Data Recovery Case File · Cameras, Drones & Cards · Two Copies, Two Routes

The Same Photographs Lost Twice Are Two Separate Chances

Her enquiry describes losing the same set of images by two different routes. Around six hundred raw photographs on a card that "got corrupted — now the camera says no images", and the same pictures on a computer where "I emptied the Trash." Those are two independent recoveries of one set of photographs, and they are so different in method and difficulty that the sensible order is to assess both and pursue whichever is stronger.

The decode: why the two routes differ, and which is usually better

What happened on the card: the structure describing where each photograph sits has become unreadable, so the camera finds no index and reports no images. The photographs themselves are almost certainly still occupying the card — an index is a small thing, and its loss does not touch the large area holding the pictures.

Why the card is usually the stronger route: a camera card is written once and read many times. After the loss she stopped using it, so nothing has overwritten anything — and raw photographs are large, contiguous and carry recognisable openings, which makes them among the most reliably recoverable content there is.

Why raw files specifically help: they are far bigger than compressed images and occupy long continuous runs. Large sequential files survive partial damage better and reassemble more reliably than many small scattered ones, so six hundred raw frames is a favourable target.

What happened on the computer: emptying the bin removed the directory entries and released the space. The image data was not erased at that moment — it remains where it was written until something else is written over it.

Why the computer route is the less predictable one: a computer writes constantly. Every hour of ordinary use — updates, temporary files, browsing, new documents — is written into space marked as free, and space released by an emptied bin is exactly the space the system reaches for first.

What decides it: how much the computer has been used since. Days of normal use may have displaced a great deal; a machine barely touched since may hold nearly all of it — and that is established by examining the free space rather than guessed at.

Why having both is genuinely valuable: the two failures are unrelated, so what is unrecoverable by one route may be intact by the other. Where a photograph is partially overwritten on the computer, the card may hold it whole, and any frames the card cannot yield may survive on the machine.

What should happen in what order: both are assessed before either is committed to, and the card is imaged first because it is stable and unchanging. The computer is the one where delay costs something, so it should come out of use now if the images matter.

What must not happen: no putting the card back in the camera to check, no formatting when a device offers to repair it, and as little use of the computer as possible. Every photograph taken on that card, and every hour on that machine, writes into the space holding what she wants back.

On the bench

Both routes were assessed independently before either was pursued — card index loss leaving image data in place and carving favourably given large contiguous raw files with recognisable openings and no subsequent writing, whereas host deletion releases space that ordinary system activity reaches for first, making prospects there a function of use since. Card and host were imaged write-blocked separately, with signature carving targeted to raw image structures and results validated by opening at full resolution.

The outcome

Both routes assessed independently, card and host imaged separately, and carving targeted to raw image structures. Free assessment, one fixed written figure including VAT; on cards where content has been deleted or overwritten, the figure is payable upfront. The decode: losing them twice gives you two chances. The card is usually the stronger route — raw files are large and contiguous, and nothing has been written since — while the computer's prospects depend entirely on how much it has been used since the bin was emptied.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.