Home / Case Studies / Formatted & Logical Faults
Formatted & Logical Faults · case file

The Scan and Fix Broke My Folders

Windows offered to scan and fix the stick, the offer was accepted, and afterwards the sub-folders stopped working as folders. They show as unknown file types now, with the project files still apparently inside them. This is the commonest self-inflicted fault in the trade, and it is worth being fair about: the prompt looks helpful, it is designed to look helpful, and almost everybody says yes. What scan and fix actually does is rewrite filesystem structures to make them internally consistent. When those structures are already damaged, consistency is achieved by discarding what does not fit — and folder records are exactly what gets discarded. The files themselves are untouched. What has broken is the description of where they belong, and that is rebuilt from an image rather than repaired in place.

USB FlashCorruption / Filesystem
// case at a glance
MediaUSB flash drive on which a Windows scan and fix was run. Sub-folders no longer behave as folders and show as unknown file types; project files still present inside.
Reported situationUSB stick · scan and fix run on it · sub-folders no longer act as folders · shown as unknown file type · files still inside them · project files needed · recovery sought.
Fault classFilesystem damage caused by the scan-and-fix itself. The structure was rewritten and the folder records detached, so folders read as unknown file types although the file data remains. Recovered by imaging read-only and rebuilding the folder structure. Running another scan is the risk.
Equipment usedRead behind a hardware write-blocker so nothing further could be written · imaged read-only · the filesystem parsed from the image, detached folder records rebuilt in R-Studio and folder contents relinked, files carved out by content signature in PhotoRec where records had been destroyed · everything opened and checked before it was written to fresh media.
// the decode

The decode

A FAT or exFAT volume, which is what most sticks use, keeps directories as ordinary files with a flag saying this is a folder, plus an allocation table describing which clusters belong to what. Scan and fix walks that structure looking for inconsistencies — entries pointing at clusters that are also claimed elsewhere, chains that run off the end, directories whose flags do not match their contents — and resolves them by editing.

Editing is the problem. Where a folder's entry is damaged, the tidiest resolution available to the tool is to clear the folder flag, which converts the directory into an ordinary file of unknown type. Its contents are still on the disk and the entries inside it are still there; the operating system just no longer treats it as a container. That is precisely the symptom described.

The reason it is worth being calm about is that no data was destroyed. Cluster chains were relinked and flags were changed, which is damage to the map rather than to the territory. Rebuilding the map from an image is ordinary work, and a good proportion of the original folder names, dates and structure normally survive.

What genuinely destroys this kind of job is running scan and fix again, or accepting a second offer to repair, or copying new files onto the stick. Each of those writes more, and each write reduces what can be reconstructed. Logical work with no parts consumed, so it runs under no fix, no fee, after a free assessment that finishes within 2 working days of arrival.

// on the bench

On the bench

It was read behind a hardware write-blocker so that nothing further could be written to it under any circumstances, and imaged read-only before anything else. All work then happened against the image. The filesystem was parsed in R-Studio, the detached directory records identified, and the folder flags and cluster chains rebuilt so the containers behaved as folders again, with their contents relinked. Where records had been destroyed outright by the scan, the project files were carved by content signature in PhotoRec and matched back into the structure by type and date where that was possible. Everything was opened and checked before it went to fresh media.

// the outcome

The outcome

The stick imaged read-only, the folder structure rebuilt, and the project files recovered onto fresh media with a good share of the original names and hierarchy intact. Assessment free, and one fixed written figure with VAT in it beforehand, and this being logical work it ran under no fix, no fee. The note that went back was aimed at the next time rather than this one: when Windows offers to scan and fix a drive that matters, the correct answer is no, and the correct next step is to copy everything off it while it is still readable.

Folders that stopped working after a scan and fix

Take the stick out and stop using it. Do not run scan and fix again, do not run chkdsk, and do not accept any further offer from Windows to repair it — each pass rewrites more of the structure a recovery reads, and the damage accumulates. Do not copy anything onto it and do not let anything defragment it. If you want to attempt it yourself, work strictly from a read-only image and never write results back to the same device. And for future reference, when Windows asks whether to scan and fix a drive holding something you care about, say no and copy the contents off first. The prompt is not malicious, but it is designed for tidiness rather than for recovery.

Got one of these on your desk right now? Everything here follows the same route: an assessment you are not charged for, completed inside 2 working days of the box reaching the bench, after which you get one written figure that never climbs afterwards. Logical faults are handled on no fix, no fee. Should the casing need opening, or the electronics rebuilding after a drop, a surge, a soaking or a fire, half of that figure falls due first and the rest only once your data is in hand. Ransomware, camera and DVR recorders, BitLocker volumes and anything else classed as forensic get settled in advance, in full. Where the files live inside a machine — laptop, desktop, Mac, server — pull the drive or the SSD and post that by itself. Computers are not dismantled here, and flash fixed permanently onto a logic board (the newer Apple laptops among them) is the one category refused outright. Unscrews or unplugs and we will take it. Send it tracked and insured to Edinburgh Data Recovery, 4 Redheughs Rigg, Westpoint, South Gyle, Edinburgh EH12 9DQ, arrange and pay for a courier of your own, or bring it to the counter there. No device is ever fetched from a customer. Packing notes and the shipping form sit here.
Start a free diagnostic

Each file below comes from a genuine enquiry taken from households and firms across Aberdeen, Aberdeenshire and the wider north-east, anonymised so nobody can be identified. Each one sets out how the fault was reasoned through, what was done about it, and which equipment did the work.

// related case files

Nearby files worth a look

Browse all case studies →

Recognise your own drive in this one?

Assessment is free and takes 2 working days at most once it lands, the figure is fixed in writing, and logical work carries no fix no fee. Begin online, or lift the phone.