Data Recovery Case File · Formatted & Logical Faults · Why the Scan Found Nothing

The Software Examined the New Filesystem and Reported It Correctly

His enquiry describes two mistakes in sequence and one puzzling result. Having "deleted and then formatted a partition by mistake — nothing has been written afterwards, but I have tried recovery with software with no luck." Two operations left two layers, and consumer software that finds a filesystem and scans it will find the new empty one, examine it thoroughly, and honestly report that it contains nothing.

The decode: two operations, and what each one changed

The first — deleting the partition. That removes the entry in the table describing where the volume began and ended. It writes a few sectors at the very start of the drive and touches nothing else — the filesystem and every file within the region remain exactly where they were, simply no longer claimed.

The second — formatting. Having deleted the entry, a new one was created and a fresh filesystem written into it. That writes empty structures at the beginning of the region, on top of where the previous filesystem's own structures lived.

So the position now: a new, empty, valid filesystem sits over the front of a region that still contains the old one's content. Two layers, with the top one small and the bottom one nearly complete.

Why the software found nothing, and it was not malfunctioning: consumer recovery tools locate a filesystem and scan it for deleted entries. They found the new one, which is valid and genuinely empty, scanned it correctly, and reported the truth about it. Nothing was ever deleted from that filesystem, because it has only just been created.

Why that is the crucial misunderstanding: the tool answered the question it was designed to answer. The question that needed asking was about the filesystem underneath, which the tool had no reason to look for because it had already found one.

What is actually required: ignoring the new filesystem entirely and searching the region for the previous one's structures — which sit beyond the small area the new one occupies, and which most filesystems duplicate at known positions away from the start. Where a backup copy survives, the old layout is read directly.

Why his position is otherwise excellent: nothing has been written since. He has reported the single variable that decides how much survives, and the answer is the best available one — a fresh filesystem writes a very small quantity, and beyond it everything is untouched.

What must not happen: no further scanning with the same tools, and nothing written to the drive. Repeated scans will keep finding the same empty filesystem and reporting the same result.

On the bench

Both operations were distinguished as separate layers before any conclusion — partition deletion removing a table entry at the start of the drive while leaving the region's contents intact, and subsequent formatting writing fresh empty structures over the front of that region. The new filesystem was excluded from the search, consumer tools locating a valid filesystem and correctly reporting it empty. Previous filesystem structures were located by signature within the region.

The outcome

The two operations separated as layers, the new filesystem excluded from the search, and the previous structures located within the region. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: the software was not wrong. It found the new filesystem your format created, scanned it correctly, and reported that it contains nothing — which is true, because it was made moments ago.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.