Recovering lost files

Lesson 1 showed that deleted data stays on a hard disk or memory card until it is overwritten. This lesson turns that into a method: what to do in the first minutes, how to get files off without making things worse, and when to stop and hand the drive to a professional.

The first rule: stop using the drive

Every write to the drive can land on the blocks that hold your lost files. So the moment you notice a loss:

• Stop writing to it. No more photos on that card, no downloads, no copying files onto it. Do not put the card back into the camera or phone.
• Do not install a recovery tool onto it. Install it on a different, healthy computer or drive.
• Do not let the computer "fix" it. Do not run chkdsk, fsck, "Repair disk" or "Format", even when the system offers to. They rewrite the very structures recovery needs.
• If the lost files were on your system disk, shut the computer down. A running system writes to its own disk all the time. Recover from another computer, or by starting a different system from a USB stick.

These come first in DiskRescue's Before you start rules too. What you do in the first minutes matters more than which tool you use.

Three kinds of loss

What went wrong decides what to do. Work out which case you are in before anything else.

Case	Examples	What still works	What to do
Deleted	Emptied the Trash, deleted on the camera, quick-formatted a card	The drive and filesystem are fine; names are forgotten	Recover from the drive. Fast, often complete, except on SSDs (TRIM)
Corrupted	"Card error", "you need to format the disk", a folder of files that will not open	The drive is fine; the file list or the files are damaged	Copy the drive to an image, then search the image. Repair damaged files
Physically failing	Read errors, clicking, very slow reads, drive keeps disconnecting	The drive is getting worse with use	Copy it once, carefully, to an image. Then work only on the image
Dead	Shows 0 bytes, does not spin up, smells burnt, got wet	Nothing software can use	Power it off and call a data recovery lab

Recover to a different drive

Recovered files must never be written to the drive you are recovering from. Each file you save there could overwrite another file you have not recovered yet.

  WRONG                               RIGHT
  ┌──────────────────┐               ┌──────────────────┐     ┌──────────────────┐
  │ SD card          │               │ SD card          │     │ Laptop disk      │
  │  lost photos ◀─┐ │               │  lost photos ────┼────▶│  recovered/      │
  │  recovered ────┘ │               │  (only read)     │     │                  │
  └──────────────────┘               └──────────────────┘     └──────────────────┘
   saving overwrites                   source is read,
   what is not yet recovered           never written

Make sure the other drive has room: as much as you expect to get back, plus the size of the whole source drive if you make an image of it.

DiskRescue enforces this: it opens the drive read-only, never writes to it, and refuses to save onto the drive being rescued, also when it is reached through a partition, a link or another layer.

Image a failing drive first

An image is a single file that holds a copy of every readable part of a drive, block by block. For a failing drive it is the safest way to work:

  Failing drive ──(read once, carefully)──▶ card.img ──▶ search, again and again
                                                         with different settings

• The drive is read as little as possible, before it gets worse.
• A good imaging tool reads the healthy areas first and comes back to the damaged ones later, so one bad patch does not stall the whole copy.
• You can search the image as many times as you like, with other settings, without touching the drive again.

A map file next to the image records which parts were copied and which could not be read. GNU ddrescue, a well-known command-line imaging tool, uses this method, and DiskRescue reads and writes the same map format.

For a healthy drive after an accidental delete, reading it directly is fine. For anything showing signs of trouble, image it first.

The DiskRescue workflow

DiskRescue follows this method in the desktop app. In outline:

1. Pick the drive. On Rescue from a drive, find it by name and size. Tags such as Mounted, Removable or Failing tell you about it. The disk your computer runs from is marked; do not pick it. Select Rescue.

2. What to recover. Choose Photos, Camera RAW photos, Videos or other kinds, and keep Deleted files and files that are still there (recommended).

3. Where to save. Choose a folder on another disk. Keep Copy the drive to an image first (recommended for failing drives) on if the drive shows any sign of trouble.

4. Review and start. Read the Safety checks. Fix any problem, select Check again, and when it shows Ready to start, select Start rescue.

5. Watch and wait. The rescue copies the drive to an image file, then finds your photos and videos. You can Pause, or Stop... and Stop and save to continue later. Nothing is written to the drive.

6. Look at the results. On Results, filter by Photos, Videos, Damaged, Repaired and Deleted.

The full steps and every safety message are in the beginner guide and Rescue a failing drive.

Unmount, do not eject

DiskRescue asks you to take a drive out of use before copying it, so nothing writes to it. In your file manager choose Unmount, not "Eject" or "Safely remove", which disconnect the drive.

Where recovered files come from

Tools find lost files in two ways, and the results folder shows which:

Folder	How the files were found	Names
files/	Existing files, read through the file list	Original names and folders
deleted/	Deleted files whose entries are still in the file list	Original names, mostly
carved/	Carving: searching the raw data for the patterns that start and end a JPEG, a video and so on	Lost; files get names like f00002c41000.jpg

After an accidental delete, look in deleted/ first, then in carved/. Carving works even when the file list is destroyed, but it cannot put back files stored in scattered pieces, and it never recovers the original names or folders.

Damaged photos and videos

Sometimes the file comes back but will not open: a photo with a grey lower half, a video that says "moov atom not found". The data inside is often mostly there; what is broken is a small part the viewer needs.

Problem	Why it happens
JPEG cut off, bottom grey	The end of the file was never written, or could not be read
JPEG will not open at all	Its header, the part at the start describing the image, is damaged
MP4 or MOV will not play	The index (the "moov atom") that says where each frame is, often written at the end of recording, is missing
Video stops early or skips	The index points past the data that survived

DiskRescue's Repair photos & videos handles these for JPEG, PNG, MP4, MOV and AVI. For a broken video or a destroyed JPEG header it needs a reference file: a healthy file from the same camera or phone. For a video, the reference must come from the same device with the same resolution and frame rate. It saves repaired copies separately and never changes your originals. See Repair photos and videos.

A repair cannot invent what is not there. A photo whose lower half was never saved stays grey there. DiskRescue fills unreadable parts with zeros and marks such files Partly repaired or Has unreadable parts, never presenting them as whole.

When to call a professional

Software can only read what the drive is willing to give. Stop and power the drive off if:

• it shows a size of 0 bytes, or much less than it should;
• a hard disk clicks continuously, beeps, or does not spin up;
• it smells burnt or got wet;
• a hard disk gets louder, slower or starts clicking during a copy.

A data recovery lab works in clean rooms with spare parts and can often still get files back, but every hour a mechanically failing disk runs can cost data. If the files are worth paying for, call the lab before you try anything yourself. Never open a hard disk.

Stay safe

• Stop using the drive the moment you notice a loss.
• Never save recovered files to the source drive. Have another drive with enough space ready.
• Do not format, repair or fsck a drive with lost files, whatever the computer suggests.
• Image anything that is failing, and do all searching on the image.
• Recover only drives you own, or have the owner's permission for. Other people's cards and disks hold other people's private files.
• Keep recovered files private. Do not attach personal photos to public bug reports or forum posts.
• Then fix the cause: set up the backup from lesson 2 so the next loss is a restore, not a rescue.

Check yourself

QuizRecovering lost files

Question 1 of 6

You just deleted holiday photos from an SD card by mistake. What should you do first?

Score: 0

What you learned

• The first rule: stop writing to the drive, and do not let anything "repair" it.
• Recovered files always go to a different drive.
• Deleted, corrupted, failing and dead drives need different treatment; failing ones are imaged first.
• Recovery finds files through the file list (names kept) or by carving the raw data (names lost).
• Damaged photos and videos can often be repaired with a reference file, but missing data stays missing.
• Clicking, 0 bytes, water or burning smells mean: power off and call a lab.

Next steps

• Moving and sharing files
• DiskRescue: Before you start
• Practise a recovery on a spare USB stick