Data Recovery Case File · Formatted & Logical Faults · Check the Source First

Where the Original Media Still Is

This enquiry came from a production and uses the trade's own vocabulary. Footage recorded to a solid-state recorder "has been corrupted during the wrangling process. My producer checked it on two computers, did a basic scan to see if anything was immediately recoverable with a non-invasive recovery programme, but had no joy." Everything they have done so far is sensible. But there is a question that comes before any recovery and it is frequently missed in the panic — because a corrupted copy is only a problem if the original it was copied from has already been cleared.

The decode: the question that comes first, and what went wrong

The first question, and it should be asked before anything else: where is the recorder's own media now, and has it been formatted or reused? If the source card or drive still holds the footage, the corrupted copy is irrelevant — the material simply needs offloading again, properly, and there is no recovery to perform. It is worth checking every recorder, every spare card and every bag before commissioning anything, because on a busy production the source is frequently still sitting somewhere untouched.

Why this gets missed: because the corrupted copy is the thing in front of everyone and the thing that failed. The instinct is to fix what is broken rather than to look for what was never broken.

What wrangling is supposed to include, and this is the process lesson: offloading media on a production is not a file copy. The established practice is copy plus verify — a checksum is calculated for every file on the source, the files are copied, checksums are recalculated on the destination, and the two sets are compared. Only when they match is the transfer considered complete, and only then is the source card cleared. That procedure exists precisely to catch corruption during transfer, which is a known and expected occurrence rather than a freak event. If corruption reached the copy undetected, the verification step either was not run or was not read.

What typically causes it: a transfer interrupted by a disconnected cable or a machine going to sleep, a card removed before writes flushed, a failing card reader, or a destination drive with problems of its own. Large video files transferring over long periods give plenty of opportunity for any of those.

Why the footage is usually recoverable either way: recorder files are large, written contiguously in single passes, and carry distinctive container headers. Where the corruption is structural — a truncated container, a missing index — the container can be rebuilt around the stream data, which is often entirely intact underneath. Where clips were interrupted at recording rather than during transfer, the index will never have been written at all, and that is reconstructed against a reference clip from the same recorder at the same settings.

Why the producer's non-invasive scan finding nothing means little: a general-purpose recovery application looks for a filesystem to reconstruct or performs a generic scan. Professional video containers need format-aware handling, and finding nothing with the wrong tool is not a finding.

On the bench

The source recorder media was located and secured before any work on the copy, since a source that has not been cleared makes the corrupted copy irrelevant and no recovery necessary — which is the cheapest possible outcome and the one most often overlooked. Both media were imaged write-blocked, and the transfer verification history established to determine whether checksums had been calculated and compared. Container structures were rebuilt on the images, with stream data reassembled where indexes were absent, and footage validated by playback.

The outcome

The source media secured first, both media imaged and the containers rebuilt and validated by playback. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose footage corrupted during offload: find the source media before doing anything else, because if it has not been cleared the copy does not matter. Then note the process point — offloading on a production is copy plus verify, with checksums calculated on both sides and compared before any card is cleared, precisely because transfer corruption is expected rather than freak. Recorder files carve well, so the outlook is good either way.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.