Data Recovery Case File · Formatted & Logical Faults · That Absence Is Evidence

Recovery Found Everything Except the Thing You Want

Her enquiry contained a detail that reads as bad luck and is actually the answer. A folder that disappeared from a MacBook desktop: "last accessed in August, no idea when it disappeared or if I deleted it accidentally. Didn't do any backup before. Tried two well-known recovery applications to scan the hard drive — every other thing deleted is there, but not that desktop missing folder. Went to the Apple store, they said everything on my Mac is fine, and have no idea where the folder has gone." That combination is not a coincidence and it is not a failure of the software. Recovery scans that find everything else and not your folder are telling you the folder was probably never deleted — which changes the whole approach, because you cannot recover something that was not lost in the way you assume.

The decode: why the absence is informative, and where to look instead

What the scans actually proved: that deletion recovery works on her machine. Both applications successfully found other deleted material, which means the mechanism is functioning — deleted items on that volume leave traces and those traces are findable. So the absence of her folder from results that included everything else is not a limitation of the tools. It is a finding: her folder did not leave the traces a deletion leaves, because it was probably not deleted.

Why this reasoning holds particularly on a Mac with solid-state storage: there is an internal check. On solid-state drives, background housekeeping clears freed blocks within minutes, which is why deleted material is usually not recoverable. If her folder had been deleted months ago, it would be gone — but so would everything else, and the scans found plenty. The results are internally consistent only if the other items were deleted recently and hers was not deleted at all.

Where a folder goes when it is not deleted: four possibilities, all more likely than deletion. It was moved — dragged into another folder by accident, which on a desktop full of items is remarkably easy and produces exactly this. It was synchronised away: where cloud storage manages the Desktop and Documents folders, material can be uploaded and removed locally, or moved by the sync client, and it then lives in the account rather than on the machine. It is in a different user account on the same Mac. Or it was renamed, and she is searching for a name that no longer exists.

What to do instead of recovering: search, properly and in the right places. A whole-volume search by filename and, more usefully, by content — a distinctive phrase from a document inside the folder will find it wherever it now sits, including in places she would never think to look. The cloud account's web interface, including its recently-deleted area, which holds items for a period after removal. Other user accounts. And any snapshot or backup the system made without being asked, which on a Mac is more common than people realise.

Why the manufacturer's answer fits: they said the machine is fine, and they are right — this is not a fault. That is why they could not help, and it is not a contradiction.

On the bench

The premise was tested before anything was recovered, since the scan results themselves suggested this was not a deletion. A whole-volume search was run by filename, by content and by date range, including hidden and system locations and every user account on the machine — because a folder that was moved is present rather than absent, and searching finds what recovering cannot. The cloud account's interface and its deleted-items area were examined separately, along with any system snapshots. Imaging and deleted-file recovery were reserved for the case where the search established that a deletion had in fact occurred.

The outcome

The premise tested first, the volume and account searched properly, and recovery work reserved for where deletion was actually indicated. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose recovery scan found everything except the thing they wanted: that absence is evidence rather than bad luck — both applications finding other deleted material proves deletion recovery works on your machine, so a folder that left none of those traces was probably never deleted; on solid-state storage there is a further check, since months-old deletions are cleared by background housekeeping and would not be recoverable at all; so search rather than recover — by content as well as name, across every user account, in your cloud account's deleted-items area, and in any snapshots.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.