Case file · Logical & corruption · BDR-2025-0932
My Folder Became Zero-Byte Files.
It started with hardware nagging — a couple of poor USB connections
— and a warning everyone has ignored once: disk not ejected properly
. The bill arrived on reinsertion: one important folder's files now showing as 0 byte
Unix Executable
entries that open as nothing at all.
Same symptoms on your desk?
01273 964902
The decode.
Zero bytes and a nonsense file type is the filesystem misreporting, not the data vanishing. A FAT directory entry stores a file's name, size, attributes and starting cluster; the data itself lives elsewhere on the media entirely. An interrupted write during an unsafe eject can leave those entries half-updated — size and type fields corrupted while the clusters holding the actual content sit untouched. macOS then displays what it reads, which is nonsense, and the file appears empty.
Equipment on this case.
How a case runs →| Platform | What it did here | Why this tool |
|---|---|---|
| PC-3000 Flash | Read the flash media at a low level, beneath the confused filesystem | Reads memory chips directly, with a current chip database for automatic identification |
| R-Studio Technician | Rebuilt the damaged FAT directory entries from surviving structures | Broad filesystem coverage and dependable RAID reconstruction |
| UFS Explorer Professional Recovery | Content-based recovery for the entries too damaged to repair | Stronger than most on the awkward filesystems — APFS, ReFS, XFS, ZFS, Btrfs |
On the bench.
Image the media before opening the folder again
Each reinsertion of a flash drive in this state risks the controller performing housekeeping over the very clusters in question. The media was read at a low level first, producing a stable copy on which every subsequent experiment was free.
Repair the directory entries where they survive
FAT keeps more than one copy of its allocation table, and the damage had not fallen identically on both. Where the surviving copy allowed it, the corrupted entries were rebuilt — restoring names, sizes and cluster chains, and with them the files themselves.
Carve the remainder by content signature
A minority of entries were too damaged to repair. Those files were recovered by their internal structure instead — documents identified by their own format signatures and reassembled from the cluster chains, then matched back to plausible names where the evidence supported it.
The outcome.
The important folder returned with its files opening normally, most under their original names. A powered USB hub replaced the flaky ports that had started the whole affair.
Related on the index.
More from Logical & corruption.
Recognise your own drive in this story?
Same rule as every case above: power it down, and let the diagnosis be free before any decision has to be.