Hard Drive RecoveryData recovery & digital forensics

Memory cards

A card that asks to be formatted usually still holds everything.

The photos and the filesystem that lists them are separate things, and it is nearly always the list that breaks. What decides whether the shoot comes back is what happens to the card between now and the bench.

What breaks on a card

Nearly all card failures are one of two kinds. Either the filesystem, the FAT or exFAT index that records which photo lives where, has been damaged, or the card’s controller, the small chip that runs the card, has failed. The first looks dramatic and recovers well. The second looks identical from the outside and mostly does not. Telling them apart is the first thing an assessment does.

Filesystem damage has ordinary causes: a card pulled mid-write, a battery dying during a shoot, a camera locking up, one card shuffled between a camera, a phone and three readers. The index gets half-written and the device gives up on it. The photos are still sitting in their blocks, unlisted.

The format prompt

“You need to format the disk before you can use it” reports one fact: the computer could not read the card’s index. The photos themselves have not been assessed by anyone. Answering yes writes a fresh, empty index and the beginnings of new structures over the exact area a recovery works from, and turns an afternoon’s job into a harder one. Decline it, take the card out, and treat the card as evidence rather than storage from that point on.

Reading a card the filesystem has given up on

When the index is unreadable, we stop relying on it. The card is imaged read-only, and the image is searched for the files themselves: every JPEG, RAW file and video stream has a recognisable internal structure, so files can be identified by their own contents and carved out with no index at all. Cameras help here without meaning to. They write files one after another in large blocks, so the fragmentation that defeats carving on a computer drive is rare on a camera card.

RAW formats get their own handling, CR3, NEF, ARW, DNG and the rest, because a generic tool that only knows JPEG walks straight past them.

Video that stops halfway

A video file is the footage plus an index that tells a player where every frame sits, and the index is written last, when recording finishes cleanly. A dashcam that lost power, a drone that came down, a camera that died mid-take leaves footage on the card with no index, and every player calls the file corrupt or plays nothing.

The footage is still there, and the file can be rebuilt from it: the stream is parsed frame by frame and a new index reconstructed from what the frames themselves say. The same treatment covers recordings cut off by a full card, and files a camera’s own rescue function turned into an unplayable stub. What cannot be rebuilt is footage the device never wrote, so a recovered file may still end a few seconds early: those frames were in the camera’s buffer when the power went, and they never reached the card.

Where it ends

Some cards are past anyone’s help, and you should hear that here rather than after a courier trip.

Overwritten is gone. A card that was formatted and then shot on has replaced the old files wherever the new frames landed. What was overwritten no longer exists. What the new footage has not reached often survives, so a partial recovery is still worth assessing.

A card that is dead to every reader is usually final. MicroSD cards, and most modern full-size cards, are a single moulded chip, storage and controller together, and when the controller inside fails there is no way past it from the outside. We assess it free, rule out the cheap causes first, and give you the findings in writing.

A card used as a phone’s internal storage is encrypted to that phone. Android’s format-as-internal option ties the card to keys held by that handset, and without the phone the card reads as noise. With the phone, even a damaged one, there are options; that is a phone job rather than a card job.

Counterfeit cards lose data by design. A card sold as 512 GB but built on 32 GB of real flash wraps around and destroys older files once the real capacity is passed. Those files were never stored anywhere. We can confirm a fake quickly, which at least settles what happened to the missing footage.

Get it assessed, freeCall 02 9707 0999

Common questions

The camera says card error, or asks me to format. Are the photos gone?

Usually not. Both messages mean the device could not read the card's index, and the index is not the photos. Provided nothing writes to the card from here, the odds are good: the files are identified by their own structure and carved from a read-only image of the card. The step that does the damage is reformatting to test whether the card still works. Decline it.

The card is not detected anywhere. Is that the end?

Often, and we will say so rather than charge you to circle it. A microSD card is one moulded chip, storage and controller together, and a failed controller has no way around it from the outside. Before that verdict the cheap causes get ruled out, because readers and adapters fail more often than cards do. The assessment is free either way, and you get the findings in writing.

I kept using the card afterwards. Is everything lost?

Not everything, usually. New recordings land where the filesystem chooses, overwriting some of the old files and missing others, so recovery becomes a salvage of what the new footage has not reached. The sooner the card comes out, the better the ratio. Stopping now still matters, even if you did not stop straight away.

What does SD card recovery cost?

Card work starts at $249. The assessment before it is free, and you get a fixed quote before any work begins. No recovery, no fee applies: if we cannot get back the files that matter to you, agreed in writing at quote time, there is no recovery fee, and a card assessed as unrecoverable costs you nothing.

Recovering deleted photos → · What it costs →