Home / Case Studies / Formatted & Logical Faults
Formatted & Logical Faults · case file

The Folders Are There but Empty

Every folder is where it should be, named as it always was, and every one of them opens onto nothing. The photographs that were in them are not in the recycle bin and were not deleted by anybody. This is a filesystem fault and it is one of the more recoverable things that happens to a drive, which is worth knowing before panic sets in. A file system keeps two kinds of record: the directory tree, which is the list of folders, and the entries that connect each folder to the actual data on the disk. Damage the second while the first survives and you get exactly this — a perfect skeleton with nothing hanging off it. The pictures have not moved. What has broken is the index that says where they are, and an index can be rebuilt.

External DriveCorruption / Filesystem
// case at a glance
MediaExternal hard drive whose folder structure is intact but whose folders contain no files. Photographs of sentimental value sought.
Reported situationExternal drive · folders all present · every folder opens empty · photographs missing from inside them · nothing knowingly deleted · recovery sought.
Fault classFilesystem fault. The directory records survived while the links from folders to file data were lost or damaged, so folders list correctly and open empty although the file data remains on the platters. Recovered by imaging read-only and rebuilding the links, or carving by content where the records are gone. Writing anything to the drive is the risk.
Equipment usedRead through a hardware write-blocker, so nothing at all could be written to it · imaged read-only on DeepSpar · the filesystem then parsed in R-Studio off the image, folder-to-file links rebuilt wherever their records survived, photographs carved by content signature in PhotoRec where they did not · everything opened and rendered before being written to fresh media.
// the decode

The decode

A file on a disk is two things: the data itself, sitting in a run of sectors, and a record saying which folder it belongs to and which sectors it occupies. Lose the data and the file is gone. Lose the record and the file is invisible but completely present. Empty folders are the second case, and that is why this is a good category of fault to be in.

The usual causes are dull. A drive disconnected while writing. A power cut part-way through an operation. An enclosure with a failing bridge chip returning a corrupted block at the wrong moment. Occasionally a file system that has simply accumulated damage over years of being unplugged without ejecting, which is something almost everybody does and almost nobody thinks about.

The thing that turns this into a partial recovery is what happens next, and it is nearly always well-intentioned. Windows offers to scan and fix the drive. Disk Utility offers First Aid. A recovery tool offers to repair the file system in place. All three write to the disk, and what they write goes over the very records a rebuild would have used. A drive that arrives untouched frequently comes back with folder names, dates and structure intact. A drive that has been repaired three times comes back as a heap of numbered files with no organisation at all.

This is logical work with no parts consumed, which is why it runs on no fix, no fee. The assessment costs nothing, finishes inside 2 working days of arrival, and produces one written figure. If nothing comes back, there is no bill.

// on the bench

On the bench

Nothing was written to it at any point. It was read through a hardware write-blocker and imaged read-only on DeepSpar first, and every subsequent operation happened against that image. The filesystem was parsed in R-Studio, which found the surviving directory records and rebuilt the links between folders and file data wherever those links could be reconstructed. Where records had been destroyed outright, the photographs were carved by content signature in PhotoRec — recovered by their own file headers rather than by any index — and cross-referenced back into the folder structure where dates and sizes allowed. Everything was rendered before it was written to fresh media.

// the outcome

The outcome

The drive imaged read-only, the folder-to-file links rebuilt where they had survived, and the remainder carved by content. The photographs came back onto fresh media, a good proportion of them with their original names and folders intact because the drive had not been repaired by anything before it arrived. The assessment cost nothing and ended with one fixed written figure, VAT included. Logical work, so it ran under no fix, no fee: had the pictures not been recoverable, there would have been no invoice. The honest note in the report was that carved files lose their original names, and that this is a limitation of the method rather than something anybody can charge to fix.

Folders that are all there and all empty

Unplug the drive and leave it unplugged. This is among the most recoverable faults on this bench, and it stays that way only if nothing writes to the disk. Decline every offer to scan, fix, repair or check the drive, because each of those rewrites the structures a recovery reads. Do not copy anything onto it, do not install recovery software onto it, and do not let a photo application index it. If you want to try software yourself, run it from another machine, read the drive strictly read-only, and never write the results back to the same disk. Otherwise box it and send it. Folders that survive are a good sign, and keeping them intact is worth more than any tool you could point at it.

Got one of these on your desk right now? Everything here follows the same route: an assessment you are not charged for, completed inside 2 working days of the box reaching the bench, after which you get one written figure that never climbs afterwards. Logical faults are handled on no fix, no fee. Should the casing need opening, or the electronics rebuilding after a drop, a surge, a soaking or a fire, half of that figure falls due first and the rest only once your data is in hand. Ransomware, camera and DVR recorders, BitLocker volumes and anything else classed as forensic get settled in advance, in full. Where the files live inside a machine — laptop, desktop, Mac, server — pull the drive or the SSD and post that by itself. Computers are not dismantled here, and flash fixed permanently onto a logic board (the newer Apple laptops among them) is the one category refused outright. Unscrews or unplugs and we will take it. Send it tracked and insured to Edinburgh Data Recovery, 4 Redheughs Rigg, Westpoint, South Gyle, Edinburgh EH12 9DQ, arrange and pay for a courier of your own, or bring it to the counter there. No device is ever fetched from a customer. Packing notes and the shipping form sit here.
Start a free diagnostic

Each file below comes from a genuine enquiry taken from households and firms across Aberdeen, Aberdeenshire and the wider north-east, anonymised so nobody can be identified. Each one sets out how the fault was reasoned through, what was done about it, and which equipment did the work.

// related case files

Nearby files worth a look

Browse all case studies →

Recognise your own drive in this one?

Assessment is free and takes 2 working days at most once it lands, the figure is fixed in writing, and logical work carries no fix no fee. Begin online, or lift the phone.