Data Recovery Case File · Trust, Practice & Honest Limits · What a Thumbnail Proves

A Preview Proves Something Survived, Not That the Whole Photograph Did

Her enquiry turns on a reasonable inference. Photographs deleted from a computer, where one shop could not recover them, but "an app I tried showed me all my deleted items in small previews, so I'm unsure why he couldn't do anything" — and it asked for payment before releasing them. Seeing a thumbnail is genuine evidence that something is there, and it is weaker evidence than it feels, because a preview can be built from a fragment far smaller than the photograph.

The decode: what a preview is made from, and why two results differed

Where a thumbnail can come from: two quite different places. Either the software read the start of the photograph and rendered a small version from it, or it found a small preview that had been stored separately — cameras and phones embed a miniature copy inside each image file, and computers keep their own cached thumbnails elsewhere.

Why that distinction is the whole question: if the preview came from an embedded miniature or a cache, it may have survived while the full photograph did not. A cached thumbnail is a few kilobytes and lives in a different place from the image it depicts, so its survival says very little about the original.

What a preview does reliably establish: that recoverable traces exist. Something was found, and it corresponds to her photographs — which is meaningfully better than a scan that finds nothing at all, and it is why her inference is not unreasonable.

What it cannot establish: that the full-resolution images are intact. A photograph is largely made up of data that follows its opening, and if later parts were overwritten, the beginning still renders a small picture while the full image is incomplete.

Why the two results can both be honest: the shop may have looked for complete, valid files and found none, while the software looked for anything renderable and found plenty. They were answering different questions, and neither was necessarily wrong.

What is worth knowing about the payment prompt: showing results and charging before releasing them is a standard commercial model rather than an indication of dishonesty. The caution is different — it is that the previews shown are not a warranty of what the files will be when opened, so the thing being paid for is not fully described by what is displayed.

Why running such software has a cost of its own: installing it writes to the same drive holding the deleted material, and saving results to that drive writes again. Space that deleted files occupy is exactly the space an installation is given, which is how a recovery attempt reduces what remains.

What should happen instead: the drive is imaged first, and every scan runs against the image. Then multiple approaches can be tried at no cost, and whether a photograph is complete is settled by opening it at full size rather than by looking at a thumbnail.

What must not happen now: no further installation, no saving recovery output to the same drive, and as little use of the computer as possible. Every hour of ordinary use writes something.

On the bench

Preview availability was assessed against full-file integrity rather than accepted as proof of recovery — a thumbnail arising either from the opening of the image itself or from an embedded miniature or separately cached copy, the latter surviving independently of the original and occupying different regions, so rendering a preview does not establish that data following the file's opening remains intact. Imaging ran write-blocked before any scanning, with recovered files validated by opening at full resolution.

The outcome

Preview availability assessed against full-file integrity, the device removed from use, imaged before any scanning, and results validated by opening at full size. Free assessment, one fixed written figure including VAT. The decode: a preview proves something survived, which is real and encouraging. It does not prove the whole photograph did — a thumbnail can be built from an embedded miniature or a cached copy that lives elsewhere and survives independently of the image itself.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.