how the two explanations are told apart
Why this is the first question rather than a technicality: it determines whether recovery is possible at all. Content that was never written cannot be recovered by anyone, and content that was written and lost usually can.
What a completed transfer leaves behind even after loss: traces. Directory records, allocation entries and partially overwritten fragments all persist, and their presence establishes that the files once existed.
What an incomplete transfer looks like instead: nothing at all. A drive that never received the content has no records referring to it, no allocated space and no fragments.
Why that distinction is usually clear-cut: the evidence is structural. Writing files leaves marks in several places, and all of them being absent is itself an answer.
Why an incomplete transfer is genuinely plausible here: it was done by someone else. Large video transfers take time, and a copy interrupted or closed early leaves the destination looking usable.
What would support the transit explanation: physical evidence. Impact damage produces read instability and mechanical symptoms rather than a drive that reads perfectly and lacks one folder.
Why a drive that is otherwise accessible argues against transit damage: impact is not selective. A drive damaged in transit does not lose one category of content and present everything else normally.
What the likeliest remaining explanations are: the transfer, or the drive's arrangement. Content written to a different volume, or to a location the recipient has not looked at, accounts for a great many cases like this.
Why the friend should be asked before anything is spent: the original may still exist. Footage transferred from a camera is often still on the camera's card or on the sender's own machine, and that costs nothing to check.
What the assessment delivers either way: a definite answer. Whether the content was ever written is established from the drive rather than debated, and it costs nothing to find out.
On the bench
Absence was assessed for evidence of prior presence before any recovery route was chosen — a completed transfer leaving directory records, allocation entries and fragments that persist after loss, while content never written leaves none of them, making the distinction structural rather than inferential. Transit damage produces read instability and mechanical symptoms rather than selective absence on an otherwise accessible drive. Content was carved by signature across unallocated regions.
The outcome
Absence assessed for evidence of prior presence, allocation state and residual records examined, and unallocated regions carved. Free assessment, one fixed written figure including VAT; where recovery is not possible, nothing is charged. The decode: the first question is whether there was a loss. Files that were written leave marks in several places even after they go — and a drive that reads perfectly while lacking one folder does not look like transit damage.
Content that is not on a drive you were sent
Ask the sender to check their own copy before spending anything — footage transferred from a camera is often still on the card or on their machine, and that costs nothing. Meanwhile, don't assume a loss: files that were genuinely written leave directory records, allocation entries and fragments that survive even after deletion, so their complete absence is itself informative. A drive that reads perfectly and lacks one folder doesn't fit transit damage, which produces instability rather than selective gaps.
Establish whether it was ever written — call Cambridge Data Recovery on 01223 655015; absence assessed for evidence of prior presence, allocation state examined, unallocated regions carved.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.