Data Recovery Case File · Formatted & Logical Faults · A Database, Not a Folder

Recovering a Backup Is Not the Same as Recovering Photographs

His enquiry named exactly what he wants, and the way he named it is worth examining. A laptop drive that "failed many years ago with many such things on it that I would like to attempt to recover — specifically my phone backup. I am specifically interested in the photos and videos within this backup." That is a precise request and it contains a hidden assumption. A phone backup is not a folder of photographs. It is a database and several thousand files with names that mean nothing, and asking for "the photos" from inside one can produce a technically successful recovery that returns nothing he can use.

The decode: what a backup actually looks like, and what to ask for

How a phone backup is stored: not as recognisable pictures. It consists of a manifest database plus a large number of payload files whose names are long strings of characters with no extensions, distributed across folders named after the first characters of those strings. A photograph in the backup is one of those anonymous files. The database is the only thing that records which anonymous file was which photograph, when it was taken and where it belonged.

Why that matters enormously for a recovery: if the manifest is recovered intact, the backup can be opened normally and the photographs extracted with names, dates and albums. If the manifest is missing or damaged, what comes back is thousands of unnamed files — which still contain the images, but with nothing describing them.

Why that is still recoverable, and this is the reassuring part: image and video files carry their own internal signatures regardless of what they are called. So even a backup whose database is gone yields the photographs by carving them directly out of the payload files, identified by their own structure. They come back without filenames, album grouping or reliable dates — organised by type rather than by memory — which is a real result and not the same as a clean extraction.

What to ask for, and it changes the outcome: not "the photos" but the backup directory, whole, as a single object — every payload file and the manifest together. A recovery scoped to "photographs" on a drive like this can quite reasonably skip a folder of extensionless files that look like nothing, and skip the database along with it. Naming the backup folder as the deliverable is the difference.

The other thing worth mentioning: the drive failed years ago and has been stored since. That is worth stating up front, because prolonged dormancy produces its own faults — lubricant thickens, heads resting on a surface can adhere — independently of whatever caused the original failure. A drive that has sat for years is inspected before it is powered rather than tested.

What else is probably on there: worth a thought before deciding scope. Backups of that kind also contain messages, contacts, notes and call history, which people rarely think to ask for and frequently want later.

On the bench

The backup was treated as a single structured object rather than a file selection, since it consists of a manifest database and thousands of extensionless payload files, and a recovery scoped to photographs can reasonably skip both. The drive was imaged write-blocked with the backup directory prioritised whole. The manifest database was validated before extraction — since it alone maps anonymous payload files to named photographs — and where it proved incomplete, media was carved directly from the payload files by internal signature.

The outcome

The backup recovered as a complete structured object, its manifest validated and the media extracted with names and dates where the index allowed. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose photographs are inside a phone backup: ask for the backup folder whole rather than for the photographs. A backup is a manifest database plus thousands of files with meaningless names, and the database is the only thing recording which is which — recovered intact, you get named photographs with dates and albums; without it, you get the images by carving, but unnamed and ungrouped.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.