Data Recovery Case File · Formatted & Logical Faults · Check the Other End First

Files That Did Not Finish Arriving

His enquiry described a fault with an unusually specific cause. A 2TB external drive: "the files have corrupted mid transfer. The disk works fine, but the files — photos, raw and JPEG — although they have size next to them, they don't open. Is this something that can be fixed?" The drive being healthy is the important part, and it changes where to look. If these files were arriving when the transfer stopped, then they are incomplete rather than damaged — and that raises a question worth asking before commissioning anything: where did they come from, and is that source still there? Because the original of an incomplete copy is usually the fastest recovery available.

The decode: the free question, then what an interrupted write leaves

Ask where the photographs came from. A transfer has two ends. If these files were being copied onto this drive from a camera card, another drive or a computer, then the originals were not consumed by the copy — copying reads the source and writes the destination, and nothing removes the source unless a move was chosen deliberately. So the first question is whether the card or the machine they came from still holds them, because if it does, this is solved by copying again rather than by any recovery. That check is free and it very often ends the matter. The exception is where the transfer was a move, or where the source has since been formatted or reused.

What an interrupted write actually produces: not corruption in the usual sense. When a file is copied, the filesystem typically records the intended size first and then fills the content. Interrupt that and you get a directory entry claiming the full size with only part of the data behind it — which is exactly what he describes: they have size next to them, they don't open. The file is not damaged, it is unfinished. That distinction matters because there is nothing to repair; there is simply content that never arrived.

Why photographs behave the way they do here: image files are read from the beginning, and a truncated one may open partially — showing the top portion of the picture and grey or noise below — or refuse entirely depending on how much arrived and where the format keeps its structural information. Camera raw files are less forgiving than JPEGs, because their structure and metadata are arranged differently and a partial file often has no usable header at all. So a mixed folder may show a mixture of results, which tells you roughly how far the transfer got.

What can genuinely be done with the partial files: where a source no longer exists, the arrived portions are real data and worth salvaging. Files can be assessed for how complete they are, and partial images rebuilt to display what did arrive — which for a photograph is often most of the frame. That is a real outcome, though a lesser one than recovering the originals.

The thing to avoid: deleting the partial files to "start again" before establishing where the source stands, and running repair tools against a healthy drive. The drive is fine; the files are incomplete, and no disk repair changes that.

On the bench

The source status was established before anything else, since copying reads rather than consumes, and originals that still exist beat any recovery. Where the source was gone, the destination was imaged write-blocked and the partial files assessed for how much had actually arrived — the directory entries claiming full sizes while the content behind them was truncated. The arrived portions were then rebuilt into displayable images where the formats allowed, and every result validated by rendering rather than by checking that a file existed.

The outcome

The source checked first, the partial files assessed for completeness and the arrived content rebuilt and validated. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose transfer was interrupted: check the other end first, because copying reads the source rather than consuming it, so the originals usually still exist on the card or machine they came from and the answer is simply to copy again; what you have at the destination is not corruption but incompleteness — the filesystem recorded the intended size and the content never finished arriving, which is why the files show a plausible size and will not open; and raw files fare worse than JPEGs, so a mixed result tells you how far the transfer got.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.