Can data be recovered from a formatted SD card? Yes, and here is how much
Two second-hand cards that looked empty gave up over 115,000 files to a free tool in minutes. What formatting actually does, how recovery works, and what that means for anyone reselling or disposing of cards.
We bought a batch of used 32 GB cards in September 2026. Two of them mounted on a laptop as empty volumes, a few megabytes of housekeeping and nothing else. Disk Utility declared both healthy. We took a read-only image of each and ran a free, open-source recovery tool over it.
| Card | What a laptop showed | What the tool recovered |
|---|---|---|
| First | empty, 3.6 MB used | 113,247 files: about 110,000 small images, 2,009 configuration records, 1,249 icons, nine databases, five XML files, a settings file |
| Second | empty, 3.4 MB used | 2,639 files: 1,859 graphics, 733 configuration records, eleven databases, several large binaries |
We counted, measured and typed the files. We did not open them. They belong to whoever owned the cards before, and that is the point.
What a format does
The card’s storage is a long run of blocks. The filesystem keeps a directory that says which blocks belong to which file. A format writes a fresh, empty directory. The blocks themselves are untouched until new data lands on them. Every one of 482 samples we took across the first card, spread evenly from start to end, still held data. Nothing had been erased.
How recovery works
A recovery tool ignores the directory and reads the blocks. Most file types start with a recognisable signature, a few bytes that say “this is a JPEG” or “this is a database”. The tool scans for those signatures and copies out what follows. No password, no special hardware, no expertise beyond a tutorial, and about ten minutes per card. Anyone who buys a used card can do it. So can anyone who finds one.
What it means
If a card ever held personal data, a format before resale or disposal is not a defence under UK GDPR. It is the absence of one. The only thing that stops recovery is overwriting every block and confirming it, or destroying the card. After we overwrote the first card with zeros and read every byte back, the same tool recovered nothing.
For a single card, our guide to erasing a card yourself covers the commands. For a batch, or when you need to show an auditor that it was done, our erasure service does it with a certificate per card.
Want the numbers for your media?
Get a rough estimate in seconds, then a fixed quote when you're ready.