Lost Allocation Records
FAT, exFAT, NTFS or other filesystem structures may no longer identify every cluster belonging to a file.
Fragmentation Recovery & File Carving
Aesonlabs provides fragmentation recovery and file carving for storage media containing files that are missing, incomplete, corrupt or no longer connected to dependable filesystem records. These cases can follow deletion, formatting, filesystem damage, interrupted recording, media failure or a previous recovery that produced files which will not open or play correctly.
The objective is not simply to locate recognizable file headers. We examine the source image, remaining filesystem metadata, allocation patterns and the internal structure of the requested file types. When a file has been divided across non-contiguous areas, its fragments may need to be identified, ordered and validated before a usable result can be produced.
Two Different Problems
File Repair Is Not the Same as Fragmentation Recovery
A video with a damaged index or missing container metadata may still contain one continuous stream of data. That is commonly a file-repair problem. Fragmentation recovery is different: portions of the original file are stored in separate physical or logical locations, sometimes with unrelated data occupying the space between them.
Replacing a header or rebuilding an index cannot restore fragments that have not been located. True reconstruction may require analysis of allocation records, neighboring files, internal sequence information, codec or container structures and the relationship between many candidate blocks.
When Fragmentation Recovery May Be Required
Files become fragmented during ordinary use when a filesystem cannot allocate enough continuous space for a growing file. Recovery becomes difficult when the metadata describing those separate extents is deleted or damaged. Similar symptoms can also be produced by corrupt allocation tables, recorder failures and incomplete acquisitions.
Missing Names and Locations
The content may remain on the media after directory entries and allocation metadata have been removed or replaced.
Interrupted or Incomplete Media
Cameras, drones, DVRs and recorders can leave unfinished containers, circular buffers or partially committed recordings.
Files That Do Not Open
A basic scan may find valid signatures but produce truncated, mixed or incorrectly sized files that require deeper reconstruction.
Metadata and Content Analysis
Recovering Files When the Directory Is No Longer Reliable
Filesystems normally record a file's name, size, timestamps and the locations of its allocated data. When usable metadata survives, it can provide the most direct route to restoring fragmented files and may preserve portions of the original folder structure.
File carving works from content rather than depending entirely on those records. Recognizable headers, footers, container fields and other internal structures can identify candidate files within a sector-level image. Straightforward carving can be effective when the file is continuous and its boundaries are clear.
A header match alone does not establish that every following block belongs to the same file. When content is fragmented, candidates must be evaluated against the expected structure and against other data found throughout the source image.
Structure-Aware Reconstruction of Fragmented Files
Large video files are frequent candidates for fragmented recovery because they grow continuously while being recorded. MP4, MOV and AVI containers can include separate metadata, indexes, audio streams and video streams. Drone footage, dashcam recordings, surveillance exports and camera media may also use proprietary naming, segmentation or circular-buffer behavior.
Reconstruction can involve interpreting container atoms or chunks, locating plausible continuation points, comparing timestamps and sequence values, separating interleaved content and rebuilding indexes after the available fragments have been assembled. JPEG photographs, audio recordings, documents and archives have different structural rules and require format-specific validation.
A correct extension is not proof of a successful recovery. A carved file can have a valid name and header while containing unrelated blocks, missing content or an incorrect endpoint. The recovered result must be parsed, decoded or opened and checked for continuity wherever the format permits.
From Candidate Data to Usable Files
Validation Is Part of the Recovery
Reconstructed files are evaluated for more than their presence in an output folder. Video and audio containers may be checked for readable stream information, plausible duration, successful decoding and continuity across reconstructed boundaries. Images and documents can be parsed or rendered to identify truncation and mixed content.
When several fragment combinations are possible, validation results help eliminate incorrect joins and prioritize the most complete reconstruction. Some files may be fully usable, while others can remain partial because one or more source fragments were overwritten, unreadable or never committed to storage.
Content carving may recover the file data without the original filename, timestamp or directory. When surviving metadata can be correlated with a carved result, we preserve that context; otherwise, recovered files may require generated names and organization by type or acquisition location.
Storage Media and File Types We Examine
Fragmentation and carving cases can originate from hard drives, SSDs, USB flash drives, SD and microSD cards, CFexpress and other camera media, RAID images, DVR storage and disk images created during an earlier recovery. We commonly examine MP4, MOV, AVI, JPEG, camera RAW, WAV, database, document and archive content, along with proprietary recorder formats when enough structure can be identified.
If the source device is physically unstable, it must first be safely acquired. Logical reconstruction should be performed from the most complete sector-level image available rather than by repeatedly scanning failing media. Related physical-media services are available through our Hard Drive Data Recovery, SD Card Data Recovery and RAID Data Recovery pages.
Not Every Missing Fragment Can Be Recreated
File carving identifies and organizes data that still exists; it cannot regenerate overwritten sectors. Recovery may also be limited by unreadable areas, missing container metadata, unsupported proprietary structures, encryption or an incomplete source image. On SSDs and some flash-based devices, deletion followed by TRIM and internal garbage collection can make the released content unavailable even when the filesystem still shows evidence that a file once existed.
Turnaround depends on the capacity of the source, number and size of the requested files, degree of fragmentation, amount of unrelated data, condition of the filesystem and availability of reliable validation markers. High-capacity video cases can require repeated scans, candidate comparison and substantial manual review.
What to Send and What to Avoid
Include With the Media
- The original storage device whenever available
- A description of deletion, formatting or failure events
- Expected file types, dates, quantities and approximate sizes
- A working sample from the same camera or recording system
- Previous recovery images or outputs without modification
Before Submission
- Do not record, save or copy new files onto the source
- Do not format or initialize the device when prompted
- Do not run filesystem repair against the original media
- Do not repeatedly scan a physically unstable device
- Preserve any original directory listings or sample files
Each case is evaluated individually. A small group of lightly fragmented files may be resolved efficiently, while large recordings with missing allocation metadata can require extensive engineering and processing time. Initial examination helps establish whether the necessary content remains present and which reconstruction method offers the most useful result.
Open a Fragmentation Recovery Case
How a Fragmentation Recovery Case Progresses
Controlled Acquisition
The source media is imaged or the supplied image is verified so analysis can proceed without changing the original evidence.
Metadata and Signature Analysis
Filesystem remnants, allocation patterns and content signatures are examined to identify files and candidate extents.
Fragment Reconstruction
Candidate blocks are ordered using format structure, sequence information and their relationship to surrounding data.
Validation and Delivery
Recovered files are parsed, decoded or opened where possible and organized according to the surviving metadata and results.
Fragmentation Recovery & File Carving FAQ
File carving is content-based recovery that searches a storage image for recognizable file signatures and internal structures instead of relying completely on filesystem directory records. It can recover files after deletion, formatting or filesystem damage, provided enough of the original content remains.
Many MP4, MOV, AVI and proprietary video cases can be reconstructed when the required fragments and enough structural information remain available. Feasibility depends on fragmentation, overwriting, container organization, codec information and the completeness of the source image.
Original names, dates and directories may be preserved when usable filesystem metadata survives. Files recovered only through content carving may require generated names because their original directory records are no longer connected to the data.
Remaining portions may sometimes be recovered, but overwritten content cannot be recreated from the source. Whether a partial result is usable depends on the file format, location of the missing data and the purpose for which the file is required.
Large files can contain many candidate fragments distributed across high-capacity media. Time may be required to compare possible continuations, eliminate unrelated data, rebuild format structures and validate the result. Missing metadata and proprietary recording formats can add substantial manual work.
Have Missing or Unplayable Files After a Recovery?
Submit the source-media details, expected file types and any previous recovery results. We will evaluate whether filesystem reconstruction, structural file carving or fragmented-file analysis is the appropriate next step.
Submit Your Media