Data Recovery Case File · Formatted & Logical Faults · The Older Copy Answered
Drive That Seems to Have Reverted to an Older State
Her enquiry described something that sounds impossible and is in fact quite specific. A portable hard drive: "sometimes not recognised, unable to open. Missing data — it seems to have reset to a couple of years ago, and all new files are gone." Drives do not travel backwards in time, and nothing has been restored from anywhere. But a drive whose contents appear to have reverted to an earlier state is describing a real and recognisable event, and the explanation is more hopeful than it sounds — because the recent files are almost certainly still physically present, and what has actually happened is that the wrong copy of the index is being read.
| Media | Portable external hard drive — intermittent recognition; contents presenting as an earlier state with recent files absent |
| Reported situation | Drive sometimes unrecognised and sometimes opening · visible contents corresponding to an earlier period · recent files not listed · no deletion or restore performed by the owner |
| Fault class | Primary filesystem index damaged with a stale backup copy in use — recent entries absent from the listing while their data remains physically present |
| Equipment used | Write-blocked imaging before any repair · both primary and backup filesystem structures located and compared on the image · current index reconstructed in preference to the stale copy · recovered set verified by opening |
The decode: why a drive can show you the past
How filesystems protect themselves: the index describing every file — its name, size, dates and location — is the single most critical structure on a drive, and losing it would make everything unreachable even though the data survived. So filesystems keep more than one copy. A primary index is used constantly, and a backup or mirrored copy is maintained elsewhere on the disk precisely so that a damaged primary is not fatal.
What happens when the primary is damaged: the system falls back on the backup. That is the design working. But there is a consequence nobody expects: the backup copy is not necessarily current. Depending on the filesystem and how the damage occurred, the fallback copy can be significantly out of date — reflecting the drive as it was when that copy was last written. So the drive mounts, the contents list successfully, and what appears is an older picture of the same disk. Files created since are absent from the listing while sitting physically untouched on the platters, unreferenced by the index currently in use.
Why that is good news: because nothing has been deleted and nothing has been overwritten. The recent files are present; they are simply not described by the index the computer happens to be reading. Recovery works by locating both copies of the index on an image, comparing them, and reconstructing the current one — which returns the recent files with their real names, folders and dates rather than as an unnamed carve. Where the primary index is too damaged to rebuild fully, the missing entries are recovered from the file records themselves.
Why the intermittent recognition fits: her other symptom belongs to the same story. A drive with damaged structures often struggles at exactly the moment it is asked to present them, so it appears sometimes and not others. That intermittency is also the danger: every successful mount is an opportunity for the operating system to write to the stale index — updating timestamps, journalling, tidying — and each write makes reconstructing the current picture harder.
What must not happen: using the drive. Copying files onto it, letting anything repair it, or running a disk check will write against the stale index and can permanently discard references to the recent files. And no file should be deleted from it in the belief that the drive is simply out of date.
On the bench
The drive was imaged write-blocked before anything else, because on this fault every mount risks the operating system writing against the stale index and eroding what remains. On the image both copies of the filesystem index were located and compared — the primary and its backup — which established directly that the drive was presenting an older picture rather than having lost data. The current index was reconstructed in preference to the stale copy, with missing entries rebuilt from the underlying file records where the primary was too damaged. The recovered set was verified by opening, and the recent files confirmed present with their real names and dates.
The outcome
The stale index identified, the current one reconstructed from the image, and the recent files recovered with names and dates intact. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose drive appears to have gone backwards: filesystems keep more than one copy of their index precisely so a damaged primary is not fatal, and when the system falls back on the backup that copy may be significantly out of date — so the drive shows you an older picture of itself while recent files sit physically present and unreferenced; nothing has been deleted and nothing overwritten; intermittent recognition belongs to the same fault; and every further mount risks writing against the stale index, so stop using it and let nothing repair it.
Drive showing an older version of itself
Stop using it, and don't delete anything from it. Your recent files almost certainly still exist. Filesystems keep a backup copy of the index that describes every file, so that damage to the main one isn't fatal — and when the system falls back on that spare copy, it can be considerably out of date. The result is a drive that mounts perfectly and shows you its contents as they were months or years ago, while everything created since sits physically on the disk, unreferenced by the index currently in use. Nothing has been erased. What makes it worse is continued use: every time the drive mounts, your computer may write to that stale index — updating timestamps, tidying, journalling — and each write erodes the current picture a recovery rebuilds from. So don't copy anything on, don't run a disk check, and don't let anything repair it.
Your recent files are still there — call Glasgow Data Recovery on 0141 404 0294; imaged write-blocked, both index copies compared, the current one rebuilt with real names and dates.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.