Data Recovery Case File · Trust, Practice & Honest Limits · Handling Is Part of the Result
Where Content Will Be Relied On, the Record of Its Handling Matters Too
Her enquiry names a requirement most do not. A card no longer being read, holding photographs needed for an expert report, where she asks for "continuity of evidence handover of the card and retrieval of data." That changes what a successful outcome looks like: recovering the images is necessary and not sufficient, because material relied on in proceedings has to be accounted for from the moment it changes hands.
| Media | Memory card holding photographic material required for expert evidence — no longer being read; dated content required for a report in preparation |
| Reported situation | Memory card no longer being read · photographic material held from specific dates · content required for an expert report in preparation · a separate earlier matter with material already held elsewhere · documented handover of the card requested alongside recovery |
| Fault class | Card not reading with evidential handling required — recovery accompanied by documented custody, unaltered originals and verifiable output |
| Equipment used | Documented custody recorded from receipt with each transfer logged · card imaged write-blocked with the original never written to · verification values computed for the image and retained with it · recovery performed exclusively against the image · original returned unaltered with the working copy and its verification record |
The decode: what evidential handling adds, and why it costs little to do properly
Why the ordinary approach already suits this: recovery is done by imaging first and working only from the copy, with the original never written to. That is the standard method for sound technical reasons, and it happens to be the same discipline evidential handling requires.
What a documented custody record adds: an account of who held the item and when. It records receipt, each transfer, the work performed and the return — so the item's location is accounted for continuously rather than assumed.
Why that matters for material relied on in a report: the question that arises is not usually whether the images are genuine but whether anything could have happened to them. An unbroken record answers that in advance, and its absence leaves a gap that cannot be filled retrospectively.
What verification values are and why they matter here: a calculation over the captured data producing a value that changes if any part of it changes. Computing it when the image is made and retaining it means the copy can be shown to be unaltered since capture — which is the technical equivalent of a seal.
Why the original must be returned unchanged: it is the source. A card that has been written to is a card whose state has been altered by the recovery, which is precisely what write-blocked imaging exists to prevent.
What she should avoid doing herself, and this is the practical warning: no further insertion into readers, no recovery software, and no accepting a prompt to repair. Every one of those writes to a card that will need to be accounted for, and an attempt made in good faith is still an unrecorded alteration.
Why the distinction between her two matters is worth keeping: for the earlier one she holds the material elsewhere, so the card is a convenience. For the current one the card is the source, and only the second requires the fuller handling.
Why saying so is useful rather than pedantic: evidential handling is not free, and applying it where it is not needed is cost without benefit. Scoping it to the material that will actually be relied upon is the sensible arrangement.
What the technical position is likely to be: a card that has stopped being read has most often suffered a controller failure, with the memory behind it unaffected. Photographs are self-contained and carry recognisable openings, so they are recoverable by searching content directly where structures cannot be rebuilt.
What is provided at the end: the recovered material, the verification record, and an account of what was done to obtain it. A recovery that cannot be described is harder to rely on than one that can.
On the bench
Documented custody was recorded from receipt with each transfer logged, accounting for the item's location continuously. The card was imaged write-blocked with the original never written to — the standard method for technical reasons and the same discipline evidential handling requires — with verification values computed for the image and retained, a calculation over captured data that changes if any part of it changes, establishing that the working copy is unaltered since capture. Recovery was performed exclusively against the image, and the original returned unchanged.
The outcome
Documented custody recorded from receipt, the card imaged write-blocked with verification values retained, and recovery performed exclusively against the image. Free assessment, one fixed written figure including VAT; on cards where content has been deleted or overwritten, the figure is payable upfront. The decode: imaging first and working only from the copy is our standard method for technical reasons, and it is the same discipline evidential handling needs. What is added is the record — custody from receipt, verification values, and an account of what was done.
When recovered material will be relied on formally
Say so before you send it, and stop trying to read it yourself in the meantime — every insertion, scan or repair prompt writes to a card that will need to be accounted for, and an attempt made in good faith is still an unrecorded alteration. Ask for three things: documented custody from the point of receipt, imaging that never writes to the original, and verification values computed at capture and retained, so the working copy can be shown unaltered since. Scope it to the material that will actually be relied upon, since this handling isn't free and applying it where it isn't needed is cost without benefit.
Say so before sending — call Easy Data Recovery on 028 9002 0144; custody documented from receipt, imaged write-blocked with verification values retained, recovery performed exclusively against the image.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.