The customer was moving files from a laptop to an external hard drive when the heads failed on the external drive. The move function made the data disappear from their laptop, and it doesn't appear to be on the external drive now. I was able to swap the heads and make a full image of the drive. The directory structure all rebuilt perfectly, but since the move didn't complete it is obviously missing the directories that were in the process of being moved onto it when it failed. The customer has used the laptop quite a bit since then, so I don't think it will be possible to recover them from that either. Shouldn't there at least be orphaned files on the recovered drive of those files that did move over successfully?

Move function is just delete function so data should be in unallocated clusters.

Thanks for the reply. Yeah, I realize that. The only thing is, the customer has used the laptop they were moving the data from extensively since then, and has saved quite a bit more data to it therefore most likely overwriting the sectors that originally contained that data. I was just curious why no orphaned files would be seen on the destination drive that crashed before the move completed.