Data Recovery Case File · Cameras, Drones & Cards · Allocation Intact, Directory Lost

Space Accounted For, Files Invisible

His enquiry contained an observation that most people would not think to make and that answers half the question. His wife's 32GB microSD card from an Android phone: "the drive is showing as having around 2GB out of 32GB free, so I assume the data is still all there, but when I try to run recovery software myself it shows as there being no files present." The photographs matter a great deal to her. His assumption is correct and well reasoned — a card reporting thirty gigabytes in use is telling you something real about what it holds. But there is one check worth making before anything else, because on an Android phone there is a specific possibility that changes the answer entirely.

The decode: what used space proves, and the Android check that matters

Why his observation is genuinely diagnostic: a filesystem tracks two related things — a directory listing the files, and allocation records marking which parts of the card are in use. A card reporting 30GB used means the allocation records are readable and say that space is occupied. So the card is not empty, its structures are not wholly destroyed, and the content it is accounting for is physically present. He reasoned his way to that and he is right.

Why software finds nothing anyway: because the two structures can fail independently. Allocation intact and directory lost produces exactly this: the card knows the space is used and cannot say what is in it. Consumer recovery software typically reads the directory first, finds nothing usable, and reports no files — many such tools will not fall back to scanning the raw content for file signatures, or will do it badly. So "no files found" describes what the software could parse rather than what the card contains.

Why that combination is the good case: content present, allocation readable, directory lost. Reconstruction rebuilds the directory from the filesystem's own backup structures where they survive — returning folders, filenames and dates — and where they do not, format-aware carving recovers the photographs directly by their internal signatures. Either way the images are there.

The Android check that must come first: and this is the branch that changes everything. Modern Android offers two ways to use a memory card. As portable storage, it is an ordinary card readable in any device — which is the normal case and the recoverable one. As adoptable storage, the card is formatted as an extension of the phone's internal storage and encrypted with a key held in that phone. A card adopted that way is unreadable in any other device by design, and if the phone that adopted it is lost, reset or dead, the contents are unreachable — not difficult, but mathematically closed. So the first question is which mode was used, and if the original phone still works and functions normally, that is the machine to try the card in before anything else.

What not to do: accept any offer to format the card, run further recovery tools at it, or let the phone "repair" it. And if the original phone still works, do not reset it.

On the bench

The card's storage mode was established before anything else, since an adopted card encrypted to a specific handset is a different question entirely and no amount of imaging changes it. With portable storage confirmed, the card was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, and the structures examined in order on the image — allocation records first, confirming his reading, then the directory. The directory was reconstructed from the filesystem's backup copies where they survived, and format-aware carving swept for anything beyond structural repair. Every photograph was validated by rendering.

The outcome

The storage mode confirmed, the directory rebuilt from a write-blocked image and the photographs validated and delivered. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose card reports space used and shows nothing: that is a real and encouraging observation — allocation records and the directory are separate structures, so a card accounting for used space has readable allocation data and physically present contents, with only the listing lost; recovery software reporting no files describes what it could parse rather than what the card holds. But on an Android phone, check one thing first: a card formatted as adoptable storage is encrypted to that specific handset and unreadable anywhere else, so try the original phone before assuming a fault.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.