Recover deleted videos from an external hard drive

Why a hard drive keeps deleted data

A hard drive does not erase freed space on its own, unlike an SSD with TRIM. A deleted video stays until new files are written over it. On NTFS, the deleted file's record in the Master File Table often still holds its name, path and the location of its pieces.

What Frame Witness reads

NTFS records of deleted files (names, paths through deleted folders, the clusters of each file) and, where records are gone, the raw bytes searched for video and photo structures. Exported files keep their source offsets and SHA-256.

What has been tested

On a 2 GiB NTFS virtual disk with six test videos deleted, Frame Witness recovered 6 of 6 with identical SHA-256 and their original names. No physical hard drive and no failing drive has been tested yet.

If the drive is failing

Clicking, not being detected, hanging or very slow reads are signs of a hardware fault. Frame Witness reads physical disks with a time limit on every read and lists unreadable sectors, but software cannot repair hardware: stop and contact a data recovery laboratory.

What cannot come back

• Overwritten data. Bytes that new files replaced are gone for every program.
• Full and overwrite formats. A full format in Windows writes zeros over the volume; an overwrite format or a wipe does the same with other patterns.
• SSD TRIM. A drive that receives TRIM usually erases freed blocks itself.
• Encryption without the key. A BitLocker volume, or a phone with file-based encryption, cannot be read without its key.

Step by step

1. Stop writing to the drive. Do not copy anything new onto it.
2. Install Frame Witness on another drive. Download the signed Windows release (version 1.0.14, Windows 11 x64; Windows 10 not yet tested) and create a free account: it gives a quick scan of the first 8 GiB, up to 100 results, previews and saving files up to 1 MiB each.
3. Scan the drive. Choose Scan a card or drive and select the external drive, or create a RAW image first.
4. Save to a different drive. Export what you need to another physical drive.

Try it on your own source

Download Frame Witness for Windows (version 1.0.14, Authenticode-signed by Aurelio Avila, SHA-256 fa22d6c7f97da0b4e5efa889e5abb9e4d98815a9b76ac0087424944b21bad6c2). The free account gives a quick scan of the first 8 GiB, up to 100 results, previews and saving files up to 1 MiB each; full scans and larger files need a licence, with current prices on the pricing page.

Related

• Recover deleted files from an SSD: what TRIM changes
• Recover data from a BitLocker-encrypted drive
• Test results and how they were measured