Data Recovery Case File · Formatted & Logical Faults · Ask IT First

Encryption Begun on a Card and Not Finished

His enquiry describes a sequence that leaves a card looking broken when it is not. Footage that will not read: "I've tried to get the footage onto my work laptop and set up device encryption, but I don't think I fully set it up in the afternoon. I've tried to look at the footage this evening and it's not showing any." The card is almost certainly fine and the footage almost certainly intact. What has changed is that the card is now protected — and because this happened on a work machine, the thing that unlocks it very likely belongs to his employer rather than to him. That makes the first call an internal one.

The decode: what half-encrypted means, and who holds the key

What enabling encryption on removable media does: it writes a protective header, creates the ways the volume can be unlocked, and then converts the contents progressively in the background. On a card holding a lot of video that conversion takes a long time. Interrupt it — by unplugging the card, closing the laptop, or simply walking away — and the result is a volume that is protected and only partly converted. The host can no longer interpret it, so it presents nothing, which looks exactly like a card that has lost its contents.

Why the footage is still there: an incomplete conversion does not destroy anything. Part of the card is encrypted, part is not, and all of it is intact behind a header that the system will not read without the key. This is a locked door rather than an empty room.

Now the part that decides everything, and it is not technical. On a managed work laptop, encryption is usually configured by the organisation, and the recovery key is escrowed automatically to the employer's directory or device-management system when the volume is enrolled. It is filed against the device or the volume identifier. So the key almost certainly exists, is retrievable within minutes by whoever administers those systems, and is not something he ever saw. The first call is internal IT, not a recovery firm — and it is likely to be a five-minute conversation rather than a job.

What to give them: the volume identifier if the machine will show it, the approximate date and time the encryption was started, and the laptop's asset or device name. Keys are listed against those, and a card enrolled that afternoon will be near the top of the list.

What must not happen meanwhile: not accepting any prompt to format the card, which is what the system will offer for a volume it cannot interpret. Not attempting to complete the encryption, since a second interruption compounds the state. And not trying to reverse it without the key, which is not possible in any case.

Why the work context cuts both ways: the key is likely to exist, which is good. But the footage is on a corporate-managed volume, so whatever happens next should go through the organisation rather than around it — including any decision to send the card anywhere.

On the bench

The card was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb before any attempt, so that every subsequent step happened against a copy and the original state was preserved. The encryption state and conversion extent were established — determining how far the conversion had progressed, which governs what a valid key will return. No format or repair was attempted, since the system's offer to format a volume it cannot interpret is the one action that would make the loss permanent. Decryption was performed against the image on production of a valid key.

The outcome

The card imaged and its state preserved, the conversion extent established and the contents decrypted against the image once a key was produced. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone who started encrypting removable media and stopped: your footage is intact behind a protective header rather than gone — enabling encryption writes that header first and converts the contents gradually, so an interruption leaves a volume that is protected and only partly converted. And if it happened on a managed work laptop, the recovery key was almost certainly escrowed to your employer's systems automatically. Ask internal IT before anything else, and refuse every prompt to format.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.