Data Recovery Case File · Cameras, Drones & Cards · The Capacity Was a Lie
A Counterfeit Card Reports a Size It Does Not Have and Overwrites Itself Past the Real One
His enquiry names the cause before describing the symptom, which makes the whole case legible. A card "bought as 128 gigabytes which turned out to be counterfeit", where "after two days of recording three hours of footage the card became unreadable" and recovery software achieved nothing. The point at which it failed is a measurement: it marks roughly where the genuine capacity ended and the card began writing over itself.
| Media | Counterfeit memory card presenting a falsely reported capacity — content written beyond the genuine capacity; card unreadable following approximately three hours of video recording |
| Reported situation | Memory card purchased as high capacity · card subsequently identified as counterfeit · card used to record video over two days · approximately three hours of footage written · card becoming unreadable at that point · consumer recovery software attempted without result |
| Fault class | Falsified capacity reporting with writing beyond genuine capacity — earlier content overwritten or discarded; recovery bounded by the real capacity of the memory present |
| Equipment used | Genuine capacity established by direct memory addressing before any recovery was scoped · card read on fixed contact equipment independent of reported capacity · memory read past the controller and the physical extent measured · translation layer reconstructed from the raw arrangement · content carved by signature within the genuine capacity and validated by playback |
The decode: how the deception works, and what it does to the recording
What a counterfeit card physically is: a small card told to lie. Genuine memory of modest capacity is fitted with a controller reprogrammed to report a much larger figure to any host that asks.
Why it appears to work at first: writing within the real capacity is normal. Everything behaves correctly until the amount written exceeds what is genuinely there.
What happens at that point, and it is the crucial part: the card has nowhere to put it. Depending on how the controller was programmed, further writing either wraps back to the beginning and overwrites what is already there, or is silently discarded.
Why that explains the timing of his failure: three hours of footage filled it. The card behaved until the recording passed the genuine capacity, and failed at approximately that moment.
Why that timing is also useful: it estimates the real size. Three hours of video at a known rate gives an approximate figure for what the card actually holds.
Why it became unreadable rather than merely full: the structures were among the victims. Wrapping writes overwrite the beginning of the card, where the filesystem's own descriptors live.
Why consumer software could not help: it trusts the reported capacity. A tool asking for regions the card claims to have receives whatever the controller invents for addresses that do not exist.
What is done instead: the memory is measured. Addressing the package directly establishes the genuine physical capacity, and recovery is bounded by that rather than by the claim.
What can realistically be expected: the most recent material, partially. Where writing wrapped, later footage overwrote earlier footage, so the end of the recording survives and the beginning does not.
Why the honest framing matters more than usual here: the loss is genuine. Overwritten content is gone, and the recoverable portion is limited by physics rather than by effort.
On the bench
Genuine capacity was established by direct memory addressing before any recovery was scoped — counterfeit cards fitting modest genuine memory with a controller reprogrammed to report a larger figure, so writing behaves correctly until it exceeds the real capacity, after which it either wraps to the beginning and overwrites, or is discarded. Wrapping reaches the filesystem descriptors at the card's start, explaining unreadability. The physical extent was measured and recovery bounded by it.
The outcome
Genuine capacity measured before scoping, memory read past the controller, and content carved within the real extent. Free assessment, one fixed written figure including VAT; on cards where content has been overwritten, the figure is payable upfront. The decode: the moment it failed is a measurement. Three hours of footage is roughly what the card genuinely holds — and past that point it was writing over its own beginning.
A card that turned out not to be what it claimed
Stop using it and note when it failed, because that timing estimates the genuine capacity. A counterfeit card is modest real memory with a controller reprogrammed to report a larger figure, so it behaves perfectly until writing exceeds what's actually there — then it either wraps to the beginning and overwrites, or discards silently. Consumer tools can't help because they trust the reported size. Expect the end of a recording to survive and the beginning not to.
Note when it failed — call Cambridge Data Recovery on 01223 655015; genuine capacity measured by direct addressing, memory read past the controller, recovery bounded by the real extent.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.