Data Recovery Case File · Solid State & Flash · The Housekeeping Already Ran
Reset to Base Build: Why an SSD Changes the Odds
The enquiry was concise and businesslike. A business laptop: "someone has reset it to the base build, which has removed the drive's original partitions. The laptop has recorded data we would like to recover. The drive is a 256GB SSD." The event is a familiar one — a machine reimaged, deliberately, with everything on it replaced by a standard build. On a conventional hard disk that would be a reasonably hopeful case, because a reimage replaces structures rather than erasing content. The detail that changes the picture entirely is the last four characters of that enquiry. On solid-state storage the odds are materially poorer, and the reason is a background process that has almost certainly already finished.
| Media | 256GB solid-state drive from a business laptop — reimaged to a standard base build; original partitions replaced; previously recorded data required |
| Reported situation | Machine deliberately reset to base build by a third party · original partition layout removed · data of business value held on the previous installation · encryption status and continued use of the machine to be established |
| Fault class | Deliberate reimage on TRIM-enabled storage — freed blocks cleared by background housekeeping; recoverability sharply time-dependent and often limited |
| Equipment used | Machine use halted · drive imaged write-blocked (Atola TaskForce 2) · residual structures and unallocated space examined for surviving remnants · encryption status established; alternative data locations identified before any expectation was set |
The decode: why the same event differs on an SSD, and what to do about it
What a base-build reset does: it writes a new partition layout and installs a standard operating system image. It does not, in itself, erase the rest of the drive — the previous content is marked as free space rather than scrubbed. That is why the same event on a mechanical hard disk is often recoverable: the old partitions can be located from residual structures and the data read from regions the new installation never touched.
Why solid-state storage is different: the crucial mechanism. Flash memory must erase a block before it can rewrite it, which is slow — so operating systems tell the drive which blocks are no longer in use, and the drive clears them in the background so they are ready for future writes. That housekeeping runs continuously and completes within minutes of blocks being freed. A reset marks the entire previous installation as free, and the drive then dutifully clears it. Within a short time of the reimage, the old data is not merely unlisted — it has been physically cleared, and no technique recovers it. That is why the honest position on this case is much less encouraging than the same enquiry about a hard disk, and it should be said before anybody spends money.
What still might survive: not nothing, which is why an assessment is worth having. Regions the housekeeping had not reached before the machine was powered down; areas the new installation occupies that happen to sit over older structures in ways that leave remnants; and residual metadata that can reveal what was there even when the content is gone — sometimes useful in itself for a business establishing what has been lost. The determining variable is time: how long the machine ran after the reset. A drive powered down immediately retains far more than one used for a fortnight.
The two things to do first, both free: stop using the machine, right now — not shut it down and restart it, simply leave it off, because ordinary use runs more housekeeping and writes over what remains. And look elsewhere before spending anything. On a business machine, recorded data very often also exists in a user profile stored on a server, in a backup regime, in an email archive, or in a cloud account the organisation runs. Reimaging is usually done because a machine is considered replaceable, which frequently means somebody expected the data to be elsewhere. Establishing whether it is costs nothing and may end the matter.
On the bench
The instruction to stop using the machine went out immediately, since on this fault every hour of ordinary use costs more than any technique recovers. The drive was imaged write-blocked on the Atola TaskForce 2, freezing whatever remained as of that moment. The image was examined for residual partition structures, surviving remnants in unallocated space, and metadata revealing the previous installation's contents — with the encryption position established alongside, since a business machine may be protected and a lawful key would be required regardless. The honest expectation was set out in writing before any work was committed to, and alternative locations for the data were identified in parallel.
The outcome
The drive frozen as an image, the residual structures examined and the realistic position stated in writing before commitment. Free assessment, one fixed written figure including VAT; where a drive has to be opened or a chip removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose machine has been reimaged: a base-build reset replaces structures rather than erasing content, which on a mechanical hard disk is a hopeful case — but on solid-state storage the freed blocks are cleared by background housekeeping within minutes, so the old data is physically gone rather than merely unlisted, and the honest odds are much poorer; the determining variable is how long the machine ran afterwards, so stop using it immediately; and check the server profiles, backups and accounts first, because a machine is usually reimaged on the assumption the data lives somewhere else.
Machine reimaged with data still on it
Stop using it now — not shut down and restarted, just left off. If the storage is solid-state, this is genuinely time-critical in a way most data loss isn't: freed blocks are cleared by the drive's own background housekeeping within minutes, so every hour the machine runs removes more of what might remain. Understand the difference this makes. On a mechanical hard disk a reimage is often recoverable, because the old content stays physically present until overwritten. On an SSD it is usually cleared outright, and the honest answer is that the odds are poor. Before spending anything, look elsewhere: on a work machine, the data very often also exists in a server-stored profile, a backup regime, an email archive or a company cloud account — reimaging is usually done because someone assumed exactly that. And check whether the drive is encrypted, because that determines whether any of it is workable.
Switch it off and leave it off — call Glasgow Data Recovery on 0141 404 0294; imaged write-blocked immediately, residual structures examined, and the realistic position stated in writing first.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.