My computer is used for both my illustration work and nearly all of my personal files from the past six years. Last week, the files on my Desktop suddenly disappeared. The folders were still visible, but they appeared empty; files elsewhere on the SSD seemed unaffected. After restarting, the computer began showing a blue screen and would no longer boot properly.
A repair shop said they could not restore Windows and suggested the SSD may have been nearly full, possibly causing data to be overwritten. They installed Windows on a different SSD, so the original drive is now available for examination. I know a computer-forensics specialist who may be able to help, but I want to know whether recovery is worth pursuing or whether the files are likely gone permanently. What should I do before attempting recovery?
5 Answers
The explanation that an SSD simply became too full and started overwriting files on its own is not quite right. A nearly full drive can cause Windows and applications to fail, but it does not normally randomly erase Desktop files. This could be a damaged Windows user profile, a filesystem problem, a synchronization issue, or actual file deletion. The fact that the folders remained while their contents disappeared is useful information for diagnosis.
This is also a good reminder that important work needs at least one separate backup, preferably an automated local backup plus an offline or cloud copy. Mirrored drives or a NAS can help with hardware failure, but they are not the same as a versioned backup if files are accidentally deleted or corrupted.
Your computer-forensics contact should examine the drive before anyone changes it. Ideally they can make a sector-by-sector image of the SSD and work from the copy, rather than experimenting with the original. They may also be able to determine whether the files were deleted, moved, affected by a corrupted profile, or removed by TRIM. Recovery is not guaranteed, but it is too early to assume everything is gone.
If the machine can still be accessed using the new Windows installation, check whether the missing files exist under another user profile or in the original user directory. Also check the Recycle Bin, cloud-sync services, and any temporary or backup folders—but avoid making changes to the old drive. If the data is important, let the specialist do those checks and recovery work instead.
There is a chance, but stop using the original SSD immediately. Do not boot from it, reinstall Windows on it, run repair tools, or save recovered files back to it. SSDs use TRIM and wear-leveling, so deleted data can become unrecoverable faster than it would on a traditional hard drive. A forensic specialist is absolutely worth contacting, especially since only the Desktop contents seem to be missing.
Related Questions
Lenovo Thinkpad Stuck In Update Loop Install FilterDriverU2_Reload