Data Recovery Case File · Second Fixes & Trade Handoffs · A Signature of Carving
What Came Back Tells You How It Was Done
His enquiry describes an informal recovery with a very particular result. A drive that asked to be reformatted, which they correctly refused: "I had a neighbour attempt to recover some data and he was able to save some photos, but there were a lot of home movies on there" which did not come back. Photographs surviving while video does not is not a coincidence — it is the characteristic signature of one recovery method, and it means a better one has not yet been tried.
| Media | External hard drive with damaged filesystem — format prompt declined by the owner; partial recovery previously attempted returning photographic content only |
| Reported situation | Drive prompting for reformatting · prompt declined by the owner · informal recovery attempted by a third party · photographic content partially recovered · video content not recovered · home video material required |
| Fault class | Filesystem damage with structures likely intact — prior recovery by signature carving; fragmented content not reassembled |
| Equipment used | Prior recovery method inferred from output pattern before assessment · imaged write-blocked before any reconstruction · filesystem structures recovered from surviving copies rather than carved · fragmentation map reconstructed for large files · media validated by playback |
The decode: why one file type came back and the other did not
What the neighbour almost certainly used: a signature carving tool. Those scan a drive from beginning to end looking for the recognisable opening bytes of known file types, and write out whatever follows each one. They work without any reference to the filesystem, which is what makes them useful when the filesystem is damaged.
Why photographs survive that approach: they are small, and small files are usually written in one continuous piece. A carver finds the header and everything that follows belongs to the same photograph, so it comes out whole and opens correctly.
Why video does not: large files are frequently split across the medium. A drive that has been used for a while has no single free region big enough for an hour of footage, so the filesystem writes it in fragments wherever space exists. A carver finds the opening bytes and then writes out whatever is physically next — which after the first fragment is a piece of something else entirely.
So the result is exactly what he describes: stills recovered, films missing or unplayable. The tool behaved correctly and its limitation is structural rather than a matter of quality. A more expensive carving tool would produce the same outcome.
Why that is genuinely hopeful: because carving is the fallback method, used when nothing better is available. The information a carver lacks — which fragments belong together — is held in the filesystem, and the filesystem is very likely still present.
Why it is likely present: the drive asked to be reformatted and they refused. That refusal preserved the structures, because a format is what replaces them. So the map describing where each fragment of each film lives has not been overwritten — it simply was not used.
What the better method is: reconstructing the filesystem from its surviving copies rather than ignoring it, which recovers the fragmentation map and therefore the videos, with their names and folder structure intact.
What must not happen: nothing further written to the drive, and no more scanning. Repeated carving runs produce the same partial result at the cost of hours of reading on a drive that has already had several.
On the bench
The prior recovery method was inferred from the output pattern before assessment — signature carving locating recognisable file openings and writing out what physically follows, which returns small contiguous files whole while large fragmented ones are truncated at their first fragment boundary. Structures were recovered from surviving copies rather than carved, the declined format having preserved them, and the fragmentation map reconstructed for large files with media validated by playback.
The outcome
The prior method inferred from what came back, the filesystem recovered rather than bypassed, and the fragmentation map reconstructed for the video. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: photographs surviving while films did not is the signature of carving. Small files are written in one piece and come out whole; large ones are split across the drive, and a carver has no way of knowing which fragments belong together.
Recovery that returned photos and no video
That pattern is hopeful rather than discouraging, so don't conclude the films are gone. It's the signature of signature-based carving — scanning the drive for recognisable file openings and writing out whatever follows. Photographs are small and usually written in one continuous piece, so a carver gets them whole. Video files are large and get split across the medium wherever space allows, so the carver finds the opening and then writes out a fragment of something else. The information it lacks is which fragments belong together, and that lives in the filesystem — which your refused format almost certainly preserved. Stop scanning and don't write anything to the drive.
The map is probably still there — call Oxford Data Recovery on 01865 593000; structures recovered from surviving copies rather than carved, fragmentation map reconstructed for large files, media validated by playback.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.