Data Recovery Case File · Cameras, Drones & Cards · Discard Runs Immediately

He Did Everything Correctly and It Did Not Help

His enquiry describes textbook behaviour and a blank result. Videos deleted from an action camera card by a family member: "I stopped using the card and tried different recovery software to see if I can recover data, but after a few hours of scanning the deleted files are not visible. The card was not formatted or re-written." Everything he did was right — and on this class of device the rule those actions protect can no longer be relied on, which is worth explaining rather than leaving him to conclude he was too slow.

The decode: the rule, and where it stops applying

The rule everybody knows, and it is a good one: deleting a file removes the index entry and marks its space as available. The data itself stays where it is until something writes over it. That is why stopping immediately matters, and it is why almost every case in this archive begins with taking the device out of use. On mechanical drives and older cards it holds completely.

Why it does not always hold on modern flash media: flash memory cannot be overwritten in place — a block has to be erased before it can be reused, and erasing takes time. So devices support a discard instruction: when a file is deleted, the host tells the card which blocks are no longer needed, and the card's controller clears them during its own background housekeeping. That happens within seconds or minutes, unprompted, whether or not anything is plugged in. The controller is not waiting for an overwrite; it is tidying up so that future writes are fast.

So what most likely happened here: the deletion issued discard, the controller acted on it, and the blocks were cleared before he could have done anything. By the time he stopped using the card, there was nothing left to preserve — which is why several independent tools, working correctly, all returned the same result. Their agreement is evidence rather than incompetence.

Why this deserves stating plainly: he will otherwise conclude that he was too slow or chose the wrong software, and neither is true. He was not too slow. The window did not exist. That is a hard answer and it is better than an expensive one.

Why it varies between devices: not every card and camera combination issues discard, and older devices frequently do not. Which is why deleted files sometimes do come back from cards and sometimes do not, apparently at random — the difference is whether the instruction was sent and acted upon, and there is no way to know from outside.

What is still worth checking: the camera's own storage of thumbnails or a media database, which sometimes retains small versions independently. And any recording that was never finalised, which may sit outside the deleted set entirely.

The lesson that follows: on modern flash, deletion should be treated as immediate. The protection is a second copy made before anything is deleted, not fast reactions afterwards.

On the bench

The card was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb before any conclusion was drawn. Discard behaviour and block state were assessed at controller level — flash requiring a block to be erased before reuse, so a deletion issuing discard has the controller clear those blocks during background housekeeping within minutes and unprompted, rather than waiting for an overwrite. Camera-side database and unfinalised recordings were examined separately, and the position stated before any charge.

The outcome

The card imaged before any conclusion, discard behaviour confirmed at controller level and camera-side sources examined separately. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront. The decode, and it is worth hearing plainly: you were not too slow and you did not pick the wrong software. Deleted data surviving until overwritten is true of mechanical drives and older cards. Modern flash cannot overwrite in place, so a deletion can tell the controller to clear those blocks — and it does, within minutes, unprompted.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.