Frame WitnessForensics

EXAMINATION NOTES ยท 8 OCTOBER 2026

How to recover a fragmented MP4 from a formatted SD card

A formatted SD card is not necessarily empty. A format typically rewrites filesystem metadata and leaves much of the old content in place until new recordings overwrite it. The difficulty is that video files are often fragmented: a camera writes a clip in pieces across the card, and once the filesystem records are gone, the pieces have to be put back together using the structure of the video itself. This guide explains what Frame Witness can do on Windows, how to go about it, and where recovery genuinely stops.

Why formatted video files are hard to recover

Two things go missing after a format:

  • The filesystem records that said which clusters belonged to which file. If the card has not been formatted, Frame Witness can use its exFAT metadata: FAT chains, deleted directory entries and the allocation bitmap. A quick format replaces the FAT and the bitmap, but folders such as DCIM often survive until new files overwrite them, and Frame Witness uses the names and paths they still list. Beyond that, the search relies on each video's own index and on media structures in the raw bytes.
  • Contiguity. Signature carving on its own assumes a file is one continuous run of bytes. A fragmented MP4 found that way plays for a few seconds and stops, or does not open at all.

Frame Witness rebuilds fragmented MP4, MOV, 3GP, AVI, MKV and WebM videos from their own index, the table inside the container that lists where each chunk of audio and video sits. If that index survived, the clip can be reassembled from non-contiguous pieces and verified by decoding.

What cannot be recovered

Be realistic before you start:

  • Overwritten regions. New recordings written after the format replace old data. No scan can read bytes that are no longer there. When only the beginning of a video was overwritten and its index survived, Frame Witness rebuilds the frames that remain into a partial video, labelled as such.
  • Clips with no index. If the index region was overwritten, there is no map to rebuild from. A clip interrupted by a power cut is different: Frame Witness can rebuild its index from another video recorded by the same camera, as a labelled derived file, but only if such a video survives on the card.
  • Cards wiped by the device or encrypted. Cryptographic erasure and storage-level erasure leave nothing to carve.
  • Phones. Phone validation is incomplete and recovery from locked phones is outside the current scope.

Frame Witness shows the difference between a full decode, a preview and a structural match, and it never treats a visible frame as proof that the whole original survived.

Step by step

  1. Stop using the card. Take it out of the camera. Every new recording reduces what can be found.
  2. Connect it to Windows with a card reader. Frame Witness only reads the card, but Windows may write to a volume it mounts, for example to mark a damaged file system. If Windows offers to scan and fix the card, choose Cancel. Use a write blocker where the evidence matters, and prefer working from a preserved image. If the card stops responding, Frame Witness is designed to stop reading it without freezing and to guide you through reconnecting it (checked so far with a simulated failing device and one USB stick); a card that keeps failing needs a data recovery laboratory rather than more attempts.
  3. Install Frame Witness and sign in. Download the signed Windows release (version 1.0.14, Windows 11 x64; Windows 10 not yet tested) and create a free account.
  4. Choose the source. Select the card as a physical disk, or create a RAW image first and scan the image. Reading a physical disk requires the permission to do so.
  5. Run the scan. A free account runs a quick scan of the first 8 GiB with up to 100 results; a licence runs a full scan of the whole source. The scan checks surviving filesystem records first, then searches the accessible bytes for media structures.
  6. Examine the findings. Sort the gallery by size or available date, open a candidate, play it and run the video-track verification. Check the coverage report to see what was read and whether any regions failed.
  7. Export to a different drive. Save the recoverable clips with their source metadata and SHA-256 hashes to another physical destination, never back to the card.

What you get with each recovered clip

  • Source offsets and extent map of the retained bytes
  • SHA-256 digest of the content
  • Dates with their recorded source: embedded container time, filesystem creation or modification, each labeled, with missing values left unknown
  • The verification checks that passed: structure, preview, decoded video track

Decoder workers run under Windows AppContainer isolation, and nothing is uploaded from your workstation.

Free scan or full licence

The free account covers a quick look: first 8 GiB, up to 100 results, previews, and saving files up to 1 MiB each. A fragmented 4K clip will be larger than that, so a real recovery needs a licence.

The Professional licence covers one workstation, with 12 months of updates and email support; Lab covers 3 workstations and Organization 5. Plans differ in activations and training, not in the recovery engine. Current prices, including any time-limited offer, are on the pricing page.

Download Frame Witness for Windows, scan the card for free, and buy a licence from your account only if the scan shows something worth recovering.

Frequently asked questions

Does a quick format destroy the videos on an SD card?

A quick format usually replaces the filesystem records and leaves the old content on the card until it is overwritten. Frame Witness looks for folders the format left in place, which keep file names and paths, and searches raw media structures, but the result depends on what is still readable; a format is not a guarantee of survival or of loss.

Why does a recovered MP4 play for a few seconds and then stop?

That is the usual sign of a file carved as one contiguous run when it was actually fragmented. Frame Witness rebuilds MP4, MOV, 3GP, AVI, MKV and WebM clips from their own index so non-contiguous pieces can be reassembled, provided the index survived.

Can a clip be recovered if the camera lost power while recording?

It can be, if another video from the same camera survives on the card. The container index is written at the end of the recording and may never have been saved; Frame Witness rebuilds it from the settings of the other video and keeps the result only if it decodes cleanly, labelled as a rebuilt file rather than the original. Without a matching video, the recording is kept as found.

Will the free account recover my footage?

The free quick scan covers the first 8 GiB of the card, returns up to 100 results and saves files up to 1 MiB each. It tells you what is there; saving full-size video clips requires a licence.

Related guides