Data Recovery Case File · Cameras, Drones & Cards · Ask What They Did

It Came Back From Someone Else's Machine

Her enquiry described a chain of custody in one sentence and the fault appeared at the handover. "I used my SD card in my camera and then lent the card to a friend to download some videos from his computer onto the card. Now my computer says SD card not readable. I really hope to retrieve all my holiday photos and videos." The sequence is the diagnosis: it worked in her camera, it went to another machine, and it came back broken. Before anything technical, there is one thing worth doing that costs nothing and frequently explains the whole thing — ask the friend exactly what happened on his computer, because he may know something she cannot possibly work out from her end.

The decode: the questions to ask, and what each answer means

Why asking is worth more than guessing: the useful information is on the other machine and only one person has it. Four questions cover almost all of it, and none is accusatory. Did anything ask to format or prepare the card? If a prompt was accepted, that is the answer and it changes the approach. Was it pulled out while the transfer was running, or without ejecting? That is the commonest cause by a distance. Did his computer say anything about the card before he used it? Some machines report a problem and offer to fix it, and people click through. And what kind of computer was it? — because a machine expecting a different filesystem behaves differently with a camera-formatted card.

Why unsafe removal is the leading suspect: writing to a card is not instantaneous. Operating systems hold recent changes in memory and commit them in batches, and ejecting is the instruction to flush everything still held and close the filing structure cleanly. Remove the card before that completes — which people do constantly, because the copy dialogue has disappeared and it looks finished — and the structure is left mid-update. That produces exactly what she describes: a card that worked, was written to, and came back unreadable.

Why her photographs are almost certainly fine: nothing in that sequence erases anything. Interrupted writes damage the small records describing where files live; the photographs and video are large, contiguous and untouched. Reconstruction on an image rebuilds those records and the volume typically returns with its folder tree, filenames and dates intact.

The exception worth ruling out: if the friend's machine did format the card to write to it — which happens when a computer cannot make sense of the camera's layout and the user accepts the offer — then the position is different but still workable: a quick format clears the index and leaves the content, so carving recovers the material without filenames.

What she should do now: stop putting the card in anything, including her camera, which will eventually offer to format it. And the practical lesson for next time: lend a copy rather than the card. Cards are cheap; a holiday is not.

On the bench

The events on the third-party machine were established where possible, since a format accepted there and an unsafe removal call for different approaches and only one person could say which had happened. The card was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, and on the image the partition and filesystem structures were reconstructed — the half-written directory and allocation records resolved and any incomplete transaction unwound — until the volume mounted from the copy with its folder tree intact. Format-aware carving swept alongside, and everything was validated by rendering and playback.

The outcome

The events on the other machine established, the structures rebuilt from a write-blocked image and the holiday material validated and delivered. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone whose card came back broken from somebody else's computer: ask them four things before anything technical — whether anything offered to format or prepare the card, whether it was pulled out without ejecting or while a transfer ran, whether the computer reported a problem beforehand, and what kind of machine it was; unsafe removal is by far the likeliest, because writing is batched and ejecting is what flushes it. Your photographs are almost certainly intact behind damaged records. And lend a copy next time.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.