Data Recovery Case File · Solid State & Flash · Carving Without a Catalogue

Recovery Software Found Strange Files: What They Are

Her enquiry described an experience that leaves people more confused than when they started. A Verbatim USB stick that "keeps asking me to format it even though I have data on there. I tried it in a Windows laptop and a Mac, but it won't work. Yesterday I bought and used recovery software to try and recover the files, but was very confused by what it found — which was a lot of strange files — and I still couldn't open anything." That output is not a malfunction and it is not random. Those strange files are exactly what recovery software produces when it cannot read a filing structure, and understanding what they are explains both why they will not open and what should have been done instead.

The decode: what carving produces, and why it looks like nonsense

The two ways software can recover: the distinction that explains everything. Reconstruction repairs the filing structure — the records naming each file, its size, its dates and its folder — and returns the volume as it was. Carving ignores the structure entirely and scans the raw contents for the internal signatures that mark the start of a document, an image, a video, extracting whatever follows. Consumer tools reach for carving quickly, because it works on anything and requires no understanding of the damage.

Why carving output looks so strange: because without a catalogue there is no way to know what anything is called, where it belonged, or where it ended. So the results contain four kinds of thing, and only one is what she wanted. Her actual files, unnamed and numbered sequentially, sorted into folders by type. Fragments — files that started at a signature and ran into something else, so they exist at the right size and are internally incoherent. Historic material — things deleted months or years ago whose data was never overwritten, surfacing now alongside current files with no way to distinguish them. And system artefacts she has never seen: thumbnail caches, temporary files, previews, index fragments, all of which carry valid signatures and are dutifully extracted. The result is a large, confusing pile in which the real files are outnumbered — which is precisely what she describes.

Why nothing opens: partly the fragments, and partly something more fundamental. When software cannot read the filing structure it also cannot know how long each file is, so it guesses — commonly by carving until the next signature. Files recovered that way are frequently truncated or padded, and a document, image or video with the wrong ending will not open. So the output being unopenable is not evidence that her data is destroyed; it is evidence that the software could not read her structures, which is the actual fault and the thing that needs fixing.

What should happen instead: the stick is imaged write-blocked, and reconstruction is attempted first and thoroughly — repairing the partition and filesystem records so the volume returns with her folders, filenames and dates. Carving becomes the fallback for whatever reconstruction cannot place, and its output is kept separate and labelled rather than merged into the tree. That is the difference between receiving her files and receiving a puzzle.

The good news in her enquiry: two platforms prompting to format means the device enumerates on both — the hardware is working, and the fault is the filing structure. She declined the format, and running recovery software read-only has not written to the stick. Her position is intact.

On the bench

The stick was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb so that everything afterwards happened against a copy. Reconstruction was attempted first and thoroughly on the image — the partition records and filesystem structures repaired until the volume mounted with its folder tree, filenames and dates as she had left them — because on a case like this the difference between a rebuilt tree and a carved pile is the whole deliverable. Carving ran only for what reconstruction could not place, and its output was delivered separately and labelled rather than mixed in. Her files were verified by opening rather than counted.

The outcome

The volume rebuilt from a write-blocked image with folders and filenames intact, and the carved remainder kept separate. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone confused by what recovery software produced: those strange files are what carving looks like without a catalogue — your real files stripped of names and folders, fragments that stop and start in the wrong places, material deleted years ago surfacing alongside current work, and system artefacts you never knew existed; nothing opens because the software could not tell where files ended, so it guessed; and none of that means your data is gone — it means your filing structure could not be read, which is the fault itself. Ask for reconstruction before carving, and for carved output to be kept separate.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.