I Thought It Would Add, Not Overwrite

The decode

His misunderstanding is completely reasonable, and the reality is far kinder than it looks. "Add the Microsoft data, not overwrite everything" is what anyone might expect. But creating install media reformats the drive and writes the installer onto it — replacing the drive's structures rather than adding to what was there. That is why his data vanished. The important corollary, though, is that this operation only touches the front of the drive, not the whole surface, so "overwritten" is far less total than the empty drive suggests.

The installer occupies only a few gigabytes at the front, leaving most of the drive untouched. Making a Windows installer writes a new, small partition and a few gigabytes of installation files near the start of the drive. The rest of the drive's capacity — where his photos, video and music lived — is not overwritten by that process. The index that described his files was replaced, so the drive looks empty, but the file data itself remains physically present across the majority of the drive.

Recovery restores the structure, not just scattered files, which matters for a collection this size. Because installer creation only overwrote the front, the previous filesystem's own structures often survive in large part behind the new partition. Reading files through those recovered structures returns them with their original names, dates and folders — so his photos and music come back organised rather than as thousands of anonymous fragments. Where structures did not survive, carving recovers the file data directly by type.

Whether he has stopped using the drive is the decisive factor now. The surviving data stays recoverable only until new writes land on it. If he set the drive aside after realising, the overwritten region is confined to the installer's footprint and the rest is intact. Continuing to use the drive — or booting from it — would erode both the data and the surviving structures. Stopping is the single most important thing, and it should happen immediately.

The honest outcome is strong on the bulk, with the installer's footprint the caveat. The data outside the small region the installer overwrote is recoverable, and where the previous structures survive, it returns organised. The genuine loss is confined to whatever sat exactly where the installer wrote — a small fraction of the drive — reported by what is missing rather than found later. The realistic result is the great majority of his photos, video and music, back with their folders.

On the bench

The drive was imaged under a hardware write-blocker before anything, all work done off the image. The previous partition and filesystem structures were located on the image and compared with their backup copies in R-Studio, and the original directory tree reconstructed to restore names and folders. Signature carving in PhotoRec recovered photos, video and music where structures did not survive, and the recovered data validated by rendering and playback.

The outcome

Drive imaged, the previous structures located and the directory tree rebuilt, and the collection returned organised rather than as fragments. The diagnostic costs nothing and completes within two working days of arrival, and the quote is one fixed written figure with VAT already in it; if the data can't be brought back, no charge is made. The decode: making install media replaces the front of the drive rather than adding to it — which is why your data vanished, but also why most of it survived. Rebuilt from the surviving structures, your photos, video and music come back with their folders.

Our case files are written up from genuine enquiries our lab has handled for customers across Swansea and South Wales, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.