A 1TB SD card holding photographs, video and documents. It appeared at the right capacity and folders opened — and most of what was inside was missing or unreadable. That description fits two completely different faults, and separating them comes before anything else.
← All case files · £250 + VAT, flat
A single high-capacity card used as working storage — photographs, video and documents together, with no copy anywhere else. It mounted, reported roughly the right capacity, and folders opened. What was inside them was largely absent or unreadable.
A reprogrammed controller reports a capacity far larger than the flash actually present. The card behaves normally until you pass its real size, then accepts writes and discards them — files appear afterwards with correct names and correct sizes, and their contents were never stored anywhere.
Card mounts, folders present, most files missing or unreadable. That is what the client described, and it is precisely what a fake card looks like from the outside.
Write a known pattern across the full claimed capacity and read every byte back, comparing. A genuine card returns what was written. A counterfeit returns the first portion correctly and rubbish beyond its real size, and the crossover point tells you the true capacity.
Full capacity verified end to end, flash behaviour consistent throughout, no falsified controller. Which meant the data was very probably still present and the fault lay in the file system.
The reason this goes first rather than last: the two situations have completely different outcomes and one of them has no recovery at any price. Nothing retrieves data that was never written.
The damage was to the exFAT structures — the allocation bitmap and a substantial share of the directory entries.
exFAT is the standard format for cards above 32GB and it is deliberately lightweight. Its layout is short: a boot sector at the start with a backup copy twelve sectors in, a File Allocation Table, an allocation bitmap tracking which clusters are in use, an upcase table for filename comparison, and then the cluster heap holding everything else. Files are described by entry sets — a directory entry carrying attributes and timestamps, a stream extension entry carrying length and starting cluster, and one or more entries holding the name.
Two design decisions make it fast and make it fragile. There is no journal, so an interrupted write leaves no record of what was in progress. And exFAT has a flag that lets a file whose clusters are contiguous skip the FAT entirely — the stream entry says “starts here, runs this long” and nothing else is recorded. That is excellent for write speed on a camera, and it means damage to a single entry set can orphan a large file completely, because the chain that would have described it was never written down.
The practical result is that a card pulled mid-write, or a camera losing power during a save, can leave the bitmap and the directory inconsistent — and once they are, files vanish from listings or return unreadable while their contents sit perfectly intact in the flash a few clusters away.
The card was imaged read-only in full through a write blocker, and every subsequent operation ran against the image rather than the card.
Structural repair first. The boot sector was validated against its backup copy, and the volume parameters — cluster size, heap offset, FAT position — taken from whichever was internally consistent. Surviving directory entry sets were recovered by walking the directory clusters and validating each set against its own checksum, which exFAT stores in the primary entry precisely so a damaged set can be identified rather than trusted. Cluster chains were rebuilt from the FAT where files had used it.
Carving for the rest. Where entry sets were beyond repair, files were recovered by signature. Photographs, video containers and documents all begin with distinctive byte sequences and most carry their own length in a header, which allows a carve to establish where a file ends rather than guessing. Recovered files were matched back to their original names wherever a surviving stream entry gave a starting cluster that lined up.
Verification by opening. Everything was checked by decoding rather than counting, and this mattered more than usual: the entire complaint was material that appeared to be present and was not. Handing back a large file count behaving the same way would have been no use at all.
About 98%, verified. The residue was files whose entry sets and cluster chains had both been damaged and whose contents were fragmented rather than contiguous — the one combination where neither structural repair nor signature carving has enough to work with.
If a card mounts at the right capacity and the files inside are missing, test the capacity before assuming corruption. Free tools write across the full claimed size and read it back; on a card this large it takes hours rather than minutes, and it is worth the wait because the two situations have completely different endings.
And treat a card as working media rather than as storage. It is small, removable, easily lost, and runs a file system chosen for speed and compatibility rather than for resilience. Cards and USB media are from £250 +VAT after a free 48-hour diagnostic — and where the diagnostic finds a counterfeit, we tell you rather than charging you to find out.
Bring the drive into our Oxford Street reception, or send it by post — finding out what went wrong costs nothing. You’ll get a written figure from our fixed bands before any work starts.