Data Recovery Case File · Formatted & Logical Faults · Which Reset Option Was Chosen
SSD Wiped by a Windows Reset: What Survives
The enquiry came from a business about its own equipment and was admirably free of narrative. "We have an SSD that has been wiped — Windows reset — by a former employee. Are you able to recover the data?" This page takes the same approach and treats it purely as a technical question, because that is what determines the answer and because speculation about anybody's reasons is neither useful nor any of this archive's business. What matters is that Windows reset is not one operation but several, offered as a short sequence of choices, and the options behave so differently that they span the entire range from routine recovery to genuinely nothing. Establishing which was used is the first job, and it can be determined from the drive itself.
| Media | Company solid-state drive — subjected to a Windows reset; original contents required by the business that owns the device |
| Reported situation | Reset performed by a departing member of staff · specific reset option used not known · device owned by the enquiring business |
| Fault class | Operating-system reset with unknown option — outcomes ranging from recoverable to unrecoverable depending on the choice made and on trim behaviour since |
| Equipment used | Ownership and authority confirmed before examination · drive imaged write-blocked (Atola TaskForce 2) · reset variant determined from surviving structures, logs and allocation patterns · deleted-entry recovery and carving where the option allows · findings reported honestly where it does not |
The decode: the options, and how the drive reveals which was used
Keep my files: the gentlest option. It reinstalls the operating system while preserving the user's documents, and moves anything it cannot keep into an old-installation folder. If this was chosen, most data survives in place and the recovery is trivial or unnecessary. It is also the least likely option in these circumstances.
Remove everything — quick: the middle case, and the most common. This removes the files and reinstalls, but it does not deliberately overwrite the drive; on a conventional hard disk it would leave most data physically present and highly recoverable. On a solid-state drive, however, the operating system informs the drive that those blocks are no longer in use, and the drive clears them in the background within minutes. That background clearing is the crucial difference: on an SSD, the quick option produces an outcome much closer to a thorough wipe than it would on a hard drive, and the passage of time since makes it worse rather than better.
Remove everything — clean the drive fully: the option Windows describes as being for when you are giving the device away, and it means what it says. It writes across the drive deliberately. Where this was chosen, the honest answer is that the data is gone, and this archive says so rather than selling an attempt.
How the drive reveals which: the reset leaves evidence. Installation timestamps, the presence or absence of an old-installation folder, the pattern of allocated and unallocated space, and what remains readable in unallocated regions together indicate which path was taken and how thoroughly. That determination is made from a write-blocked image before any recovery effort is spent, so the business finds out what is realistic before committing.
The other thing worth knowing: a reset affects the drive it ran on. Company data frequently exists elsewhere — on a file server, in a cloud workspace, in mailbox archives, in colleagues' copies, or in the backup system the business already runs. Those should be checked in parallel, because in commercial cases the material is often reconstructable from sources that cost nothing to interrogate. It is also worth noting, without labouring it, that a firm should expect to confirm ownership of a device before anyone examines it — a reasonable safeguard that protects the business as much as it constrains it.
On the bench
Ownership was confirmed before the device was examined, as it is for any third-party machine. The drive was then imaged write-blocked on the Atola TaskForce 2, and the reset variant was determined from the image rather than assumed: installation timestamps read, the presence of a preserved old-installation folder checked, and the allocation and content patterns across unallocated space examined for the signature of a deliberate overwrite. With the variant established, deleted-entry recovery and content carving were applied where the option left anything to find, and the outcome — including where it was nothing — was reported plainly in writing before further effort was spent.
The outcome
The reset variant determined from a write-blocked image and the realistic position reported before any assumption was made. Free assessment, one fixed written figure including VAT; where a drive has to be opened or a chip removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for any business facing the same: Windows reset is several operations behind one name, and the choice made spans the whole range — keep-my-files preserves most data, remove-everything-quick removes the references without deliberately overwriting, and clean-the-drive-fully writes across it and ends the matter; on a solid-state drive the quick option behaves far more destructively than on a hard disk, because the drive clears the freed blocks in the background; and the variant used can be established from the drive itself before anybody spends anything.
Company device reset by a departing member of staff
Take the drive out of service immediately and don't power the machine up again — on a solid-state drive, background clearing continues whenever it has power, and that is what turns a partial removal into a complete one. Then find out which reset option was used before assuming anything: keeping files preserves nearly everything, removing everything quickly removes references without deliberately overwriting, and the full-clean option writes across the drive and genuinely ends it. That determination can be made from the drive itself, so ask for it before committing to a recovery. In parallel, check where else the material exists — file servers, cloud workspaces, mailbox archives, colleagues' copies and your own backup system frequently hold most of it, and those cost nothing to interrogate. Expect any reputable lab to confirm the device belongs to your business before examining it.
Power it down and call Leeds Data Recovery on 0113 322 3083; ownership confirmed, imaged write-blocked, the reset variant determined from the drive, and the realistic position stated in writing.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.