Data Recovery Case File · Cameras, Drones & Cards · Two Cards, One Question
The First Question Is Whether the Old Card Still Holds Everything
Her enquiry describes a migration that seemed to work and did not. Eleven thousand photographs transferred from an old card to a newly bought one, where "only a handful of photos now load", and she wonders whether "there was some kind of virus that transferred to the card." A virus is very unlikely and the source card is the priority — because if the transfer failed rather than the destination, the originals may still be sitting where they always were.
| Media | Two memory cards — an original holding approximately eleven thousand images, and a recently purchased destination card presenting only a small fraction of them |
| Reported situation | Original memory card holding approximately eleven thousand photographs · new card purchased following a device failure · content transferred from the original to the new card · only a small number of images loading from the destination · malware suspected by the owner as the cause · recovery of the photographs sought |
| Fault class | Transfer incomplete or destination card unsound — source condition to be established before destination recovery is scoped; falsified capacity a candidate explanation |
| Equipment used | Source card assessed before any work on the destination · both cards imaged write-blocked at genuine physical capacity rather than reported capacity · destination card's real capacity measured by direct memory addressing · transfer completeness established by comparing image counts between the two · content carved by signature and validated by opening |
The decode: what to check first, and the explanations worth testing
Why the source card comes first: a copy does not remove. Transferring files leaves the originals in place unless something deleted them afterwards, so the old card is the most likely place her photographs still are.
Why that is worth establishing before anything else: it may end the matter. An intact source card means no recovery is needed at all.
Now the virus question, answered directly: it is very unlikely. Malware that selectively removes photographs while leaving a card mounted and readable is not how any of it behaves, and nothing about the symptom fits.
What fits far better, and it is worth naming: a card that is not what it claims. Newly bought cards from unfamiliar sellers are frequently modest memory reporting a large capacity, which accepts a copy and retains only the genuine portion.
Why that produces exactly what she describes: the copy appears to succeed. The card acknowledges every write, and only what fell within the real capacity survives — which on a large transfer is a handful of files.
What the second candidate is: an interrupted transfer. A copy stopped partway, or a card removed before writing completed, leaves a destination holding only what was written before the interruption.
Why both are distinguished by measurement: the real capacity is knowable. Addressing the memory directly establishes the card's genuine size independently of what it reports.
Why the distinction matters to her: it changes what to do next. A false-capacity card means using a genuine one and copying again from the source; an interrupted copy means the same thing with more care.
What to do about verification in future, stated once: check the count. Comparing the number of files at both ends after a copy takes a moment and catches every incomplete transfer.
What must not happen meanwhile: nothing written to either card. The source is the priority and the destination holds whatever did arrive.
On the bench
The source card was assessed before any work on the destination — copying leaving originals in place, so the old card is the likeliest location of the content. Malware selectively removing images from a mounted readable card does not fit any observed behaviour. Falsified capacity does: a card acknowledging every write while retaining only its genuine portion produces exactly this result. Real capacity was measured by direct memory addressing and counts compared between the two.
The outcome
Source assessed first, both cards imaged at genuine physical capacity, and transfer completeness established by comparison. Free assessment, one fixed written figure including VAT; on cards where content has been deleted or overwritten, the figure is payable upfront. The decode: copying does not remove, so the old card is the first place to look. And a virus does not fit — a newly bought card reporting a capacity it does not have fits perfectly.
After a transfer where most of the files did not arrive
Go back to the source card first and write nothing to either — copying doesn't remove originals, so your photographs are most likely still where they started. Set the virus theory aside: malware that selectively removes images while leaving a card mounted and readable isn't how any of it behaves. Two things fit much better — a newly bought card reporting a capacity it doesn't have, or a copy interrupted partway. In future, compare file counts at both ends.
Check the source first — call Cambridge Data Recovery on 01223 655015; source assessed before the destination, both cards imaged at genuine capacity, completeness established by comparison.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.