Unlost found nothing. What that means, and what to try next

First: read what the app told you

Unlost writes a note at the top of the results whenever something limited what it could see. These are easy to scroll past and they usually contain the answer.

Seven things to try, in order

Work down this list. It is ordered so that the cheapest and most commonly correct fixes come first.

1. Scan the whole physical disk, not the drive letter. This is the single most common reason a scan comes back empty. If the partition table was damaged, or the volume was deleted rather than the files on it, there is no drive letter pointing at the right place any more — and scanning the letter that is there scans a different volume. Pick the physical disk in Unlost instead. That path reads the partition table, its backup copy, and failing both, sweeps the medium for the start of a file system that nothing has recorded.

2. Run the deep pass. If the file table gave a usable list, Unlost offers the deep pass rather than running it, because it returns files without names and takes hours. When the ordinary scan found nothing you wanted, that trade is worth making. It reads every byte of the medium and recognises 64 file types by their contents, which is the only thing that still works after a format.

3. Check that you scanned the right drive. Obvious, and it happens constantly — particularly with two identical USB sticks, or a card reader that shows up as several drives. Unlost names the drive it has open in its title bar for the whole session, so the check takes a second.

4. Look under [unknown folder] and sort by type. Files whose parent folder could not be reconstructed are put in one folder with that name rather than into a plausible guess at a path. If you were looking for a familiar folder structure and did not see it, your files may be sitting there. After a deep pass, sorting by file type is the only useful way to navigate, since there are no folders at all.

5. If files are listed but cannot be saved, read what the row says. Two different states look similar and mean opposite things. A file found only in a folder index has a name, a size and a date but no addresses — nothing on the volume records where its bytes were, and the file cannot be written out. A file marked as encrypted is the reverse: the data is right there in full, and the key is in a Windows user account. For the second, logging into the account that owned the files and copying them out normally is the answer, if that account still exists.

6. Take the disk out of the enclosure. Some external drive enclosures and NAS boxes present the disk through a bridge chip that hides or re-maps the real layout, and some encrypt at the enclosure level. Connecting the bare disk to a SATA or USB adapter gives Unlost the actual medium. If a NAS disk shows a Linux layout, that is expected: ext2/3/4, XFS and LVM are read.

7. Image the drive and scan the image. If the scan was slow, stalled, or returned errors, the drive may be failing. Copy it front to back into an image file, then scan the image. This is gentler on the drive than scanning it, and it means every later attempt costs the drive nothing. Unlost records the address of every stretch that would not read, so files landing on damaged areas are flagged when they are found rather than discovered to be broken later.

When an empty list is the correct answer

These are cases where no software can help — not this one, not a more expensive one. Recognising your situation here saves you from a week of trying tools.

The data was overwritten

Something new was written into the same place. The old bytes are not underneath the new ones; a drive stores one value per location. The often-repeated idea that overwritten data can be read back with laboratory equipment comes from research on drive densities of the 1990s and does not carry over to any modern disk. A single overwrite is enough, and no recovery service can undo it.

This is why the advice to stop using the drive is not a formality. Every minute of ordinary use is another chance for something to land on the files you want.

The files were on an internal SSD

Windows tells an SSD which blocks a deleted file freed — the TRIM command — and the drive's controller erases them by itself, typically within seconds to minutes. After that the drive returns zeros for those addresses to everyone, including software reading it sector by sector. There is nothing left to find, acting fast rarely helps because the erase is not triggered by you using the computer, and a recovery lab cannot undo it either. Why deleted files can be recovered, and when they can't covers this in full, including the important exception: SD cards and USB sticks do not receive TRIM, which is why they recover so well.

A full format, a secure erase, or a free-space wipe

A quick format replaces the index and leaves the data — those come back well. A full format writes over the whole volume, a drive's own secure-erase command destroys everything on it, and tools that wipe free space are designed to make exactly this unrecoverable. All three work as intended.

The volume is encrypted and you do not have the key

Unlost identifies BitLocker volumes, including BitLocker To Go, and reports the encryption method, the available unlock methods and the recovery key identifier. It does not decrypt, and neither does anything else without the key — that is what encryption is for. The recovery key identifier is genuinely useful here: it turns "somewhere in my Microsoft account there are nine recovery keys" into "this one". Check your Microsoft account, your organisation's IT department, a printed copy, or a USB startup key.

The file system is one Unlost does not read

APFS and HFS+ from a Mac, btrfs, ReFS, ZFS and UDF are recognised and named, and then Unlost tells you it cannot read them. The deep pass still works on those volumes, because it does not care how the bytes were laid out — you would get files without names. A tool built for that file system will do better.

When the answer is a recovery lab

If the drive has a physical fault, software is the wrong tool and running more of it makes things worse. Stop, disconnect the drive, and get a quote from a professional data recovery lab. This is the point where we would rather send you somewhere else than keep you here.

The signs

• Clicking, beeping, grinding or repeated spin-up noises from a hard drive. A clicking drive is usually a head or actuator problem, and every additional minute of power can turn a recoverable disk into a damaged platter.
• The drive does not spin up at all, or is not detected by the computer's firmware.
• It appears and disappears, or disconnects part way through every scan.
• Reads are extremely slow — kilobytes per second — or the scan stalls for minutes at a time on one area.
• Physical damage: the drive was dropped while running, went through water or fire, or the circuit board is visibly burnt.
• A RAID array or a server volume where more than one disk failed. Unlost does not reassemble RAID sets.
• The data matters more than the cost. That is a legitimate reason on its own. If losing it would be a business or legal problem, do not experiment.

What a lab can do that software cannot

A lab opens drives in a clean environment, replaces heads and circuit boards with donor parts, reads platters on specialist hardware that can retry a failing sector far more patiently than an operating system will, and reconstructs RAID sets from member disks. None of that is available to a program running on your PC, and none of it is something to attempt at home.

What to do before you call one

• Leave the drive off. Not plugged in, not powered, not "just one more try". On a failing drive, attempts are a consumable.
• Do not run more recovery software. Including this one.
• Do not open the drive, and do not put it in a freezer. Both of those pieces of advice circulate widely and both make a lab's job harder or impossible.
• Do not let anyone run a repair tool on it, including Windows' own check-disk. A repair tool's job is to make a file system consistent, and it does that by writing.
• Ask for a diagnosis and a fixed quote before work starts, and ask what happens if they recover nothing. Many labs work on a no-recovery-no-fee basis; the ones that do will say so.
• Expect it to be expensive. Clean-room work on a mechanically failed drive is skilled labour on specialist equipment, and the price reflects that rather than the value of your files.

Three things that are widely claimed and are not true

• "Overwritten data can be read back with the right equipment." No. Not by software, and not by a lab. Anyone claiming to read layers underneath overwritten data on a modern drive is describing something that does not exist.
• "A lab can recover files deleted from an SSD." Not once the controller has erased the blocks, which happens on its own within minutes. The chips are physically blank; there is nothing to read with any equipment.
• "Paid recovery software finds files that free software cannot." Price is not the variable. What a tool reads is: whether it reads the file table, whether it reads the journals, and whether it can carve. If one tool found nothing, try one that reads something the first one did not, rather than one that costs more. The comparison page lists the questions worth asking about any of them.

Questions

Is it worth running the scan a second time?

Not on the same settings — the result will be the same, and on a drive that is struggling, a second full pass spends reads it may not have. Change something first: scan the physical disk instead of the drive letter, or run the deep pass. On a drive with any physical symptom, image it once and run every later attempt against the image.

Should I try a different recovery program?

Yes, if it reads something Unlost does not — a file system on the not-supported list is the clearest case. Trying five tools that all do the same thing is not a strategy, and every install and every scan is more activity on a drive you want left alone. Never install another tool onto the drive you are recovering from.

The files came back but they are broken. Is that recoverable?

Sometimes. A file reported as damaged is missing some of its clusters, and those clusters went to something else — that part is gone. But a photograph put back at its right length with a damaged band across it usually still opens, and a document missing a small fraction often still opens. Recover it and look. If Unlost reported a file as intact and it opens broken, that is a bug worth reporting.

How do I report a result that looks wrong?

Write to [email protected] with the file system, the file type, what the app said before you recovered the file, and what happened when you opened it. A file reported intact that opens broken — or the reverse — is the most useful bug report this project can get. More on getting in touch.