Data Recovery Case File · Cameras, Drones & Cards · The Space Is Still Used
The Photographs Went and the Space Did Not
Her enquiry contains an observation that answers the question before it is asked. Photographing an event at her school, "I suddenly got an error message from my camera saying that it couldn't reach the memory card. I turned the camera off and back on, and all of the photos I had taken were no longer visible. When I put the memory card into my laptop when I got home, I also couldn't see the photos, but the card was showing as ha"ving space used. Nothing lists and the space is occupied. That combination is one of the most encouraging things anybody can report — because it means the photographs are physically there and only the description of them has gone.
| Media | SD card from a camera — card lost mid-session with the day's photographs no longer listed; card reporting used capacity consistent with the missing content |
| Reported situation | Card in use photographing an event · camera reporting it could not reach the card · camera power-cycled · photographs no longer visible on the camera or on a computer · card reporting used space · event photographs required |
| Fault class | Filesystem index loss following an interrupted write — file content present and accounted for by reported capacity usage |
| Equipment used | No format or repair permitted · imaged write-blocked (DeepSpar USB Stabilizer 10Gb) · index structures reconstructed from surviving copies on the image · signature carving alongside · images validated by rendering |
The decode: why used space is the good sign, and what the power cycle did
What used space actually means: the figure the system reports comes from the card's filesystem accounting — the record of which regions are occupied. If that says several gigabytes are in use while the folder shows nothing, the two halves of the filesystem disagree: the allocation records still know the space is taken, and the directory entries describing what is in it are gone or unreadable. Files that occupy space and appear in no listing are files whose index has been lost, not files that have been deleted — a deletion updates both halves.
Why that is such a strong signal: it distinguishes this from the alarming alternative. A card that reports itself as empty after a failure may have been reformatted or had its accounting reset. A card that still reports the space as used is telling you the content is there and accounted for.
What actually happened during the shoot: the card stopped responding mid-session — most often a contact or controller problem under sustained writing — and the camera reported that it could not reach it. At that moment the camera had almost certainly not finished writing the directory information for the session, since cameras update those structures as they go and complete them when the card is closed or removed cleanly.
What the power cycle did, and it is worth knowing without any blame attached: turning the camera off and on is the obvious response and it is what anybody would do. On restart the camera read the card, found filing structures it could not reconcile, and displayed what it could — which was nothing. It did not delete anything. But it is worth knowing that a card which has just thrown an error is best removed rather than re-read, because the next thing a camera may offer is a format.
Why the laptop showed the same: confirmation rather than a second problem. The index is damaged, so no host can list the contents, and every host reports the same used space for the same reason.
What must not happen: no format, no repair utility, and nothing further written. Both the camera and the computer will offer to fix or format the card, and both offers replace the very structures that a rebuild works from. Filesystems keep backup copies of their key structures at known positions, which is what usually allows the photographs to come back with their original names and sequence intact.
On the bench
No format or repair was permitted, since both the camera and the computer offer one and each replaces the structures a rebuild works from. The card was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, and index structures reconstructed from their surviving backup copies on the image — which is what returns photographs with original filenames and shooting sequence rather than as an unordered set. Signature carving ran alongside for anything the structures could not account for, and images were validated by rendering.
The outcome
The card imaged write-blocked, the index rebuilt from its surviving copies and every image validated by rendering. Free assessment, one fixed written figure including VAT; where a chip has to be removed, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose card lists nothing but reports space used: that is the best sign available. The used figure comes from the filesystem's allocation records, so space occupied with nothing listed means the records know the content is there while the entries describing it have gone. A deletion updates both. Refuse every offer to format or repair.
Card showing nothing but reporting space used
Refuse every offer to format or repair it, from the camera and the computer both — and take real encouragement from what you're seeing. The used-space figure comes from the card's own allocation records, which track which regions are occupied. If those say gigabytes are in use while the folder shows nothing, the two halves of the filesystem disagree: the space is still accounted for and the entries describing what's in it have been lost. A deletion would have updated both. So your photographs are physically present and only their index has gone, which is the recoverable situation. There's usually a backup copy of those structures elsewhere on the card, which is what lets images come back with their original names and sequence. Stop writing anything to it.
Don't format it — call Newcastle Data Recovery on 0191 406 1051; imaged write-blocked, index rebuilt from its surviving backup copies, images validated by rendering.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.