Data Recovery Case File · Formatted & Logical Faults · The Arithmetic Disagrees
Files Vary in Size, So an Identical Figure Is Not About the Files
Her enquiry contains a number that does the whole diagnosis. A flash drive where "the files are still showing as being there, albeit they don't open properly. All are showing the size as 8KB, though the total size showing on" the drive is far larger. Real files are not all the same size — a uniform figure across every entry means the records describing them were written with a default value, and the disagreement with the occupied capacity proves the content is still there.
| Media | USB flash drive — directory entries present with a uniform incorrect length reported for every file; occupied capacity substantially exceeding the sum of reported lengths |
| Reported situation | Files visible on the drive · files not opening or opening incorrectly · every file reporting an identical small size · total occupied capacity far exceeding the sum of those reported sizes · contents required |
| Fault class | Directory length fields overwritten with a uniform default — content present and correctly located; entries understating file extent |
| Equipment used | Reported lengths reconciled against occupied capacity before any conclusion · no repair permitted · imaged write-blocked under strict timeouts · true file extents determined by structure analysis and signature boundaries · files validated by opening |
The decode: what a uniform size means, and why the totals matter
Why identical sizes cannot be real: files vary enormously — a document is not the same length as a photograph, and neither matches a video. Every entry reporting the same figure is a pattern no genuine set of files produces, so the figure is not describing the files at all.
What it is describing instead: a default. When directory records are damaged and partially rewritten — by an interrupted write, or by a repair that reconstructed entries it could not fully resolve — the length field frequently gets a placeholder, commonly the size of one allocation unit. The name survives, the location may survive, and the length is invented.
Why her second observation is the confirmation: the drive reports far more capacity in use than the sum of the sizes it is reporting. That is an arithmetical contradiction and it can only resolve one way — the content occupies the medium and the records understate it. If the files really were that small, the space would not be consumed.
Why the files open badly rather than not at all: anything reading them reads the recorded length, takes that many bytes, and stops. So it receives a fragment of a real file — enough to identify the format, not enough to render it, which produces exactly the partial and broken behaviour she describes.
Why that is a good position: the content is present, correctly located, and unaltered. What is wrong is a number in a record, and the true extent of each file is determined from the filesystem's allocation structures or from the file's own internal markers, both of which survive independently of the length field.
The danger worth naming, because it is specific to this fault: a repair utility meeting entries whose recorded length disagrees with their allocation will make them agree — by truncating the files to match the recorded size. That converts a bookkeeping error into genuine loss, and it is what a consistency check exists to do.
What must not happen: no repair, no check, no copying the files off and hoping. Copying honours the recorded length, so a copy produces the same fragments.
What to do instead: nothing to the drive at all. The reconstruction happens against an image, where extents can be recalculated without any risk of the disagreement being resolved the wrong way.
On the bench
Reported lengths were reconciled against occupied capacity before any conclusion — an identical size across every entry being a pattern no genuine file set produces, and occupied capacity exceeding the sum of reported lengths establishing arithmetically that content is present and understated. No repair was permitted, a consistency check resolving that disagreement by truncating files to their recorded size. True file extents were determined by structure analysis and signature boundaries, both surviving independently of the length field.
The outcome
Lengths reconciled against capacity, no repair permitted, and true extents determined from allocation structures and internal markers. Free assessment, one fixed written figure including VAT; where a chip has to be removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: files vary in size, so an identical figure across all of them describes a default rather than your data. And your own observation settles it — the drive reports more space in use than those sizes add up to, which means the content is there.
Every file reporting the same small size
Don't run a repair or a consistency check — this is the one fault where that does the specific damage. A tool meeting entries whose recorded length disagrees with the space they occupy will make them agree by truncating the files to match the recorded size, turning a bookkeeping error into real loss. Your own arithmetic already proves the content is there: files vary enormously in size, so an identical figure across every one of them is a default rather than a measurement, and the drive reporting far more capacity in use than those sizes add up to can only mean the content occupies the medium. Copying won't help either, since a copy honours the recorded length.
Don't run a repair — call Oxford Data Recovery on 01865 593000; lengths reconciled against occupied capacity, imaged write-blocked, true extents determined from allocation structures rather than from the entries.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.