Home / Case Studies / The Scan Could See It. The Card Could Not
Flash, Sticks and Cards · case file

The Scan Could See It. The Card Could Not

A food producer near Melton Mowbray keeps a camera over the packing line, and one morning it recorded a jam that a supplier later disputed. The card came out with exactly one video on it, and by the afternoon the machine reported it as corrupted. Free software found the clip, listed it, and then failed at the point of saving it out. The claim depended on that one file, so they stopped and asked.

Memory CardCamera / DroneCorruption / Filesystem
// the job in four lines
MediaAn SD card holding a single video file from a line camera, reported as corrupted, with the clip still visible to recovery software but not retrievable by it.
What was reportedSD card, corrupted after recording, one video on it, the file shows in a recovery scan but will not save out, the clip needed as evidence for a supplier claim.
Fault classLogical. The card's memory and controller were both answering normally. What had broken was the small structure at the front that lists what is on the card and where each part of it sits, which is why a scan reading the raw memory could see the clip while the operating system saw an unusable volume.
On the benchHeld behind a hardware write blocker throughout so no repair, format or recovery tool could write to it, imaged read-only through a controlled reader in a single pass, the surviving directory records parsed in R-Studio from the image, the clip rebuilt from its allocation chain where that chain held and carved by content signature where it did not, and the result played from beginning to end before being written to fresh media.
// reading the fault

Reading the fault

A scan that finds something is reading past the damage, not repairing it. Those tools work by sweeping the raw memory for the patterns that mark the start of a known file type. They can therefore see a clip whose index entry has gone, which is genuinely useful information: it means the recording is physically present in the memory cells and has not been erased or overwritten.

Seeing it and saving it are separated by one number: the length. An index entry says where a file begins, how long it is and which blocks it occupies. Without it, a tool has to estimate the end, and video is the format where estimating goes wrong most often, because a long recording is broken across the card in whatever order space came free. The scan was not lying; it simply did not know where to stop.

The dangerous instruction is the helpful-looking one. Almost every consumer tool offers to write its results somewhere, and the default somewhere is often the card itself. On a card with a damaged index, writing anything is how a recoverable clip becomes a genuinely lost one, because the new data lands in blocks the old recording still occupies. Formatting it, which the camera will suggest, does the same job faster.

Cards fail this way for undramatic reasons. Power interrupted during a write, a card pulled while the camera was still finishing, or simply a cheap card at the end of its endurance. None of those harm the recorded frames. They damage the bookkeeping, and bookkeeping is reconstructable from a copy in a way that a physically worn cell is not.

// bench work

Bench work

The card was write-blocked before it met any operating system, which removed every remaining way for it to be modified. It read at full speed through a controlled reader with no unstable regions, and a complete image was taken in one pass. The card itself then went in a drawer and played no further part.

R-Studio parsed what remained of the directory from the image and found the file record damaged but not gone: the start and part of the chain survived, and the rest was resolved by following the recording forward through the image and confirming each block belonged to the same stream. The rebuilt clip was played end to end at full length, with the timestamp region checked against the date the line stopped, before it was written to fresh media.

// what went back

What went back

The whole recording came back, including the two minutes on either side of the jam that mattered to the claim. A second copy went out in a format their insurer could open without special software, since a recovered file that nobody can play is not much of a result.

Cards and sticks are £250 + VAT. This was logical from start to finish, with nothing opened and nothing lifted off a circuit, so it ran under no fix, no fee and was billed only after the footage had been watched.

When recovery software can see the file but not save it

Take that as good news and then stop. The file being visible means the data is sitting in the memory, which is the hard part; getting it out whole is a question of method rather than luck. Do not let any tool write its output to the card it is reading, do not reformat it because the camera asks, and do not put it back in the camera to test whether it has come right. If the card is the only copy of something that matters, the cheapest thing you can do is nothing at all until it is imaged. Post it in a small rigid case rather than loose in an envelope, since a card that arrives cracked is a much longer job than a card that arrives corrupted.

Is this your drive as well? Every file on this page began with somebody describing a noise or a message, and the route in is the same each time. Nothing is charged for finding out what has happened. That examination finishes two working days after the parcel is logged in — never sooner, because rushing it is how evidence gets destroyed — and it ends in one number, written down, which does not move afterwards. Where a single drive is recoverable it is generally back with you two to four working days later. How you pay turns on which kind of fault it is, and the wording does not vary across this network: no fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. So a deletion, a broken file system, a lost partition, a firmware or service-area repair all keep the guarantee — nothing comes back, nothing is owed. Opening a drive under laminar flow, rebuilding a board, lifting a memory chip, or anything that arrived wet or burnt does not: half the agreed figure is taken before the work, and the balance only if your files come home. The published figures run: £250 + VAT for a memory card, a USB stick or a pen drive; £300 + VAT for any one hard drive or SSD, NVMe included; £400 + VAT for a recorder disk or a BitLocker volume; from £500 + VAT for an array, a NAS or a server; and £800 + VAT for a forensic investigation that ends in a written report. Five bands, all of them public, and the only one outside the guarantee is the forensic work. On packing: if the storage is screwed inside a laptop, a tower, a Mac or a server, take it out and send the bare unit, because dismantling equipment is not work this bench does. Three things go the other way and travel complete — an external drive in its own case, a NAS, and a WD My Passport or My Book with its cable, since on those the key sits on the bridge rather than the disk. A Fusion Mac needs both of its drives, labelled. A RAID or a server sends its member disks only, numbered by bay, with the front of the chassis photographed first. Flash soldered onto a mainboard, as on Apple Silicon Macs and many thin laptops, cannot be taken in at all, and neither can phones or tablets. Post it tracked and insured to Cambridge Data Recovery, Compass House, Vision Park, Chivers Way, Cambridge CB24 9AD, or put your own courier on it; the Cambridge reception takes devices across the counter too, Mon–Fri 9:00am–5:30pm. Nothing is collected, and there is no shopfront in the county to call at. Freephone 0800 689 0668. Packing notes and the shipping form live here.
Start a free diagnostic

Each of these is a real enquiry, taken from a household or a business somewhere in Leicester or the surrounding county, with the name of the customer, the firm and anything else that would identify them taken out. What is left is the reasoning: what turned up, what had actually failed inside it, the method that fault required and the equipment it was worked on. One of the thirty-six is a job that was refused, and it belongs here every bit as much as the successes do.

// nearby on the shelf

Three more files along the same lines

See every case file →

Is this your drive as well?

Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.