Data Recovery Case File · Cameras, Drones & Cards · Fragmentation Is the Problem

Why Carving Finds Video and Cannot Rebuild It

His enquiry was the most technically precise in this tranche and identified exactly where the difficulty lies. An SD card from a professional camera "that was accidentally formatted. It contains video files that I need back — I'm able to see the data with some tools but not able to reconstruct the MP4 / MOV files. The card was immediately ejected from the camera and hasn't been used." Everything he did afterwards was right, and his footage is almost certainly present. The obstacle he has hit is real and specific, and it is the reason consumer tools produce files of plausible size that refuse to play: finding where a video begins is easy, and knowing where it continues is the hard part — and the format erased precisely the record that answered it.

The decode: why the start is findable and the rest is not

What the format actually removed: a quick format writes a fresh empty index and marks the space available — it does not erase content, which is why his footage is still there and why tools can see it. But the index it replaced contained the allocation map: the record describing, for every file, which parts of the card it occupies and in what order. That map is the only thing that ever knew a file's layout, and it is gone.

Why that matters more for video than anything else: carving works by recognising the distinctive bytes at the start of a file. For a photograph that is usually enough — images are small and almost always written in one continuous run, so reading forward from the start gets the whole file. Video is different. Clips are enormous, they are written over minutes rather than milliseconds, and on a card that has been used before they are frequently fragmented — split into pieces scattered across whatever free space existed at the time. Carving finds the beginning of a clip and then reads straight ahead into whatever happens to be next, which is often the middle of a different file. The result is a file of plausible length that will not play.

Why the containers make it worse and better: modern camera formats keep their index — the map of frames and timing — in a specific place within the file, and a clip assembled from the wrong pieces has an index that does not describe its own contents. That is why the failure is total rather than partial. But those same containers are also the way in: their internal structure is highly regular, with frame boundaries, sequence markers and continuous timecode, so a fragment can be tested for whether it genuinely belongs to a given clip rather than guessed at.

How it is actually reconstructed: two things consumer tools do not do. First, any residual allocation structures that survived the format are recovered and used, because filesystems keep backup copies and a partial map is worth far more than none. Second, where no map survives, fragments are reassembled by following the video container's own internal continuity — matching frame boundaries and timecode across candidate pieces until the sequence is coherent, then rebuilding the index around the assembled stream so the clip plays.

Why his handling was ideal: he ejected immediately and has not used the card. Everything still recoverable sits in space the camera considers free, and a single further recording would land in it. That restraint is why this is a reconstruction problem rather than an overwriting one.

On the bench

The card was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, freezing the position his restraint had preserved. Residual allocation structures were recovered first from the filesystem's surviving backup copies, since even a partial map resolves fragmentation directly and is worth more than any inference. Where no map survived, fragments were reassembled by following the container's own continuity — frame boundaries, sequence markers and timecode tested across candidates rather than assumed — and the index rebuilt around each assembled stream. Every clip was validated by playing it end to end rather than by checking its size.

The outcome

The footage reassembled from residual allocation data and container continuity, with every clip validated by playback. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront. The decode, for anyone whose formatted card yields unplayable video: a quick format leaves your content and removes the allocation map that recorded which parts of the card each file occupied; carving recognises the start of a file, which is enough for photographs because they sit in one continuous run — but video clips are large and often fragmented, so reading straight ahead from the start runs into unrelated data and produces a file of the right size that will not play; reconstruction needs residual allocation structures where they survive, and fragment reassembly following the container's own frame and timecode continuity where they do not.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.