How to recover photos from a memory card

Stop using the card

Deleting a file, or formatting a card, does not usually erase the photographs. It marks the space as free. The pictures are still sitting there in full until something writes over them.

Which means every additional thing you do with that card is a chance to destroy what you are trying to get back. Taking one more photo can land directly on top of the file you wanted. So can letting the camera write a new directory listing, or letting a phone regenerate thumbnails, or letting an operating system decide to “repair” the volume when you plug it in.

Take the card out. Put it somewhere. Do the rest of this on a computer.

Make an image before you try anything

This is the step that people skip and regret.

Copy the whole card, byte for byte, into a single file on your computer. Not the visible files — the entire card, including the parts that no longer appear in any directory. On macOS or Linux:

diskutil list                       # find the card, e.g. /dev/disk4
sudo dd if=/dev/rdisk4 of=~/card.img bs=4m status=progress

On Windows, use a disk imaging tool that offers a raw sector-by-sector image of the physical device rather than of the volume.

Two reasons this matters. Recovery software that works on an image file cannot damage your card, whatever it does. And if the first tool you try produces nothing useful, the second one starts from an identical card rather than one that has been through the first tool.

Once you have the image, put the card away and do not touch it again until you are finished.

What is actually recoverable

There are two very different situations and they need different tools.

The filesystem is intact and the files were deleted. The directory entries are gone but the data and often the layout are still there. This is the good case: recovery is usually near-complete and filenames sometimes survive.

The filesystem is gone — the card was formatted, the card reports a wrong size, the camera says “card error”, the computer offers to initialise it. Here there is no directory to read, and the technique is different: scan the raw bytes from beginning to end looking for the signatures that file formats start with. A JPEG begins FF D8 FF. A PNG begins with a fixed eight-byte header. Find a signature, work out where that file ends, and carve it out.

Carving does not recover filenames or folders, because that information lived in the directory that is gone. It recovers the pictures, numbered in the order they appear on the card. It also struggles with fragmented files — a video written in pieces scattered across the card may come back with only its first fragment.

Then check what you got back

This is the part almost everybody skips, and it is why people think recovery “worked” and discover six months later that half the files will not open.

A carved file can be the right length, have the right header, open its thumbnail happily in a file browser, and still be truncated or corrupt halfway down. The only way to know is to fully decode every recovered image and see whether the decoder gets to the end.

Do that pass before you delete anything, and before you tell anybody the recovery worked.

The programs for this

• CardRecovery carves files out of a raw card image by signature. It never reads a directory structure and never writes to the image it scans. scan reports every file it could recover with its type, byte offset, length and a confidence; recover carves them into a folder you name, and is a dry run unless you pass --apply.
• MediaRescue is the check afterwards. It fully decodes every image in a folder and gives each one a verdict — healthy, truncated, corrupt, mislabelled, empty or unreadable — so you find out which of the recovered files are actually good. It never repairs and never deletes; damaged files are moved to a quarantine folder, and only with --apply.
• PhotoRevive scans years of photo folders in one run and repairs a narrow class of damage: JPEGs that lost their tail. It writes repairs to a separate output directory and leaves your originals alone.
• VideoMend explains why a recovered video will not play, by walking the container structure and reporting what is missing or wrong.

Free while we are in preview, one file each, Windows and Mac.

When to stop and pay somebody

If the card is physically damaged, if the computer cannot see it at all, or if it makes a noise, stop. Imaging a failing device can be the thing that finishes it off, and a professional recovery lab has read heads and clean rooms that you do not.

The same goes for the only copy of something irreplaceable. Software recovery is cheap and often works. It is not worth one attempt at a wedding.