A primary school in Glenfield uses one camera for the whole year: sports day, the leavers' assembly, the nativity, and the photographs that go into the yearbook. The card came back from the summer term reporting no photographs at all, where there had been over four hundred the previous day. A second reader in the school office gave the same answer. Nobody had deleted anything and nobody had formatted it, which is the version of this that is worth believing.
| Media | An SDHC card from a school camera that reports no photographs, where over four hundred were present the day before. Two separate readers show the same empty result. |
| What was reported | SDHC card, says there are no photographs on it, over four hundred were on it the previous day, the same result in a second card reader, the photographs needed for the yearbook. |
| Fault class | Logical. The structure listing the contents of the card had been lost, so both readers correctly reported an empty volume. The photographs themselves were still written in the memory, untouched, with nothing having overwritten them. |
| On the bench | Held behind a hardware write blocker from the outset, imaged read-only through a controlled reader in one pass, the surviving directory structures parsed from the image in R-Studio, the photographs carved from the image by content signature in PhotoRec where those structures were gone, the dates and camera settings read back from inside each image to restore the original order, and the set previewed and written to fresh media. |
Two readers agreeing is the useful piece of evidence. If one reader shows an empty card and another shows the photographs, the reader is at fault. When both agree, the card is being read correctly and is genuinely presenting nothing, which moves the question from hardware to what the card is being asked to describe.
What a card presents is a list, and the list is small. A few kilobytes at the front of the card describe where every file sits. The four hundred photographs occupied several gigabytes further in and were never touched. Losing the list makes the card look empty in exactly the same way that losing a library catalogue makes a library look empty, and it is repaired in the same way, by going through the shelves.
Photographs are the easiest thing there is to carve. Each image begins with a distinctive marker and ends with another, and the camera writes them one after another as they are taken, so they sit in long unbroken runs. That combination means a carve returns whole images rather than the fragments that make carving unreliable on large documents and video. It is the one file type where the crude method works very well.
What carving loses is the naming, and that is recoverable another way. Files pulled out by signature come back numbered rather than named, which on four hundred photographs would be a real nuisance. Each image carries the date, time and camera settings inside itself, so the original sequence can be rebuilt from the images and the folders put back in shooting order even though the card's own list is gone.
The card was write-blocked before it met an operating system, which removed the school's remaining risk: putting it back in the camera to check, which would have written a fresh empty list over the top and started overwriting images as soon as anyone took a picture. It read at full speed with no unstable areas and imaged in one pass.
R-Studio found part of the directory structure still present in the image, which returned a few dozen photographs with their original names. The remainder were carved by content signature in PhotoRec, which recovered them cleanly because the camera had written them in long consecutive runs. The internal date and time in each image was then used to put the whole set back into shooting order, and the folders were previewed before being written to fresh media.
All four hundred and eleven photographs came back, arranged by date and grouped by event, which was more use to the school than a numbered heap would have been. The card was not returned to service; a card that has lost its list once has said something about itself.
Cards and sticks are £250 + VAT. This was logical throughout, with nothing opened and nothing lifted from a circuit, so it ran under no fix, no fee and was invoiced after the school had seen the photographs.
Take it out and leave it out. The single worst thing to do is put it back in the camera, because a camera that finds no usable list will offer to make a new one, and the next photograph taken lands on top of the ones you are trying to get back. Do not accept a format from a computer either, and do not run a repair tool that offers to fix the card in place. Photographs recover well from a card in this state, provided nothing is written to it in the meantime, and the odds get worse with every well-intentioned attempt. Post it in a rigid case rather than loose, and say roughly how many photographs were on it, since a carve that returns four hundred when you expected six hundred is a result worth questioning rather than accepting.
Each of these is a real enquiry, taken from a household or a business somewhere in Leicester or the surrounding county, with the name of the customer, the firm and anything else that would identify them taken out. What is left is the reasoning: what turned up, what had actually failed inside it, the method that fault required and the equipment it was worked on. One of the thirty-six is a job that was refused, and it belongs here every bit as much as the successes do.
A file that appears in a scan has not gone anywhere; the index that lists it has
A card has nothing moving inside it, so a fall damages the way in rather than the contents
A format the trade stopped making needs equipment the trade stopped selling
Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.