Data Recovery Case File · Desktop Externals & Aging Drives · A List Is Not a Copy
Seeing Files Listed in a Scan Is Not the Same as Having Them
His enquiry describes a window that closed while he was standing in it. A 4TB drive that showed on the system but would not mount, where recovery software "initially found it and the data — but as soon as I paid for the full version, the disk could not be found", following a second enclosure and a deep scan that stalled. The scan that listed his files was itself the load, and the drive it was reading did not survive it.
| Media | 4TB external hard drive — initially presenting without mounting, content listed by recovery software, subsequently not presenting; rotation achieved with shutdown after approximately one minute |
| Reported situation | External drive presenting on the host without mounting · recovery software run and content listed · full version purchased · drive no longer found afterwards · alternative enclosure tried in the interim · deep scan attempted and stalling · drive now reaching speed and shutting down after approximately a minute · substantial photographic content held |
| Fault class | Progressive degradation advanced by sustained scanning — initial readability lost; drive now failing to sustain operation |
| Equipment used | Scan listing treated as evidence of prior readability rather than secured content · no further scanning permitted · current draw measured across the operating period on a controlled bench supply · laminar flow bench inspection with head and platter assessment before any further attempt · imaging under capped timeouts in one supervised session |
The decode: what the listing meant, and what the scanning cost
What a scan listing his files established at the time: that the drive could be read then. The software located structures, interpreted them, and reported what they described — genuine evidence that the content was reachable at that moment.
Why a listing is not a recovery: the software read enough to describe the files and had not yet read the files themselves. Listing touches structures; recovering touches every region the content occupies, and those differ by orders of magnitude.
Why that distinction was the whole of this case: the position looked far better than it was. A complete file list on screen suggests the work is essentially done, when in fact none of it had been secured.
What the interval cost him: the drive was scanned, moved to another enclosure, and deep-scanned again before anything was copied. Each of those is sustained full-surface reading on a drive that was already failing to mount.
Why a deep scan is the most demanding thing that can be asked: it reads the entire surface without pause, including regions ordinary use never reaches. On a degrading drive that is hours of continuous retrying, and the stall he reports is the drive failing under it.
Why the current behaviour follows from that: reaching speed and shutting down after a minute is a drive that starts and cannot sustain operation. That is a worse condition than not mounting, and the progression from one to the other happened during the scanning.
Why none of this is a criticism of him: running recovery software on a drive that will not mount is the obvious response, and the licence purchase is how those products work. Nothing about the sequence was unreasonable — the problem is that the tool's model assumes a drive that will hold up.
What the general rule is, and it is the useful thing here: on a drive that is behaving abnormally, the first operation should be a capture rather than a survey. An image secures whatever can be read before anything is examined, and everything else is done against the copy.
Why that ordering matters more than tool choice: a capture spends the drive's remaining reads on content. A scan spends them on finding out what content there is — and on a failing drive there may only be enough for one.
What must not happen now: no further scanning, no more enclosures, and no attempts to repeat the listing. The drive is now shutting down under its own operation, and each start is another attempt it may not complete.
On the bench
The scan listing was treated as evidence of prior readability rather than secured content — listing requiring structures to be located and interpreted, whereas recovery requires every region the content occupies to be read, differing by orders of magnitude. Deep scanning reads the entire surface without pause, including regions ordinary use never reaches, constituting hours of continuous retrying on a degrading drive. No further scanning was permitted, and inspection ran under the laminar flow bench.
The outcome
The listing treated as evidence of prior readability, no further scanning permitted, and the drive inspected under filtered air before any further attempt. Free assessment, one fixed written figure including VAT, 50% of parts and labour upfront with the balance only on successful recovery. The decode: seeing the files listed was real evidence that they were reachable then. It was not the same as having them — listing reads structures, recovering reads everything, and the scanning in between is what the drive did not survive.
When recovery software lists your files
Treat the listing as a warning rather than a result, and stop scanning now if the drive is behaving abnormally. Listing only requires the software to locate and interpret structures; actually recovering requires reading every region your content occupies, and those differ enormously — so a complete file list on screen means the work has barely started. On a drive that won't mount, the first operation should be a capture rather than a survey, because an image secures whatever can be read before anything is examined. A failing drive may only have enough reads left for one of the two.
Stop scanning it — call Manchester Data Recovery on 0161 871 0788; listing treated as evidence of prior readability, draw measured across the operating period, inspected under filtered air before any further attempt.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.