RAW Data Recovery

When we talk about RAW data, we mean data that has become detached from any file name and folder. Not to be confused with camera RAW files, which contain the data from a digital camera sensor.

To explain RAW data, it is important to first understand how data gets saved to disk. Without going into too much detail, there are basically two things going on. The file and folder names get written to an index, and the actual file content gets written to somewhere else. Much like a filing cabinet, where a file gets added to the drawer and then the location gets written to the index card.

Certain types of failure can cause the index to become damaged, even though the actual file is still on the disk. This is why you may have heard that deleted files are not really gone; When you delete a file, it is just removed from the index1.

Often the files work fine, but there are no filename or folders to identify the file.

To recover RAW files we scan the whole drive looking for known sequences of data. For example all JPEG photos start with the same few bytes in the header (0xFFD8FFE0 or 0xFFD8FFE1).

Different formats and systems use different ways of storing the indexes so there are different chances of recovery depending on where the data was stored. See some common examples below:

  • On a Mac, if you format a drive you will not get back the original structured data. Raw files should still be recoverable.
  • On an iPhone, if you delete a file you won’t even get back RAW files as the they are encrypted1.
  • If you format a Mac drive as a Windows drive or vice versa then there is a chance of recovery as they store info in different parts of the disk.
  • If you format and re-install Windows or OS X, you will only get RAW data, and only from the areas that were not overwritten by the installation.
  • If you delete all the files from an SD card and then use it again, we may be able to get any files that were not overwritten by new files. If there were originally 100 photos and then the card was erased and 50 new photos taken, we should be able to get back the 50 old files that were not yet overwritten.

Notes:

If encrypted files are deleted they will be indistinguishable from a random string of data, and therefore lost. Also certain types of files rely on file names to link to assets. Adobe InDesign files pull in graphical assets by name, and Logic / Garageband also link to audio samples by name. This makes raw recovery of those types of file either very difficult or impossible. Also Garageband / Logic files are actually just a folder full of files so they need their file names to be correct.
Read More on Our Blog