Deleted video recovery:
what can survive?

Start with the source.

A deleted file may retain a filesystem record, surviving data extents, both, or neither. A metadata-based search can use a surviving record to locate content. RAW carving searches recognizable byte structures without requiring a current filename. Neither method establishes that all pieces of the original are present.

For repeatable examination, preserve an acquired image and record its hash. A live Windows system keeps changing its disk while other processes run; read-only access by an examination application does not freeze those processes.

Earlier formatting is a survival question.

A new filesystem can replace metadata while leaving some old content accessible. A deep search can examine surviving structures, but a disk is not an archive of every earlier installation. Overwritten regions, missing encryption keys and bytes erased by the storage device cannot be reconstructed from signatures alone.

Microsoft documents that file-delete notifications, also called TRIM or unmap, tell the storage device which clusters were freed. The setting alone does not prove that a particular video survived or disappeared; the bytes actually acquired are what the examination can assess.

Source: Microsoft — filesystem behavior and delete notifications

Why a recovered fragment may not play.

Video data can be fragmented or missing container indexes, codec configuration or reference frames. Recognizing a container is one check. Decoding a frame is another. A successful preview does not prove complete recovery, and an unavailable preview does not automatically mean there are no useful surviving bytes.

Document the source offsets, recovered length, hash and checks performed. Compare an exported result with a known original when a lawful reference is available. Keep unknown dates and uncertain completeness explicitly unknown.

A practical reporting checklist.

1. Record the source and acquisition method.
2. Identify the search scope and incomplete or unreadable regions.
3. Separate filesystem findings from content carving.
4. Record hash, byte length and structural checks for each finding.
5. Describe playback validation separately from original completeness.
6. State the source of each timestamp and preserve unknown values.

Discuss the workflow.

Frame Witness is a Windows photo and video examination tool. The publisher-signed Windows release is available to download. A free account includes a quick scan of the first 8 GiB (up to 100 results), previews and saving files up to 1 MiB each; full scans of the whole source, larger files and the advanced analysis tools require a paid licence. Licences can be bought from your account; public evaluation enrolment is not open. We are collecting professional workflow feedback, without collecting case evidence.

Which reporting detail is hardest to preserve when reviewing recovered video?

The discussion is public. Share synthetic examples and requirements only; do not upload case files, personal media or sensitive identifiers.

Guides.

• Dashcam and CCTV video recovery on Windows
• How to recover a fragmented MP4 from a formatted SD card
• Recovered media you can document