Data Recovery Case File · Trust, Practice & Honest Limits · Reasonable Caution

What a Preview Proves and What It Does Not

Her enquiry describes a common commercial arrangement and a sensible hesitation. Having found most of her photographs deleted from a camera card: "I used an online company to try and retrieve them and managed to get them displayed on my Mac. However, I was asked for a payment to recover them, which I didn't wish to risk without guarantees." Her caution is reasonable and her evidence is real — those two things are both true, and separating what the preview demonstrated from what it did not is the useful part.

The decode: the preview is genuine evidence, with three limits

What the preview genuinely proves, and it should not be dismissed: those thumbnails were rendered from data actually found on her card. The software did not invent them. So the photographs are physically present, the deletion removed index entries rather than image data, and the card is in a recoverable state. That is real information and it is the most encouraging thing in her message.

The first limit — a preview can render from a partial file. Photographs contain a small embedded thumbnail near the beginning, so an image whose opening portion survives can display perfectly while the remainder is overwritten or missing. A grid of previews therefore demonstrates presence, not completeness. Whether each file saves as a full-resolution image is a separate question, and it is the one that matters.

The second — previews say nothing about names and dates. Where recovery works by signature rather than from surviving index entries, files return without original filenames, folders or timestamps. That may be perfectly acceptable, but it is worth knowing before rather than after.

The third, and this is the practical risk she has not been warned about: the software must write its output somewhere. If the destination offered is the card itself — which some tools default to, and which is the obvious choice for anybody without a spare drive — the recovery overwrites the very data it is recovering. Whatever route she takes, output must go to a different device.

On the arrangement itself, fairly: scan free, show results, charge to save is a legitimate model and the tools are often decent. What it does not include is any assurance about the outcome — the licence is bought before the result is known, which is precisely what she objected to. Wanting a guarantee is not unreasonable, and no recovery, no fee is exactly that arrangement stated differently.

What her caution has preserved: the card, unaltered, with no output written to it and no further scanning. That is the best condition it could be in, and it means every option remains open.

What is done differently on a bench: the card is imaged first, and recovery runs against the image — so nothing writes to the original, scans can be repeated, and the result is validated by opening files at full size rather than by counting previews.

On the bench

The card was removed from use with no further scanning, and imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb before any recovery. Recovery was performed against the image with output written to separate media — consumer tools requiring an output destination, and the card being the obvious and most damaging choice for anyone without a spare drive. Images were validated by opening at full size rather than by preview, since an embedded thumbnail can render from a file whose remainder is missing, and the recovered count reported against expectation.

The outcome

The card imaged before any recovery, output written to separate media and every image validated at full size. Recovery of deleted or overwritten data from memory cards and USB sticks is charged at a flat figure, payable upfront. The decode: that preview is genuine evidence — the thumbnails were rendered from data really on your card, so the photographs are present. What it does not prove is completeness, because an embedded thumbnail can render from a file whose remainder is gone. And whatever you use, the output must never be written back to the card.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.