Data Recovery Case File · Memory Cards · Flash Failure

SD card recovery: a wedding on a card that failed mid-transfer

Some jobs carry a date that can't be reshot. A full wedding — around 112GB of footage from a Nikon Z8 — was being copied to a computer when the transfer errored and died at 85GB. Everything after that went wrong at once: the camera stopped recognising the card, recovery software could see files but not save them, and the card began dropping offline mid-scan. The unrecovered portion included the ceremony.

The enquiry

“Wedding filmed normally — about 112GB used. Copying started fine and around 85GB transferred, then the copy errored and stopped. Windows shows 112GB used but only the first 85GB of files. The camera no longer recognises the card. Recovery software found around 700 MOV files in a raw scan, so the data exists, but export failed with a 'card removed' error — the card keeps dropping offline during scans, and there are I/O errors right at the start of the card.”

Reading the failure

The customer's own notes contained the whole diagnosis. Unreadable sectors at the card's very start explain the camera's rejection and the vanished file listing — that region holds the volume's directory structures, so the card's contents didn't disappear, their index did. And the pattern of working briefly then dropping offline is the signature of flash memory failing underneath its controller: each sustained read forces the controller into escalating error-correction against worn NAND until it stalls or resets. Every additional software scan was another lap of exactly that — the raw scans that "proved the data exists" were also consuming the card's remaining life. To the customer's credit, he stopped and picked up the phone instead of trying a fourth utility.

Two roads into a dying card

The gentle road was tried first: the card behind the DeepSpar USB Stabilizer, which turns its habit of dropping offline from a session-ending event into a managed one — hardware power control clearing each stall, reads resuming exactly where they stopped, no operating system in the loop to panic. A patient, error-skipping pass harvested what the controller could still serve. But the collapse was progressive, and the yield curve made the call for us: the remaining data would not be coming out through a controller losing its fight.

So the controller was taken out of the conversation. A modern SD card is a monolith — controller and NAND sealed in one wafer — and beneath its casing lie technological access points that allow the memory to be read directly. Mapping those points with the Visual NAND Reconstructor's pinout resources, the raw NAND was dumped in full. Raw flash is not a filesystem: it arrived scrambled by the controller's whitening, strewn with correctable errors, and arranged in the interleaved, wear-levelled order flash controllers use internally. Reconstruction in VNR and PC-3000 Flash ran the sequence that turns chip contents back into a card: error correction across the dump, the scrambling reversed, page and block geometry established, and the controller's translation layer rebuilt to produce a clean logical image — the card as the camera saw it, minus the card.

On that image, the exFAT structures at the damaged start were repaired from their surviving copies, and the missing tail of the shoot — the post-85GB region — was extracted. Long video recordings fragment on flash, so each recovered MOV was validated as a playable file, not a carved guess: container structure checked, fragmented clips reassembled in correct sequence, and every clip opened and spot-played through verification.

Outcome

The full shoot was reunited — the 85GB the customer had already secured, and the trapped remainder recovered at NAND level, ceremony included, delivered as verified playable footage. The margin for that result was thinner than the couple will ever know: worn NAND does not announce how many reads it has left, and the difference between this case file and a very different one was that the scans stopped when they did.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.