Data Recovery Case File · Memory Cards · The Shallow Carve

Files found, holiday missing: what it means when recovery software surfaces only test and configuration files — and the trip's footage recovered beneath them

His self-recovery had produced the genre's most confusing partial result. The setup: an action camera with a Lexar 256GB card, used "for taking film and video whilst away" — until the card filled and, "by mistake, was formatted using the [camera]." His attempts with a couple of recovery applications found data — "I can see that there are some files on there, but they are just test files rather than the pictures and movies that were taken from abroad." His scope was refreshingly precise: no interest in "the small configuration and test files, only genuine holiday snaps" — none of which his tools could surface. The result reads like the holiday is gone. It almost never means that — it means the tools found the shallow layer and stopped, and the trip was always in the deep one.

The decode: why the tools found housekeeping and missed the holiday

What the format did (and didn't): an in-camera quick format erased the card's index, not its contents — the trip's photos and footage stayed physically present the moment it finished, as this archive establishes across the whole formatted-card genre. What his tools then found, and why it was only the boring layer: consumer recovery works largely by signature carving — scanning for recognisable file headers and reading forward — and that method's easy wins are exactly what he got: small, contiguous, simply-structured files. A camera's own housekeeping — configuration files, test stubs, firmware leftovers — is precisely that: tiny, unfragmented, written once, trivially carveable. The holiday is the opposite cargo: an action camera writes large, high-bitrate video in fragments scattered per the card's allocation — and near the end of a trip on a card that filled up, fragmentation is at its lifetime maximum, with recordings threaded through whatever gaps remained. A fragment-blind carver meeting that layout either produces broken unplayable stitches (this batch's wedding-card case) or — his version — fails to assemble the big files at all and reports only the shallow layer it could handle. So "only test files" is not an inventory of what survived; it's an inventory of what the method could reach — and the deep layer, the actual trip, waits for filesystem-trace mapping and fragment-aware reassembly. His discipline after the tools — no re-recording, no further formats, straight to enquiry with the scope stated — kept that deep layer exactly as recoverable as the format left it.

The recovery — the deep layer, delivered to scope

The card was imaged once, write-blocked at chip level, and the deep work ran on the copy: the original filesystem's surviving traces used to map fragment order, the trip's recordings reassembled clip by clip and the photographs recovered alongside, every rebuilt video verified by playback and the stills by opening — the standard that separates recovered from merely found. Delivery honoured his scope to the letter: the genuine holiday — the photos and films from abroad — organised and delivered on new media in duplicate, with the housekeeping layer his tools had so thoroughly discovered left exactly where it belonged: out of the deliverable. The honest ledger noted the format's bounded cost (the card's post-format use had been nil, so losses were minimal and itemised), and the report closed with the two-line doctrine his result teaches: what consumer tools surface is a statement about the tools' depth, not the data's survival — and a formatted card that yields "only the wrong files" has usually just been asked too shallowly.

Outcome

The holiday home and playing, the confusing partial result decoded — and the filings for everyone staring at a recovery app's list of files they never wanted. Read "only test/config files" correctly: the shallow layer carving easily while the footage doesn't is the signature of fragmentation meeting a fragment-blind method — evidence of depth, not loss. Stop after the tools disappoint: every further app pass, format prompt or recording session risks the deep layer the next method needs. State your scope like he did: "only the genuine holiday" shapes both the work and the deliverable — nobody needs their camera's firmware stubs returned in triplicate. The tools found what was easy. The bench found what was his. The difference was never whether the trip survived — only how deep anyone was willing to look for it.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.