File system or raw data recovery?
Two recoveries of the same scope can lead to very different results: in one case the complete folder structure with names and dates, in the other 40,000 consecutively numbered images with no context. The difference is not the effort involved but whether the file system was still readable.
What a file system actually is
A storage device does not store files. It stores blocks. Which blocks belong together, what the resulting file is called, which folder it sits in and when it was last modified — all of that is held in a separate administrative structure, the file system. NTFS uses the Master File Table for this, APFS and HFS+ work with catalogue trees, ext4 with inodes, exFAT and FAT32 with allocation tables.
This administration is small — often less than one percent of the capacity — and it sits in fixed locations. That is precisely what makes it vulnerable: a brief power cut at the wrong moment, an interrupted copy operation or a few bad sectors in the wrong position can render it unusable while 99 percent of the actual data is untouched.
File system recovery: repairing the administration
If the structure is still partially present, it is reconstructed. File systems keep backup copies of their most important tables in several places; often a complete tree can be reassembled from fragments.
The result is the best form of recovery: folder structure, file names, timestamps and — crucially — the correct order of the blocks even for heavily fragmented files. A 30 GB video file scattered across half the drive only comes back together this way.
Raw data recovery: searching for patterns
If the administration can no longer be saved, the remaining route is via the contents themselves. Almost every file format has a characteristic signature at the beginning — JPEG, PDF, ZIP, MP4 and hundreds of others can be recognised by their first bytes. The software searches the entire drive for such beginnings and cuts out everything from there to the recognisable end.
This works surprisingly well — with three known limitations. Names and folders are gone, because they were never in the content but in the administration. Timestamps are missing for the same reason. And fragmented files are reassembled incompletely or incorrectly, because a search for signatures cannot know where a file continues on the drive.
That is why raw data recovery often produces very good results with photos and videos from cameras — such cards are written in large, contiguous runs, so the files sit together. On a system drive used for years, with many small and frequently modified documents, the result is noticeably more uneven.
What that means for your expectations
Why the order in the lab is fixed
- 01
Secure first
A sector-by-sector image of the drive. Everything else runs on this copy, never on the original.
- 02
Then check the file system
Can the administrative structure be reconstructed in whole or in part? That is always the first attempt, because the result is incomparably better.
- 03
Then raw data
Only when the structure can no longer be restored is a signature search carried out — often in addition, to collect files missing from the tree.
- 04
Check last
Open samples. A file that is present but does not open is not a recovered file.
Answered briefly.
Why are my recovered photos now called “file0001.jpg”?
Because they were found through a raw data recovery. The file name was never in the image but in the administrative structure of the file system — and that could no longer be reconstructed. The image content itself is unaffected by this.
Can the file name be restored afterwards?
Not from the image itself. Sometimes the metadata inside the file helps — cameras write the capture date and model into it, Office documents often the author and title. A usable sort order can be built from that, but not the original name.
Is a raw data recovery cheaper?
No — our price depends on the fault pattern of the storage device, not on the method. Which route is possible only becomes apparent during diagnosis.
We will take a look at your storage device.
The Economy diagnosis is free of charge. You find out what is possible before anything costs money — and what it would cost is put in writing beforehand.
Wasserweg 8–10 · 60594 Frankfurt am Main