Data Recovery Case File · Trust, Practice & Honest Limits · Whose Data, and Who Asks
A Quick Format Removes the Description and Leaves Nearly Everything Behind It
This enquiry comes from an organisation rather than an individual, which changes what has to be established before anything technical. A laptop belonging to a charity, returned by a member of staff who had been using it remotely, where "upon return it appears the hard drive has been formatted" — and they would like whatever can be recovered. Two questions come first: what the format actually did, and on whose authority the drive is read.
| Media | Organisation-owned laptop hard drive returned following remote use — volume apparently formatted; organisational content sought |
| Reported situation | Laptop owned by an organisation and issued for remote working · device returned by a member of staff · drive appearing to have been formatted · organisational content sought · enquiry made by an authorised representative · written correspondence preferred |
| Fault class | Formatted volume with content regions retained — recoverability governed by format type and by writing since; scope confined to organisational material |
| Equipment used | Authority to instruct confirmed before any examination · scope agreed in writing as organisational material only · device removed from use immediately · imaged write-blocked at the block level before any interpretation · prior volume structures recovered from residual copies with content carved by signature where they did not reconcile |
The decode: what the format left, and how the scope is set
Why authority is established first here and not last: the device belongs to the organisation and the material may not all be theirs. A machine used for remote working commonly holds personal content alongside organisational content, and the distinction matters.
How that is handled in practice: the scope is agreed in writing before anything is read. Recovery is confined to organisational material, and personal content encountered incidentally is not delivered.
Why that is worth insisting on rather than glossing: it protects everybody. An organisation recovering its own records is on firm ground; an organisation receiving an individual's private material is not.
Now the technical position, which is favourable. A standard format writes fresh filesystem structures and marks the capacity available. It does not erase content, and the great majority of what was there remains in place.
Why the description is nonetheless gone: the directory was replaced. Names, folders and dates described by the previous filesystem are not in the new one, even where the files themselves persist.
Why they can often be recovered anyway: filesystems keep duplicate copies of key records elsewhere on the volume. Where those survive outside the newly written region, the original arrangement can be read from them.
What would change the position substantially: a full format or a secure erase. Those write across the whole capacity and leave nothing, and which was performed is established from the drive rather than assumed.
What matters more than any of that: use since. Every hour the machine runs writes into space the format marked as free, which is why it should already be switched off.
Why that is the one thing they control today: everything else is fixed. The format has happened and cannot be undone; the writing that would consume what it left has not all happened yet.
What is worth checking in parallel, at no cost: what the organisation already holds. Documents worked on remotely are frequently on shared storage or in mail, and anything found there reduces what rests on the drive.
On the bench
Authority to instruct was confirmed before any examination, with scope agreed in writing as organisational material only, since devices issued for remote working commonly hold personal content alongside organisational records. Technically, a standard format writes fresh structures and marks capacity available without erasing content, replacing the directory while duplicate copies of key filesystem records elsewhere on the volume permit the original arrangement to be reconstructed. A full or secure erase would differ, and was established from the drive.
The outcome
Authority confirmed and scope agreed in writing before examination, the device removed from use, and prior structures recovered from residual copies. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: a standard format takes the description and leaves the content. What decides the rest is use since — which is why the machine should already be switched off.
Recovering an organisation's data from a returned device
Switch the machine off now — it's the only variable still under your control, since every hour it runs writes into space the format marked as free. Then set the scope in writing before anything is read: a device issued for remote working usually holds personal content alongside organisational records, and confining recovery to the organisation's own material protects everyone involved. On the technical side, take some encouragement — a standard format replaces the directory rather than erasing content, and duplicate filesystem records often survive to rebuild it.
Switch it off now — call Cambridge Data Recovery on 01223 655015; authority confirmed and scope agreed in writing first, imaged write-blocked, prior structures recovered from residual copies.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.