Data Recovery Case File · Cameras, Drones & Cards · The Shape of the Gap

A Missing Band, With Both Ends Intact

Her enquiry describes a loss with a shape, and the shape is the diagnosis. A card holding over six thousand photographs where "the middle section of 2,000 photos has disappeared and my daughter is distraught. We don't know exactly what happened but it may have occurred when she tried to transfer pics on to a phone. The recent ones are there, the oldest are there, but the" middle is not. Failing storage does not produce a tidy contiguous band — it produces scattered losses. A clean block with healthy material on both sides is the signature of an operation that acted on a selection, and that changes both the explanation and the outlook.

The decode: why the shape matters, and what probably happened

What a hardware fault looks like, for contrast: damage to memory or to a card's management tables produces losses that are scattered — a file here, a run of files there, images that half-render, gaps that do not correspond to anything meaningful about when the photographs were taken. It does not respect chronology, because the order files were written in has little to do with which cells fail.

Why a contiguous chronological band points elsewhere: photographs sit on a card broadly in the order they were taken. So a missing block that begins at one date and ends at another, with intact material on both sides, describes something that selected a range — which is what a person or an application does, not what a failure does. Her guess about the transfer is very likely correct.

The mechanism, and it is common: phone import functions frequently offer to remove imported items from the card afterwards, and some do it by default. If the import ran on a subset — a date range, a selection, or simply as much as fitted before it failed or was interrupted — the deletion can be applied to that subset while the rest is untouched. The result is precisely this: a band gone, both ends intact, and nobody quite sure what they agreed to.

Why the outlook is good, with one caveat: deletion of that kind removes index entries and marks space as available. It does not erase the images, which remain physically present until something writes over them. So two thousand photographs are very probably still on that card.

The caveat, and it is the urgent part: she says her daughter took more pictures on the card before realising. Every one of those was written into space the card considered free — which is precisely the space the missing band occupies. That is what limits the result, and it is the only thing that does. The card must come out of the camera now, and nothing further should be written to it, because each additional photograph is taken at the direct expense of the missing ones.

What is worth checking first, free: the phone. If the import partly succeeded, some or all of those two thousand may be sitting in the phone's gallery, in its cloud account, or in the service's trash — and that is a far better route than recovery.

On the bench

The card was removed from use immediately, since photographs taken after the loss are written into precisely the space the missing band occupies. It was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, and the extent of subsequent writes was measured against the missing range — establishing how much of the affected region had already been reused, which is the single figure determining what can be expected. Index remnants were reconstructed to return original filenames and dates where possible, with signature carving across the unallocated regions alongside. Images were validated by rendering.

The outcome

The subsequent-write extent measured against the missing range, the index reconstructed and the unallocated regions carved. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront. The decode, for anyone missing a contiguous band: the shape names the cause. Hardware faults scatter their losses and ignore chronology, so a clean block with intact material on both sides describes an operation that acted on a selection — most often a phone import offering to remove items from the card afterwards. That means the images were deleted rather than destroyed, and are still there until overwritten. Stop using the card, and check the phone first.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.