Case Study 1 — Ten Years on a Reformatted Drive

A grieving daughter reformats the wrong external drive and loses a decade of family photographs. This is the chapter's first phone call made concrete: a pure recovery job, judged not by elegance but by whether a person gets back what mattered most. Watch how the right reflexes — image first, read what the file system still remembers, triage by human value — turn panic into a near-complete rescue, and where the honest limits land.

Background

The drive arrives on a Tuesday afternoon in a padded envelope: a 2 TB USB 3.0 external disk, a single spinning platter inside a plastic enclosure, NTFS-formatted. The client — call her the owner, because this book uses no invented names — explains over the phone what happened, her voice thin with the particular panic of an irreversible mistake. She had two external drives on her desk: one full, one blank and bound for a donation pile. She meant to format the blank one. She formatted the full one. Windows asked if she was sure; she clicked Yes without reading, the way everyone clicks Yes. The progress bar finished in seconds — a sign she will not understand until you explain it, but a hopeful one to you.

On the drive: roughly ten years of family photographs. Her wedding. Two children, photographed from newborn to grade school. Her father, who died the previous spring, in what she believes are the last pictures anyone took of him. There is no backup. There is no cloud copy. There is only this drive, and the question she asks before you can finish saying hello: Can you get them back?

This is recovery in its purest form. There is no lawsuit, no employer, no chain of custody to keep, no opposing expert waiting to attack your method. There is a person, a deadline she sets only by her own grief, and an irreplaceable original you must not make worse.

Recovery vs. Forensics. Note what is absent here and present in the engineer case next door: no court, no warrant, no admissibility standard. That absence is exactly what frees you to be pragmatic — to chase the wedding album first and not fret over the page file. But one rule from forensics still binds you, for a different reason: the original is irreplaceable. You will image before you recover. Recovery and forensics arrive at "protect the original" from opposite motives — admissibility there, irreplaceability here — and obey it just the same.

The recovery

Your first act is not to recover a single file. It is to protect the original. The owner already made one irreversible mistake; your job is to guarantee she cannot make a second through you, and that a flaky USB bridge or a tired platter cannot finish off what the format started. You attach the drive through a write-protecting bridge, confirm the system mounts nothing, and image the entire device sector by sector to a healthy lab disk. Then you hash both, and they match:

$ sudo dd if=/dev/sdb of=wedding_drive.dd bs=4M conv=noerror,sync status=progress
$ sha256sum /dev/sdb wedding_drive.dd
7d3a9b1e6c4f2058a1b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7  /dev/sdb
7d3a9b1e6c4f2058a1b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7  wedding_drive.dd
#                                                                  ^ identical: faithful copy

The original goes back in its envelope, untouched from this moment on. Everything that follows happens on the copy.

Now the hopeful sign from the phone call pays off. The format finished in seconds, which means it was a quick format — NTFS wrote a fresh, nearly empty Master File Table and marked the volume's clusters as free, but it did not overwrite the old data, and crucially it did not zero the old metadata that NTFS keeps scattered through the volume. A full format that wrote zeros across 2 TB would have taken hours and told a far grimmer story. You point a Sleuth Kit listing at the imaged volume and the old file system answers:

$ fls -r -o 2048 wedding_drive.dd | grep -i ".jpg"
r/r * 5142-128-4:  Users/owner/Pictures/2014_Wedding/IMG_0428.jpg
r/r * 5143-128-4:  Users/owner/Pictures/2014_Wedding/IMG_0429.jpg
r/r * 5144-128-4:  Users/owner/Pictures/2019_Dad/IMG_3310.jpg
   ... 8,941 more deleted image entries ...

The * on every line is the whole rescue in one character: these files are deleted, but NTFS still knows their names, their folders, their sizes, and which clusters held their bytes. The pointers were flagged free, not erased. You extract them by metadata with icat, cluster run by cluster run, and the great majority open cleanly on the first try — wedding, children, father, all there.

Not all of them. A few hundred clusters in the old MFT's region were reused when the new MFT was written, so a band of files has lost its metadata. For those, you switch techniques: file carving, scanning the unallocated space for the FF D8 FF JPEG header and reading to the FF D9 footer, reconstructing files directly from raw bytes with no help from the file system. Carving recovers most of the rest, though carved files come back without their original names and a handful are truncated where later writes clipped their tails.

The final tally: about 9,200 of roughly 9,600 photographs recovered intact, several hundred more carved but unnamed, and a few dozen genuinely gone — overwritten in the narrow region the new file system happened to touch. You triage the delivery by what matters most, exactly as the discipline demands: the wedding album and the last pictures of her father are confirmed first, opened and eyeballed one by one, before you even start sorting the vacation snapshots.

The analysis

  1. Image before you recover — the original is sacred even in pure recovery. There was no court here and no chain of custody to keep, yet imaging first was still non-negotiable: the drive is irreplaceable and possibly failing, and a second mistake on the only copy would be unforgivable. Recovery obeys "protect the original" for the same blunt reason a surgeon double-checks the site — there is no undo.

  2. Deleted is not destroyed, and a quick format barely scratches the data. The format that terrified the owner removed bookkeeping, not bytes. The tell was the clock: a quick format finishes in seconds because it only rewrites metadata, while a full, overwriting format would take hours. Reading the clock told you the prognosis before you opened a single file.

  3. Read what the file system still remembers before you reach for heavier tools. Because NTFS still held names, sizes, and cluster runs for the deleted files, metadata-based extraction recovered the overwhelming majority quickly and with original filenames intact. Carving is powerful but lossy — no names, possible truncation — so you use it only where the metadata is gone, not as a first resort.

  4. Triage by human value — "good enough" is a complete success. You did not need to perfectly reconstruct the thumbnails cache, the browser files, or the temp directory. You needed the wedding and the father. Sorting the delivery by what the person cares about most — and confirming those first — is the part beginners skip and professionals lead with.

  5. Name the limits honestly. A few dozen photographs were overwritten and are gone; no tool resurrects overwritten bytes. Telling the owner plainly — "I recovered essentially everything that mattered; a small number are unrecoverable because the format reused their space" — is more professional, and kinder, than a vague promise or a buried failure. Knowing and stating the limit is part of the craft, not an admission of defeat.

Discussion questions

  1. The recovery succeeded largely because the format was a quick format. Describe what your prognosis and your approach would have been if the owner had instead performed a full format that wrote zeros across the entire 2 TB, and explain how you would set her expectations on the first call.

  2. No chain of custody was kept here, and the chapter says that was appropriate. Construct a plausible turn of events that would convert this exact job into a forensic matter midway through — and explain what you would have wished you had done from the first minute.

  3. Carving recovered files but stripped their names and truncated some. For a photo library, why is metadata-based recovery so strongly preferable to carving, and what specific information does the file system's metadata give you that raw bytes alone never can?

  4. The owner had no backup. Without lecturing her in her worst moment, how and when would you raise prevention — the 3-2-1 backup rule — so that she never needs you again? Is backup advice part of a recovery professional's job?

  5. ⭐ You recovered the last photographs of the owner's late father, plus, incidentally, a folder of clearly private documents you were not asked to retrieve and did not open. The chapter's sixth principle is the human cost is real, and its Ethics Note warns you will see things you weren't looking for. What are your obligations regarding the private documents you can see exist but were not engaged to recover, and how do you handle the emotional weight of returning a dead man's last images to his daughter? What, if anything, do you say to her — and what do you keep to yourself?