Home / Case Studies / Formatted & Logical Faults
Formatted & Logical Faults · case file

Recordings Lost to a Reinstall

Old recordings lost when a machine's operating system was reinstalled are usually still on the drive — reinstalling or restoring an OS lays down a fresh system and clears the index that lists the old files, but it does not scrub the drive, so the file data persists until new writing lands on top of it — carved back by content, an honest partial that is best where the machine has been left alone. That the machines have not been used since is exactly the thing that protects the recordings; the freed space has not been written over, so what was lost to the reinstall is largely still there to recover. His recordings from 2006 were lost when the system was reinstalled or restored on his laptop and desktop, but the good thing, as he puts it, is "i have not used them since that time". A reinstall removes the index, not the files — untouched since, they carve back well. The files are carved back by content.

Laptop / PCHard DriveDeleted / Formatted
// case at a glance
MediaOld recordings lost when a machine's operating system was reinstalled — the machine untouched since.
Reported situationRecordings from 2006 · lost when the OS was reinstalled or restored · on a laptop and a desktop · machines not used since · recovery sought.
Fault classA logical loss from an OS reinstall — the index cleared and a fresh system laid down, the old file data persisting until overwritten; carved back by content, an honest partial, strongly helped by the machines not being used since.
Equipment usedEach drive read directly behind a hardware write-blocker on PC-3000 UDMA to prevent any further writing · imaged read-only on DeepSpar · the filesystem parsed in R-Studio, the freed records recovered, and the recordings carved by content in PhotoRec where the old index is gone, validated onto fresh media.
// the decode

The decode

A reinstall clears the index, not the file data. That the recordings were lost when the OS was reinstalled does not mean they were erased, because reinstalling or restoring an operating system writes a fresh system and clears the catalogue that lists where the old files sit, but it does not scrub the whole drive — so the old file data stays where it was written, in the space not taken by the new system, until something new is saved over it. So the loss is of the listing, not the content: the drive no longer indexes the old recordings, which is why they appear gone, rather than the data being wiped. His recordings usually persist on the drive, reached by reading it. A reinstall clears the index, not the file data.

Not using the machines since is exactly right. That the machines have not been used since the reinstall is exactly what protects the recordings, because the space holding the old file data is only lost when new data is written onto it — so a machine left alone has not overwritten that space, and the old recordings remain to be carved back. So his instinct to leave them untouched preserved the recovery: the less that has been done since the reinstall, the more of the old data survives, and not using them at all is the best case. His recordings are reachable because the drives were left alone. Not using the machines since is exactly right.

The recordings are carved back by content. Because the old index is gone, the recordings are carved by content — each drive imaged read-only, the freed records recovered where they survive, and the recordings identified by their content where the index is gone, so the files are rebuilt from what remains on the drive. So the recovery reads each drive for the recordings themselves rather than relying on a catalogue the reinstall cleared, with the laptop and desktop each read in turn. His recordings are reached by carving the drives, which is how files lost to a reinstall are recovered. The free diagnostic establishes how much survives before any work is agreed.

The honest prognosis is a strong partial, the drives untouched. If the drives have not been written to since the reinstall — his case, the machines left alone — much of the old data carves back, often most or all of it, even years later, since age does not fade what is on the platters. If a machine had been used and the freed space written over, that part is lost, and recovery returns what remains. His having left them alone puts the odds high, confirmed at assessment before you decide.

// on the bench

On the bench

Each drive was read directly behind a hardware write-blocker on PC-3000 UDMA to prevent any further writing. It was imaged read-only on DeepSpar. The filesystem was parsed in R-Studio, the freed records recovered, and the recordings carved by content in PhotoRec where the old index is gone, validated onto fresh media.

// the outcome

The outcome

Each drive read read-only, and the old recordings carved back from what survived the reinstall. The diagnostic stage is free and reports back within two working days of the media arriving; after it you hold one written quote, fixed with VAT included — and if the files don't come back, you don't pay. The decode: a reinstall removes the index, not the files — untouched since, they carve back well. Carved from what remains, your recordings come back.

Files lost when an OS was reinstalled

A reinstall clears the index, not the file data — it writes a fresh system and clears the catalogue that lists the old files, but doesn't scrub the drive, so the old file data stays where it was written until something new is saved over it. Not using the machine since is exactly right: the space holding the old data is only lost when new data is written onto it, so a machine left alone hasn't overwritten it. The files are carved back by content from a read-only image. Keep the machines off and unused. Have each drive read read-only.

Sending this in from Swindon? Every case opens with the free diagnostic — completed within 2 working days of your media arriving — and one fixed written quote before any work: logical jobs run no fix, no fee; invasive drive-opening work takes 50% of the quote upfront; forensic-classed work is payable upfront in full. If the data is inside a laptop, PC, Mac or server, remove the hard drive or SSD and send us just the drive; we don’t provide an internal drive-removal service, and we don’t recover storage soldered to a motherboard (e.g. Apple Silicon Macs) — only drives that can be removed and sent to us. Post or courier tracked and insured to Oxford Data Recovery, John Eccles House, Oxford Science Park, Robert Robinson Avenue, Littlemore, Oxford, OX4 4GP — full sending instructions and the shipping form are here.
Start a free diagnostic

Our case files are written up from genuine enquiries our lab has handled for customers across Swindon and Wiltshire, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.

// related case files

More cases like this one

Browse all case studies →

Got a device with a story like this?

Free diagnostic, fixed quote, no fix no fee — start now or call the freephone.