Data Recovery Case File · Formatted & Logical Faults · Not Marked, Therefore Not Found
Undelete Software Looks for Entries Marked Deleted, and His Was Not
His enquiry is unusually well documented and explains its own failure. A drive used for academic work where a folder "labelled Research under Documents has gone missing. Up until one date files were saved and used on it. Between then and the early hours of another the folder has gone. Searches do not show that it has been moved elsewhere. I have run scans of the drive but cannot find the files anywhere." A scan finding nothing does not mean nothing is there — it means the tool did not find what it was looking for, and it was looking for deletions.
| Media | 1TB external hard drive in professional use — a single directory tree absent between two documented dates; consumer undelete scanning returning nothing |
| Reported situation | External drive used for academic and professional work · a named folder present and in use up to a documented date · folder absent by a documented later date · search of the volume confirming it has not been relocated · undelete software run without result · content required |
| Fault class | Directory record damage rather than deletion — entries not flagged as deleted and therefore invisible to undelete scanning; content present and unreferenced |
| Equipment used | Absence of undelete results interpreted as evidence against deletion · date window used to bound the affected structures · imaged write-blocked before any reconstruction · directory records recovered from surviving copies · signature carving within the bounded region alongside |
The decode: why the scan found nothing, and what that tells us
How undelete software works: a deletion does not remove a file. It marks the directory entry as no longer in use and releases the space, leaving the entry itself readable and flagged. Undelete tools scan for exactly those flagged entries and offer to restore them.
Why that approach is effective and narrow: it depends entirely on the entry existing and carrying the mark. A file that was deleted normally is found reliably — and anything absent for a different reason is invisible to the method.
So what his empty result actually establishes: the folder was probably not deleted. If it had been, the tool would have found it, because that is the one thing such tools do well. The absence of a result is a finding rather than a dead end.
What else removes a folder from view: damage to the directory record describing it. The record holding a folder's name and the list of what it contains occupies specific sectors, and if those become unreadable, the folder ceases to appear — without ever being marked as deleted, because nothing deleted it.
Why the contents are unaffected: the files sit elsewhere on the medium, exactly where they were written. What has gone is the entry that named them and said where they were — so they are present and unreferenced rather than removed.
Why his search for the files was also fruitless: a search asks the filesystem for files matching a name, and the filesystem no longer has a record of them. Searching cannot find what the index does not list, so a negative result there is expected rather than informative.
Why his date window is genuinely valuable: he can bound the event between two known times. That establishes how much has been written since — which is the variable determining whether the unreferenced content is still intact, and it is measurable rather than guessed.
What must not happen: no consistency check. A repair meeting an unreadable directory record resolves the inconsistency by removing it, which converts a recoverable situation into an actual deletion — and it is the natural next step after undelete software fails.
On the bench
The absence of undelete results was interpreted as evidence against deletion — deletion marking a directory entry as unused while leaving it readable and flagged, which is precisely what such tools scan for, so a folder absent for another reason is invisible to the method. Damage to the record naming a folder removes it from view without any deletion flag. The date window was used to bound the affected structures, and records recovered from surviving copies.
The outcome
The empty scan treated as evidence against deletion, the date window used to bound the event, and directory records recovered from their surviving copies. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: your scan finding nothing is informative. Undelete tools scan for entries marked as deleted, and they find those reliably — so an empty result suggests the folder was never deleted, and its record was damaged instead.
A folder that vanished and undelete software cannot find
Don't run a consistency check next — it's the natural step after undelete fails, and it does the specific damage here by resolving an unreadable directory record through removing it. Read the empty scan as information instead: undelete tools work by finding entries marked as deleted, which they do reliably, so nothing found suggests the folder was never deleted at all. Damage to the record naming a folder removes it from view without any deletion flag, and the files themselves sit untouched where they were written, present but unreferenced. Note the dates it was last seen and first missed — that bounds how much has been written since.
Don't run a check — call Oxford Data Recovery on 01865 593000; empty scan treated as evidence against deletion, date window used to bound the event, directory records recovered from surviving copies.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.