Data Recovery Case File · Case 1200 · How to Tell a Real Answer

One Word in Her Message Explains Everything

She opens by assuming the worst, which after what she has been told is reasonable. "To be honest with you I don't think I have any chance, but I deleted my photos by accident — no backup, no card, just gone. My son got a few back from the do-it-yourselves but blurry. Sent it to a firm, could get nothing back, but said about chip-off and that would get them all back. All a 1,000 memories gone. Can you help, or are they truly gone?" Three people, three answers: a few, blurry. Nothing. All of them. She cannot tell which is true, and that — not the photographs — is the problem this case is about. But there is one word in her message that is hard evidence, and it settles more than everything else she has been told.

The decode: what blurry means, and why it is the most useful word in the message

Here is the mechanism, and it is genuinely under-explained. Every photograph a phone takes contains, inside the file itself, a small low-resolution preview — a thumbnail embedded in the image so that galleries can display a grid without decoding thousands of full-size pictures. Separately, the phone maintains its own thumbnail cache, a database of small copies of everything it has ever displayed.

Why that matters for a recovery: thumbnails are tiny, stored contiguously, and live in a database that is written once and rarely moved. Full photographs are large, frequently split across the storage, and occupy far more space. When space is reused after a deletion, the big files go first and the small cached previews survive. So when consumer software recovers photographs from a phone and they come back small and blurry, what it has almost always found is the previews — not the photographs.

Which means her son's result is not a partial success. It is a specific and checkable finding: the full images were no longer assemblable, and what came back was the cache. She can confirm this herself in a minute — the recovered files will be a few hundred pixels across and a few tens of kilobytes each, where a phone photograph is several thousand pixels and several megabytes. Blurry is not damage. It is the wrong file.

What that tells us about her actual position, honestly: that the originals were gone by the time he looked. On a modern handset that is expected rather than surprising — internal storage is encrypted, and the controller clears space marked as free during its own background housekeeping, within minutes and without anything being plugged in. Continued use of the phone finishes the job.

Now the third answer, and it is the one that needs examining. She was told that chip-off — removing the memory and reading it directly — would get them all back. On a modern phone that cannot be true as a general statement, because the storage is encrypted with a key held in a security element on the board. Memory read away from that board returns ciphertext. Whoever said it may have meant something narrower, or been thinking of a card, or spoken loosely. But as she received it, it was not a mechanism. It was a hope with a technical word attached, and it is the answer she has been carrying because it was the most encouraging.

The doctrine of case 1200: an answer you can act on names a mechanism

Look at what she was actually given. Nothing came back — which explains no mechanism and cannot be checked. Chip-off would get them all — which names a technique without explaining how it would work on her device, and cannot be checked either. Both are unfalsifiable, and a person with a thousand photographs at stake has no way to weigh one against the other. So she is left choosing between answers on the basis of who sounded most confident, which is the worst possible basis and the only one available to her.

Against that, consider the blurry files. That single word supports an explanation that names a specific mechanism — cached previews survive where full images do not — makes a prediction she can test in sixty seconds by looking at the dimensions, and would be disproved if the recovered files turned out to be full size. It is checkable. And being checkable is what makes it worth something.

Which is the whole doctrine, and it is the one this archive has been building toward. The test of an answer is not how confident it sounds. It is whether it names a mechanism you could check. Twelve hundred cases have been spent explaining what a beep is, why a light flashes, what a used-space figure means, why a printer can read what a computer cannot — not to make anybody a technician, but so that when somebody tells you something about your own data you have a way to tell a real answer from a hopeful one.

The three questions that follow from it, which anybody can ask anybody. What mechanism — what specifically is wrong and why does that produce what I am seeing. What evidence — what did you observe that supports it, rather than what do you conclude. And what would change your answer — because a person who can say what would change their mind is describing a finding, and a person who cannot is describing a position.

Why this is case 1200. Most of this archive is addressed to people at the beginning of a problem. She is at the end of one, having been told three incompatible things and having no way to choose between them. The honest answer to her question is probably that they are gone — and the reason that answer is worth more than the encouraging one is that it comes with a mechanism attached, which she can check for herself, and which does not require her to trust anybody. Including us.

On the bench

The recovered files were examined for dimensions and structure before any conclusion was drawn — since images returning at a few hundred pixels and tens of kilobytes are cached previews rather than degraded originals, which is a finding the owner can verify herself rather than a verdict she has to accept. Device use since deletion was established, and storage encryption and controller behaviour confirmed, since freed space on this class of device is cleared during background housekeeping rather than waiting to be overwritten. The position was stated before any charge, and no bypass or chip-level claim was offered.

The outcome

The recovered artefacts identified as cached previews, the position established from evidence the owner could check, and stated plainly at no cost. Free assessment, and no charge where no recovery is possible. The decode, and the doctrine of case 1200: blurry is not damage — it is the wrong file. Phones embed a small preview in every photograph and keep a separate cache of thumbnails, and those are small, contiguous and survive where full images do not, so consumer software recovering blurry pictures has found the cache rather than the photographs. That explanation names a mechanism and makes a prediction you can test by looking at the dimensions. An answer you can act on names a mechanism you could check — and "nothing came back" and "chip-off would get them all" name none. Ask what mechanism, what evidence, and what would change the answer.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.