Data Recovery Case File · Cameras, Drones & Cards · Right Name, Wrong Blocks

Every Filename Intact, Every File Broken

Her enquiry asks a precise question and deserves a precise answer. After recovering from a quick format: "why is it that after I recovered my data, they are all corrupted and damaged but the name of the file still exists? I tried professional repair tools but they couldn't help. For example, photos: no preview supported or damaged. Videos: no preview supported or damaged." That combination is not bad luck and it is not a damaged card. Names surviving while contents fail describes exactly how the recovery was done — and it points at a different approach that returns working files without their names.

The decode: why names survive, and what the tool did with them

Why the names came back: a quick format writes a fresh empty index, but the previous index entries frequently survive in the space beyond it — small records giving a filename, a date, a size and a starting position. Recovery software finds those records and uses them, which is why the output looks so promising: correct names, plausible sizes, everything apparently in order.

Why the contents did not: the record says where a file started. It does not guarantee that the file is still there, that it was stored in one continuous run, or that the space has not since been used for something else. So the tool goes to the stated position, reads the stated length, and writes out whatever it finds — which may be the right file, may be part of it followed by something unrelated, or may be entirely different data. A file with the correct name and the wrong contents is exactly what that produces.

Why photographs and video fail this way specifically: both are large and both must be read in order. A photograph whose first portion is correct and whose remainder is not will fail to preview, because the decoder reaches contents that make no sense. Video is worse, since a container that does not match its index is unplayable from the start. Small documents survive this treatment more often, simply because they fit in one place.

Why repair tools cannot help: and this is worth being clear about, because she has already spent effort on them. A repair application assumes a damaged version of the right file and tries to salvage it. What she has is not a damaged file — it is a correct name wrapped around the wrong data. There is nothing to repair, because the content was never hers. That is why every tool failed identically.

What works instead, and the trade-off it forces: ignoring the index entirely and finding files by their own internal structure. Photographs and video carry distinctive headers, so they can be identified and extracted wherever they physically sit, and validated by actually rendering them. Those files come back working and unnamed — organised by type and date rather than by folder or original filename. So the choice this case forces is a real one: correct names with broken files, or working files without their names. Almost everybody, once they understand it, chooses the second.

What to stop: writing anything further to the card, and running more repair applications on the output.

On the bench

The card was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb. Surviving index remnants were tested against actual content rather than trusted — since an entry gives a name, a size and a starting position but no guarantee that the file is still there or was stored in one run, which is precisely what produces correctly named unusable output. Signature carving then ran independently of any index, identifying files by their own internal structure, and everything was validated by opening rather than by listing.

The outcome

The index remnants tested rather than trusted, files carved by signature and validated by opening. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront. The decode, for anyone whose recovery returned names and not files: the two come from different places. Surviving index entries give a name, a size and a starting position, and software uses them — but they do not guarantee the file is still there or was stored continuously, so the tool writes out whatever sits at that position. Repair applications cannot help, because a correct name around the wrong data is not a damaged file. Carving returns working files without their names.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.