Data Recovery Case File · Cameras, Drones & Cards · Look in the Hidden Folder First
Deleting From a Mounted Card Does Not Always Mean Gone
Her enquiry describes a mistake made while trying to be organised. Clearing space on a laptop with a card mounted: "I believe I have accidentally deleted the data from my SD card while it was mounted on my laptop. I was trying to clean some space, so as to save the data from the card, but I think I have deleted the data on the card mistakenly." There is something specific worth checking before any recovery is discussed — because deleting from a mounted external volume on that system does not necessarily remove anything, and where it does not, the files are sitting in a folder she can open herself.
| Media | SD card mounted as an external volume — contents deleted in error during a storage cleanup; card retained |
| Reported situation | Card mounted on a laptop during a storage cleanup · contents deleted in error by the owner · deletion recognised shortly afterwards · card retained · photographs required |
| Fault class | Deletion from a mounted external volume — content present pending overwrite; volume-level trash directory to be checked before recovery |
| Equipment used | Volume-level trash directory checked before any recovery work · card removed from use · imaged write-blocked (DeepSpar USB Stabilizer 10Gb) · index remnants reconstructed · signature carving across unallocated regions · images validated by rendering |
The decode: the hidden folder, and why it exists
What happens when you delete from an external volume on a Mac: not what most people assume. Items are not removed — they are moved into a hidden trash directory on that volume itself, because the trash cannot span devices. A card that has had files deleted from it while mounted therefore often still carries every one of them, in a folder that does not show in the normal view. Emptying the trash is the step that actually deletes them, and it is a separate action that may never have been taken.
Why she may not know: the folder is hidden by default, so the card looks empty. And the trash is emptied from the desktop, which acts across all mounted volumes at once — so somebody who emptied it afterwards for unrelated reasons will have cleared the card too without connecting the two.
How to check, and it costs nothing: with the card mounted, hidden items can be revealed in the file manager, and the volume's trash directory becomes visible with the deleted contents inside. If they are there, they can simply be moved back. That is a two-minute check that resolves this entirely, and it should happen before any recovery is commissioned.
What applies if they are not there: the ordinary position, which is still good. A deletion removes index entries and marks space as available; it does not erase image data. The photographs remain physically present until something writes over them — and a card that has been taken out of use is a card where nothing is writing.
Why the timing helps her: she noticed almost immediately and the card has not been used since. That is the single variable that determines the result, and it is in the best condition it can be.
What must not happen: the card must not go back into a camera. A camera writes on insertion — thumbnails, folder structures, its own management files — into precisely the space now marked free. And nothing should be copied onto it.
The general point about cleaning up storage: deleting with an external volume mounted is how a surprising number of these arise, because a file manager shows local and external items in the same view and a selection can cross both. Unmounting anything not being worked on before a clear-out costs nothing.
On the bench
The volume-level trash directory was checked before any recovery work — deletion from a mounted external volume moving items into a hidden folder on that volume rather than removing them, which resolves the case at no cost where the trash has not since been emptied. The card was then removed from use and imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb, index remnants reconstructed to return original names and dates, with signature carving across the unallocated regions alongside. Images were validated by rendering.
The outcome
The hidden trash directory checked first, the card imaged and the contents reconstructed and validated. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront. The decode, and the free check worth doing today: deleting from a mounted external volume on a Mac does not remove the items — it moves them into a hidden trash folder on that volume, because the trash cannot span devices. Reveal hidden items and the folder appears with your photographs in it. Emptying the trash is the separate step that actually deletes them.
Files deleted from a card or drive mounted on a Mac
Reveal hidden items in the file manager and look for the trash folder on the card itself — that check takes two minutes and often ends this. Deleting from a mounted external volume doesn't remove anything; it moves the items into a hidden trash directory on that volume, because the trash can't span devices. So your card may still hold every photograph, just in a folder that doesn't show by default, and you can move them straight back. Emptying the trash is the separate step that actually deletes, and it acts across every mounted volume at once — so if you emptied it later for unrelated reasons, that's what cleared the card. Either way, keep the card out of your camera, because a camera writes the moment it's inserted.
Check the hidden trash on the card first — or call Guildford Data Recovery on 01483 901310; that folder checked before any charge, then imaged write-blocked and the index reconstructed.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.