Case Study 1 — The Drive That Said It Was Empty

A reformatted external drive holds ten years of family photographs the operating system swears are gone. This is the wedding-photos case worked end to end at the byte level — a clean demonstration that on magnetic media, a "format" burns the map, not the territory, and that the gap between marked free and actually overwritten is wide enough to live inside.

Background

A client arrives at a small recovery shop with a 2 TB USB external hard drive in a sandwich bag and an apology already half-formed. Two nights earlier, intending to wipe an old drive she planned to hand down to a nephew, she had — half asleep, the two enclosures identical — reformatted the wrong one. The drive she erased held the family archive: a decade of photographs, including her wedding, her late mother, her children as infants. She had done the natural things first. The Recycle Bin was empty. The folders were gone. Windows reported the volume as nearly empty and offered, helpfully, to let her start using all that lovely free space.

The drive is a single NTFS volume. Critically, what she performed was Windows' default quick format, not a full format with a surface scan. She had also, to her enormous credit, stopped touching the drive the moment she realized the mistake — she did not copy new files onto it, did not install "recovery" software onto the same volume, did not let the system write so much as a thumbnail cache back to it. That restraint, more than anything the shop did, is why this story ends well.

Recovery vs. Forensics. This is a pure 💾 recovery engagement — the deliverable is the client's photographs back in her hands, not evidence for a court. But the shop still works to forensic discipline out of habit and self-protection: image first, work on the copy, keep notes. The original is irreplaceable, and a recovery shop that destroys a client's only copy by working on it directly does not stay in business.

The recovery

The technician's first act is the one the whole book insists on: do not work on the original. The drive is attached through a USB write blocker and imaged bit-for-bit with dcfldd to a clean destination drive, producing family_archive.dd. The tool reports the geometry that governs every later calculation — 512e sectors (512-byte logical, 4 KB physical), 3,907,029,168 logical sectors — and computes a SHA-256 of the image so any later claim that "nothing changed" can be proven. The physical drive goes back in its bag. Everything that follows happens on a verified copy.

  Imaging summary (illustrative)
  source     : USB ext HDD, 2 TB, NTFS, single volume
  sector size: 512 logical / 4096 physical  (512e)
  sectors    : 3,907,029,168
  image      : family_archive.dd  (1,953,514,584 KiB)
  sha256     : 7b3f...e1a9   (recorded; re-verified after copy: match)

The quick format had written a fresh, nearly empty NTFS structure at the front of the volume — a new boot sector, a new and almost-empty Master File Table. But it had not walked the platters overwriting the old data clusters. So the technician works the problem from two directions, exactly the two the chapter previews.

First, residual MFT records. Even a "new" MFT on a quick-formatted NTFS volume frequently sits physically near, or overlapping, the old one, and large stretches of the previous MFT survive in what the new file system regards as free space. Running a logical-recovery pass over the image turns up thousands of old MFT records whose "in use" flag — bit 0 of the flags field at offset 0x16 in each record header — still reflects deleted-but-present files, complete with their original names, sizes, timestamps, and, in many cases, intact pointers to their data clusters. For every such record whose cluster runs had not yet been reused, the file is reassembled precisely: not carved and guessed at, but rebuilt from the file system's own surviving bookkeeping, original filename and folder path included. Roughly 70% of the archive comes back this way, named and dated.

Second, file carving where the MFT was gone. Where the new file system's metadata had landed on top of the old MFT, those records were destroyed, and with them the filenames and the cluster maps. But the photographs themselves, out in the data area, were untouched. So the technician carves: scan the raw image for JPEG headers, read forward to each footer, write the bytes out. Navigating to one region of unallocated space — byte offset 0xC0000000, which the core arithmetic (offset ÷ sector size) places at logical sector 6,291,456 — the dump is unambiguous:

   c0000000: ffd8 ffe0 0010 4a46 4946 0001 0100 0001  ......JFIF......
             ^^^^^^^^      ^^^^^^^^^^
             FF D8 FF E0   "JFIF" at +6  -> a JPEG, sitting exactly where
             (JPEG SOI)                     it was written years ago

That is not metadata about a photo; it is the photo, its first bytes physically present, untouched by the reformat. The carver reads from the FF D8 FF header forward to the FF D9 end-of-image marker and writes out a recovered .jpg. Repeated across the image, carving recovers most of the remaining photographs — without names or original folders, but openable and intact. The few genuine losses are files whose data clusters had been partially reused by the format's own metadata writes, leaving them truncated.

Finally, selective recovery of what matters. The technician does not dump 40,000 anonymous carved JPEGs on the client and call it done. She and the client sit together; the named, MFT-recovered wedding and family folders come first, then the carved images are browsed in batches so the client can flag the irreplaceable ones. The wedding photographs, the pictures of her mother, the infant photos — all recovered. The lesson the shop carries is as much about service as about sectors.

The analysis

  1. A quick format burns the index, not the data. Reformatting wrote a new, near-empty file system over the front of the volume but left the data clusters across the platters physically intact. "The drive is empty" was true only of the new bookkeeping, not of the medium.

  2. Magnetic persistence buys time. Because an HDD bit is a magnetic orientation that nothing changes until a write head deliberately flips it, the photographs survived for days exactly as written. Had this been a TRIM-enabled SSD, the same two-day-old deletion could have been physically erased before the drive reached the bench.

  3. The client's restraint mattered more than the tools. Every write to the volume after the format risked reusing a "free" cluster and overwriting a photo. By not copying files, not installing software onto the drive, and bringing it in quickly, she kept the marked free → actually overwritten window open.

  4. Two recovery paths, one principle. Logical recovery (residual MFT records) reproduced files precisely with their original names; carving (the file's own FF D8 FF…FF D9 structure) recovered data where the file system was destroyed. Both worked only because deletion removed the pointer, not the data.

  5. Image first; the original is sacred. Working on a verified copy behind a write blocker meant the irreplaceable original was never at risk, and the recorded hash means the shop can prove its process if the client ever asks what was done.

Discussion questions

  1. The client performed a quick format. Walk through exactly what would have been different — and why far less might have been recoverable — had she instead run a full format with a surface scan, or had she continued using the drive for a week after the mistake.

  2. About 70% of files came back via residual MFT records (with names and dates) and the rest via carving (data only, no names). Why does logical recovery preserve filenames and folder structure while carving cannot? What does each method actually trust?

  3. The technician imaged the drive and recorded a hash even though this was a non-court recovery job. Argue both for and against spending that time on a routine consumer recovery. When is the discipline worth it?

  4. ⭐ Suppose that midway through carving, the technician had encountered images that were clearly not family photos but evidence of a serious crime. This is a pure recovery engagement with no warrant and no law-enforcement involvement. What are the technician's obligations, what are the limits of those obligations, and which later chapters of this book govern the answer? (Consider that "I found it while doing authorized work" is not the same as "I went looking.")

  5. The drive was a 512e device — 512-byte logical sectors over 4 KB physical sectors. Identify every point in this recovery where assuming the wrong sector size (512 vs. 4096) would have produced wrong offsets, and explain how the technician avoided that error.