Data Recovery Case File · Formatted & Logical Faults · The Warning Nobody Reads

Windows Recovery Drive Wiped the Whole Disk

His enquiry described a trap that catches careful people rather than careless ones. "Whilst creating a Windows recovery image in a partition of a portable hard drive, the recovery drive creation tool reformatted the entire portable drive — including a separate partition containing a photo library, documents and software. I would like to get the documents, photos, videos and software restored as they were prior to the reformat." He did something sensible — making a recovery drive — and chose a disk that had room to spare, reasonably assuming the tool would use the free space. It does not. The recovery drive tool formats the entire device, and it says so in a sentence that is very easy to read past. The good news is substantial: what that tool did is among the more survivable things that can happen to a disk.

The decode: what the tool did, what survives, and the one thing that cannot be restored

Why it took the whole disk: the recovery drive tool is designed to produce a bootable device, and a bootable device needs to control the disk's partition layout — so it replaces the partition table and formats the whole thing rather than adding a partition alongside what is there. The warning is displayed, and it is genuinely easy to miss because the expectation everybody brings is that a tool needing a few gigabytes will use free space. It does not, and choosing a disk with room on it is precisely the decision that leads here.

What actually happened to the data: two things, and the distinction is the whole recovery. The partition table was replaced, so the disk no longer describes his original partitions. And a quick format was performed, which writes fresh empty filing structures and marks the space as available — it does not erase content. Then the recovery files were copied on, which is a genuine write of a few gigabytes. So the position is: his original data is physically still there, minus whatever the recovery files landed on, sitting under a partition table and filing structures that no longer describe it.

Why the odds are good: the recovery files are small relative to a portable disk, so the overwritten footprint is bounded and its location can be mapped. Original partition structures also leave recoverable traces — filesystems keep backup copies of their own key structures in known places precisely for this kind of event — so the previous partitions can often be located and rebuilt rather than carved blindly, which returns folder trees and filenames rather than a flat heap of files.

The instruction that protects it: the disk must not be used as a recovery drive, or for anything else. Every further write extends the footprint. If the recovery drive has already been created and is sitting there, leave it alone rather than adding to it.

The one thing that cannot be restored: gently, because he asked for it explicitly. He wants the software back "as it was prior to the reformat", and installed applications cannot be restored that way — they are not files that can be replaced into position, because installing scatters licence records and system registrations outside the visible program. What comes back is his documents, photographs and videos, in their folders. The software is reinstalled from source and signed into, which for modern applications means the entitlement is in an account rather than in anything that was on the disk.

On the bench

The disk was imaged write-blocked on the Atola TaskForce 2 before anything else, freezing it as of the moment he stopped using it. On the image the original partition structures were located — using the backup copies filesystems maintain rather than accepting the new table — and reconstructed, which returned his previous partitions with their folder trees and filenames rather than an undifferentiated carve. The overwrite footprint left by the recovery files was mapped and resolved to the specific files it affected. Documents, photographs and video were verified by opening and rendering, and delivered on fresh media, with the software addressed as a reinstallation exercise rather than a restoration.

The outcome

The original partitions located and rebuilt from a write-blocked image, the overwrite mapped, and the contents verified and delivered. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone who has lost a disk to a system tool: the recovery drive creator formats the entire device rather than using free space, because a bootable device needs to own the partition layout — and choosing a disk with room on it is exactly what leads there; what it performed was a quick format, which replaces structures rather than erasing content, so your data is physically present under a table that no longer describes it; the recovery files themselves are a small bounded overwrite that can be mapped; and installed software cannot be restored as it was — that part is reinstalled and signed into.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.