Data Recovery Case File · Cameras, Drones & Cards · Every Test Wrote Something
Three People Tried to Help and Each One Wrote to the Card
His enquiry is an honest account of a loss compounded by good intentions. A card handed to someone to copy holiday photographs from, returned with all fifteen hundred gone, then "I again made another fatal error and took a picture on my camera to see if it was a problem with the reader" — and finally a stranger's recovery software returning two complete images. Each of those three steps was reasonable, and each one wrote to the only copy.
| Media | Camera memory card holding approximately 1,500 photographs — apparently formatted by a third party, then written to by a test exposure and scanned by consumer software |
| Reported situation | Card given to a third party to copy photographs · card returned with approximately 1,500 images absent · format assumed · a further photograph taken on the card to test the reader · consumer recovery software run by another party · two complete images returned, roughly 150 reported unrecoverable and approximately 1,300 not processed · contents required |
| Fault class | Format followed by successive writes to the same media — directory structures cleared and free space partially overwritten; carving prospects reduced by each intervening action |
| Equipment used | Sequence of interventions established before any assessment of prospects · card removed from all use · imaged write-blocked at the block level before any scanning · signature carving performed against the image rather than the card · partial and fragmented images reassembled where continuity allowed |
The decode: what each step cost, and why the poor scan is not the ceiling
What a format did and did not do: cleared the directory that describes where each photograph sits. The photographs themselves were not erased by the format — a quick format writes a new empty index and marks the whole card as available, leaving the image data physically in place until something writes over it.
Why that leaves real hope: a card carrying fifteen hundred photographs is mostly occupied by those photographs. The format changed a small index and left the bulk untouched, and photographs are among the most recoverable content there is because each begins with a recognisable signature that can be found without any index at all.
What the test photograph cost: a new file written to a card marked entirely as free space. The camera placed it wherever it chose, and wherever it chose was on top of something — that is the single clearest example of the principle that after a loss, every action that touches the media is a cost.
Why the test was so understandable and so expensive: he wanted to know whether the fault was the card or the reader, which is a sensible question. The answer could have been obtained on any other card, and testing the reader with a different card would have told him the same thing at no cost.
What the recovery software cost: less directly, but not nothing. Software run against the card itself reads it repeatedly, and where such software is installed or writes its results onto the same card it does further damage — the safe order is always to image first and scan the image.
Why the results he was given are not the measure of what remains: two complete photographs from fifteen hundred sounds like an answer, and it is a description of one tool's performance rather than of the card. Roughly thirteen hundred files reported as not processed is a tool that stopped, not a card that is empty — that number is the software declining to continue, and it says nothing about whether the content is there.
What "unrecoverable" means in that context: the tool located something and could not assemble it into a valid image. Partial images, fragmented images and images whose openings survive but whose remainder is displaced are all frequently reassembled by different means than a general-purpose scan applies.
What is done differently: the card is imaged once, at the block level, and never touched again. Every subsequent attempt runs against that image, so scanning can be repeated with different approaches without any further cost to the original — which is the opposite of what has happened so far.
What must not happen now: nothing further goes into the camera, no more photographs are taken, and no more software is run against the card. The single most valuable thing at this point is that the card stops being used entirely.
On the bench
The sequence of interventions was established before any assessment of prospects — a format clearing the directory and marking capacity available while leaving image data physically in place, so a subsequent exposure written to nominally free space displaces content, and consumer software run against the card itself compounds the exposure. Imaging was performed write-blocked at the block level before any scanning, with signature carving performed against the image rather than the card, photographs carrying recognisable openings locatable without any index.
The outcome
The intervention sequence established first, the card removed from use, imaged at the block level, and carving performed against the image. Free assessment, one fixed written figure including VAT; on cards and sticks where content has been deleted or overwritten, the figure is payable upfront. The decode: the format left your photographs in place and cleared only the index. What cost you was everything after — the test exposure written to space marked free, and software run against the card itself rather than a copy of it.
Testing a card after photographs have gone missing
Never test with the affected card — put a different card in the camera instead, which answers the same question at no cost. Taking a photograph to check whether the reader works writes a new file onto media the camera now considers entirely free, and it lands on top of what you're trying to recover. The same applies to recovery software: run it against an image of the card rather than the card itself, so attempts can be repeated without further cost. And treat a poor result as one tool's performance rather than a verdict — files reported as not processed usually means the software stopped, not that the card is empty.
Stop using the card entirely — call Easy Data Recovery on 028 9002 0144; intervention sequence established first, imaged at the block level before any scanning, carving performed against the image.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.