Data Recovery Case File · Formatted & Logical Faults · Triage Across Three Sources
Three Places the Photographs Might Be
Her enquiry described a loss that happened in stages, and that turns out to be the hopeful part. Family holiday photographs, "removed from my computer and the recycling bin emptied. The photos were put onto an external hard drive which my son cleared and took apart. I still have the memory card, which he claimed to have wiped, so all may not be lost." Three devices, three different fates, and — crucially — three independent chances. This page is about triage: when material may exist in more than one place, the question is not whether it can be recovered but which source to try first, because they are not equally promising and the order affects both cost and outcome.
| Media | Three potential sources — a computer hard drive from which files were deleted and the recycle bin emptied; an external drive subsequently cleared and physically dismantled; a memory card reported as wiped |
| Reported situation | Photographs deleted from a computer with the bin emptied · copies placed on an external drive later cleared and taken apart · memory card retained and described as wiped · family holiday material of high personal value |
| Fault class | Multiple independent sources with differing prospects — deletion and quick-format traces persisting where no overwriting has occurred |
| Equipment used | Sources triaged and ordered before any work · each imaged write-blocked · deleted entries recovered and free space carved format-aware · photographs validated by rendering |
The decode: ranking the three, and why "wiped" is the good word
Source one — the memory card, and probably the best. "Claimed to have wiped" is more encouraging than it sounds. What people mean by wiping a card is almost always a quick format through a computer or camera, which writes a fresh empty index and marks the space available — it does not erase the photographs. Unless the card has been used heavily since, the images are very likely physically present and recoverable. Cards are also small, cheap to image and quick to work with. It is the first source to try.
Source two — the computer. Deleting files and emptying the recycle bin removes the entries and frees the space; on a mechanical hard drive the data stays physically present until something writes over it. So the prospects depend almost entirely on how much the computer has been used since. If it has been in daily service for months, much will have gone. If it has been little used, a great deal may remain. One important distinction: on solid-state storage the outlook is far poorer, because background housekeeping clears freed blocks within minutes.
Source three — the dismantled external drive, and the hardest. Two problems compound. It was cleared, which has the same arithmetic as the computer. And it was taken apart, which matters enormously depending on what "apart" means. If the case was opened and the drive removed intact, that is harmless — external drives are ordinary disks in plastic. If the drive itself was opened, exposing the platters to room air, that is serious and often terminal, because airborne particles score the surfaces. Establishing which happened is the first question, and it costs nothing.
Why the order matters commercially: she does not need all three. Recovering the photographs from the card may end the matter entirely at the lowest cost, and the assessment on each is free — so the sensible sequence is card first, computer second, dismantled drive last, stopping as soon as the photographs are back.
The instruction that applies now: stop using the computer. Whatever survives there is sitting in space the system considers free, and ordinary use overwrites it. Keep every piece — the card, the computer, and every part of the dismantled drive including its board.
On the bench
The sources were triaged and ordered before any work, because she does not need all three and the cheapest promising route should be exhausted first. The card was imaged write-blocked and its deleted entries recovered, with format-aware carving across freed space where the index had been replaced. Where the card did not yield everything, the computer's drive was imaged and its deleted entries and free space examined, with the caveat about solid-state housekeeping established first. The dismantled drive was assessed last, beginning with the question of what had actually been opened. Every photograph was validated by rendering.
The outcome
The sources ranked, the most promising imaged first, and the photographs validated and delivered. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront; for the drives, free assessment and one fixed written figure including VAT, with 50% of parts and labour upfront where a drive has to be opened. The decode, for anyone whose material may be in more than one place: rank the sources rather than starting with the one you happen to be holding — a card someone "wiped" is usually the best, because wiping almost always means a quick format that clears the index and leaves the photographs physically present; a computer's deleted files persist on a mechanical drive until overwritten, so the prospects depend on use since, and are poor on solid-state storage; and a dismantled drive depends entirely on whether the case or the drive itself was opened.
When the photographs might be in more than one place
Rank your sources before spending anything, and stop as soon as you have what you need. A memory card someone says they wiped is usually the most promising: wiping nearly always means a quick format, which writes an empty index and leaves the pictures physically on the card. A computer you deleted from comes next — on a mechanical hard drive those files stay present until something overwrites them, so it depends on how much the machine has been used since, though on solid-state storage the outlook is much poorer. A drive that was cleared and dismantled is the hardest, and the crucial question is what was actually opened: taking an external drive out of its plastic case is harmless, but opening the sealed drive itself exposes the platters and is often terminal. Meanwhile stop using the computer, and keep every part of everything.
Start with the card — call Glasgow Data Recovery on 0141 404 0294; sources triaged and ordered before any work, each imaged write-blocked, and every photograph checked by eye.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.