Windows shows letters as mount points; they can move when you shuffle USB devices, add a second internal disk, or restore an image. Recuva’s wizard asks which volume to scan—if you pick by letter alone after hardware changed, you may scan an empty or wrong partition while the data sits under a new letter.
Letters are not stable identities—they are session-specific labels the PnP manager hands out as volumes arrive. Docking stations that reorder Thunderbolt chains can reshuffle letters between boots even when you plug “the same” cable.
A quick verification checklist
- Capacity in GB (and GiB vs vendor marketing).
- Partition style hint: GPT vs MBR, number of volumes on the disk.
- Volume label you set last month—not the default “New Volume.”
Use Disk Management (or your vendor tool) to match capacity, partition style, and label to the physical device. Note the size in GB, not only “E:”. After a reboot, re-verify before starting a multi-hour Deep Scan.
Hidden volumes and OEM partitions
Recovery partitions and BitLocker boot partitions sometimes confuse casual readers of the disk layout. The volume that holds user data is rarely the 499 MB OEM slice—double-check which partition actually contained the missing folder.
Network drives are another layer: a mapped letter may point to SMB storage where undelete belongs on the server, not your laptop cache. Pair this mental model with Workflow and Stories when letters and truth disagree.
When multiple external enclosures share identical vendor strings, serial numbers printed on the case become your friend. Tape a paper label after you verify in Disk Management—future you will thank present you.
Dynamic disks, storage spaces, and third-party RAID drivers can expose volumes that do not map 1:1 to a single physical disk. If your layout uses those features, read vendor docs before assuming Recuva should target a single letter.
Mount points without drive letters
Windows can mount a volume at an empty NTFS folder on another drive. Recuva may list the data under that path—not under a letter at all. If users “lost D:” but the data now lives on C:\Mount\Data, your wizard choice must follow the mount point, not nostalgia for old letters.
WSL and network paths
WSL exposes Linux paths under \\wsl$\ and \\wsl.localhost\. Deletes there are not the same as deletes on C:. Confirm which subsystem owns the file before scanning the wrong layer.
USB hubs and power budgeting
Two identical enclosures on one hub can enumerate in different orders after sleep. If letters swap only after resume, disable selective suspend for that hub during recovery or use powered ports so enumeration stays stable.
Operator cheat sheet
- Screenshot Disk Management before and after hardware changes.
- Note serials in your ticket; “silver Samsung enclosure” is not a unique ID.
- When in doubt, scan by physical disk ID the UI offers, not the letter alone.
Handoff to another tech
Letters alone are not enough in a shift handover. Include partition offsets, capacity, and whether BitLocker was suspended. The next person should not have to reverse-engineer your Friday afternoon cable swap.