He was able to fix the blue screen and lose his photos in the same step. When stuck on a blue screen, he "reinstall my windows 10 from a pen drive", then used the recovery pen drive that came with the PC to "reset my windows 10 and I loose all my data." The things he wishes to get back are "family pictures and some docs." Resetting Windows simply hides the old files from view (they have not been shredded yet), so those family photos and documents are very likely still recoverable, provided the freshly-reset PC is used as little as possible going forward.
| Media | Internal system drive of a PC reset to factory Windows 10 from a recovery pen drive to escape a blue screen — family photos and documents removed in the reset, the drive now holding a fresh Windows install. |
| Reported situation | PC stuck on a blue screen · Windows reinstalled, then reset from the manufacturer's recovery drive · previous data lost in the reset · family photos and documents wanted · PC now running a fresh Windows installation. |
| Fault class | A Windows reset that removed the previous files — their data largely intact in unallocated space behind the fresh install, recoverable until overwritten by continued use of the reset system. |
| Equipment used | Drive imaged under a hardware write-blocker before further use of the PC, all work off the image · unallocated space and the previous filesystem's remnants analysed in R-Studio, the prior directory recovered where structures survive · signature carving in PhotoRec targeting photos and documents where they don't · recovered files validated by rendering and opening. |
A Windows reset removes files from the filesystem but does not overwrite them wholesale. A reset of Windows and a subsequent clean install establishes a brand-new operating system environment and deletes the prior files (and their associated directory entries) from the file system's indexes, which is why his data is gone from view. However, the reset writes the new installation and marks the old data's space as available; it does not immediately overwrite the entire drive. Therefore, while he may not see the old files anymore because there are no longer directories that reference those files, the data for the prior files largely still exists in what is now free, unallocated disk space, behind the fresh install.
"Lost all my data" signifies removed from the index, not shredded, which is the hopeful distinction. The family photos and documents were de-indexed by the reset. Thus, the system does not show them; however, the underlying data still resides in the disk space that has now been marked as "free". An empty-looking drive post-reset indicates the index of files was cleared while the majority of file contents remained intact, not a surface wiped clean, and it's exactly this situation from which recovery succeeds.
A fresh install uses up just some space from the disk, with plenty of area left over where your old files still sit. It will use up a portion of a hard disk when you perform a "fresh" Windows install, but on a typical drive it does not fill the whole capacity. So much of your previous information is not overwritten by the install itself; it sits in the many areas of the drive which still had unassigned addresses (unallocated). Your photos and documents are located in those spaces and can be recovered using either the remnants of the previous file system or "carving" the file data out directly.
Use of the reset PC has become the active threat, and it needs stopping urgently. Any time the computer with its newly reset operating system is used, writing occurs (updates, temporary files, new information), and each write can land on the unallocated space holding his photographs, overwriting them permanently. Each day he continues to run this reset operating system on his computer, he is steadily losing recoverable data. The single most important thing to do is stop using the PC and create an image of the disk before anything more is written.
An honest outlook, weighed against the usage since the reset, is encouraging. If the image of the drive can be taken prior to a lot more usage, it is very likely that the family photos/documents will be substantially recoverable, returned as they were originally arranged where previous structure survives, or carved out if previous structure does not. The real caution here is how much the reset install and/or any later usage has already overwritten, determined by examining the image of the drive, with confirmation of what extent is recoverable before a charge is made.
The drive was imaged using a hardware write blocker before any further use of the PC, and all of the analysis was conducted from that image copy. All of the unallocated space and the remainder of the old file system was analysed with R-Studio, and the old directory was found and reconstructed wherever its structures remained. Where they did not, signature searching in PhotoRec was used to target individual photos and documents that were still recoverable. Each of the recovered files was verified through rendering and opening.
The drive was imaged before any further use. Previous data was retrieved from unallocated areas, and the photos and documents have been returned. The diagnostic costs nothing, and it is completed within two working days after we receive the drive. We provide one fixed written quote, with VAT already in it. If we cannot bring your data back then there will be no charge to you. The decode: when you reset Windows it removes the reference to your files in the file system index, however it does not shred the actual files; they exist in unallocated areas behind the new Windows installation. Imaged before the reset PC overwrites them, your family photographs and documents come back.
Stop using the computer immediately: a reset will remove your files from the index but leave the data in unallocated space on the drive, and every time you run the freshly reset system it writes, risking overwriting those files permanently. Do not install any programs or save anything, and ideally, do not boot it again. The data isn't shredded; just de-listed. It is still recoverable until it is overwritten. Have the drive imaged before any further use so that the previous photos and documents can be recovered from a copy.
Our case files are written up from genuine enquiries our lab has handled for customers across Swansea and South Wales, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.
Diagnostic provided at no charge. Fixed quote. In most cases you only pay if we recover your data. Start now or call the freephone.