Data Recovery Case File · Formatted & Logical Faults · The Upgrade Went Well

An Upgrade That Reports Success Can Still Have Lost a Volume

His enquiry describes an outcome nobody was warned about. A solid-state drive upgraded to a newer system version, where "after the upgrade one of the partitions disappeared and we need to retrieve the data on it" — a consumer tool has since found some of it. The upgrade completed and the machine works, which is why nothing flagged this: the volume that vanished was not the one the upgrade cared about.

The decode: what an upgrade does to the drive's own map

What an in-place upgrade actually is: a substantial rewrite of the system volume, and an adjustment of the structures describing how the drive is divided. It creates and resizes its own areas — recovery partitions, reserved space, boot structures — which means it writes to the small record at the drive's start that describes every volume.

Why a second volume can be lost in that: if the upgrade misreads or rewrites that record, an entry describing his data volume can be dropped. The entry is a few bytes; the volume it described is unaffected, and the system then genuinely does not know the volume exists.

Why nothing reported a problem: the upgrade's job was to produce a working system, and it did. Nothing verifies that volumes it was not responsible for still appear afterwards — success is measured against the machine starting, not against the drive being unchanged.

Why the content is very likely complete: losing a partition entry does not touch the data. His files sit exactly where they were written, in a region nothing has been allocated to since, because the system does not regard that space as available — it simply cannot see it.

Why the boundaries can be recovered without the original record: a filesystem has a recognisable beginning and records its own size. Finding where it starts and how far it extends reconstructs the partition from the inside, without needing the entry that was lost.

Why the consumer tool found only some of it: tools of that kind generally search for file signatures rather than rebuilding the volume. That returns individual files without folders, names or structure, and misses anything fragmented — which is a partial result by method rather than a measure of what survives.

Why a proper reconstruction should return considerably more: rebuilding the filesystem returns the directory as well as the content. Names, folders, dates and the arrangement come back together, and files that a signature search could not reassemble are recovered through their own records.

Why the machine must come out of use, and this is the urgent part: it is running its system from this drive. Every hour of operation writes updates, temporary files and caches — and if the system ever does decide that region is available, it will start using it.

Why that risk is real rather than theoretical: an unrecognised region is space the system regards as unallocated. Any prompt to create a new volume, extend an existing one, or make the space usable would write directly over the content — and such prompts appear readily in volume management tools.

What must not happen: no creating or extending partitions, no further tool runs against the drive, and no continued use of the machine.

On the bench

The upgrade was identified as a partition-table event rather than a content event — an in-place upgrade rewriting the system volume and adjusting the record describing how the drive is divided, so an entry for an unrelated volume can be dropped while the volume itself is untouched, and nothing verifies volumes the upgrade was not responsible for. Partition boundaries were derived from filesystem structures within the image, a filesystem carrying a recognisable beginning and recording its own extent.

The outcome

The upgrade identified as a partition-table event, the machine removed from use, and boundaries derived from the filesystem within the image. Free assessment, one fixed written figure including VAT. The decode: the upgrade succeeded at its own job, which is why nothing warned you. A volume entry is a few bytes and losing it does not touch what it described — so your files sit where they were, in space the system cannot see.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.