Data Recovery Case File · USB Flash · The Worst Advice, Survived

"Format the drive to recover your data": anatomy of consumer recovery's most dangerous instruction — and the encrypted files that outlived obeying it

The sequence in this enquiry contains a sentence that should stop every reader: after his encrypted 64GB SanDisk stick began demanding a format and several recovery programs had failed to help, one more instructed him to format the drive in order to recover his data. He did. It didn't work either. By the time he wrote in — a teacher, email contact only, please — he held "a formatted, previously encrypted flash drive that has not been used since formatting," and the weary tone of a man who suspects he was talked into making things worse. He was. This page explains the instruction, the damage it did and didn't do, and the recovery that still succeeded — in that order, because the instruction deserves the autopsy.

Why software says it — and what obeying actually cost

The instruction isn't malice; it's a workflow shortcut with the risk printed in invisible ink. Some recovery tools struggle to scan a volume the operating system won't mount, so they direct the user to format it first — making the device mountable and scannable — and then undertake to recover the "formatted" contents afterwards. On a textbook case it can even work, because a quick format is a new front page rather than a shredder. But it is gambling with the patient to convenience the tool: the format's writes land somewhere, occasionally on something that mattered; it destroys the original filesystem's evidence that a careful recovery would have used; and — decisive here — generic undelete logic has no idea what to do with what his stick actually contained. Because his data didn't live as ordinary files at all: "previously encrypted" meant the stick's contents sat inside an encrypted vault — one large sealed container file holding everything, opened day-to-day by his password. The format overwrote the filing system that pointed at that container; the applications then dutifully resurrected fragments of ordinary-looking files and found nothing he recognised, while the vault itself — a single huge, distinctive, contiguous object — sat in the untouched majority of the stick, invisible to tools that were looking for documents instead of the safe that held them.

The two-layer rescue

The stick was imaged once, write-blocked, and the search ran for the right quarry: not his files, but the vault. Encrypted containers have recognisable anatomy — headers, structure, improbable-entropy bulk — and the carve located it whole in the image, its boundaries validated, its body untouched by the format's small footprint. Then layer two, the part no software or laboratory does without the owner: the recovered container was opened with his password — stated plainly as ever, because it's the honest architecture of encryption: with the credentials, a vault recovery proceeds like any other; without them, nobody on Earth reads a byte, which is precisely what he'd bought when he encrypted it. Inside: his files, complete, exactly as the vault had always kept them — a teacher's working life, verified by opening documents across it, delivered on new media, and immediately re-secured in a fresh vault with the password that had just proven its worth.

Outcome

Full recovery, one instruction formally condemned. The rule this page exists to publish: any software that tells you to format the failing device as a step toward recovering it is telling you whose convenience it serves — decline, close it, and treat the advice itself as a diagnostic that you've reached the edge of the desk-tool world. His encryption, meanwhile, deserves the closing credit: the vault that made his data invisible to the bad tools is also what carried it intact through a format and out the other side. Encrypt your portable data — and store the password like the second half of the data it is.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.