A recovery tool finds a video. Its thumbnail looks right, the player opens, and the first few seconds are familiar. That is useful evidence about a preview. It does not answer whether the complete original file survived.
For developers testing a media recovery workflow, keep three checks separate: what bytes were retained, what the decoder can read, and what the available metadata actually establishes. Here is a small review exercise using your own non-sensitive test media.
1. Keep a known reference before the experiment
Start with a short clip you created and a separate, preserved reference copy. Record its byte length and SHA-256 before doing any recovery experiment. Keep the reference away from the source you will examine and the destination used for exports.
In PowerShell, the following reads two existing files and compares their SHA-256 values. Replace both placeholder paths with files in your test corpus:
$referenceHash = (Get-FileHash -LiteralPath '.\reference\known-good.mp4' -Algorithm SHA256).Hash
$candidateHash = (Get-FileHash -LiteralPath '.\export\candidate.mp4' -Algorithm SHA256).Hash
$referenceHash -eq $candidateHash
Microsoft documents Get-FileHash as a content-based check. Renaming a file does not change its content hash. No example output is supplied here: the comparison depends on the actual files you test.
2. Interpret the comparison narrowly
A matching SHA-256 against a trusted reference is strong practical evidence that the retained bytes match that reference. It does not identify the person who created the media, the application that downloaded it or the time it was recorded.
A mismatch means you have not established a byte-for-byte match. It does not tell you the cause. Truncation, a different container or metadata, and re-encoding can all produce different files. Keep the original export before making a repair or transcode, so you can distinguish the retained candidate from later derivatives.
3. Record the checks that a thumbnail cannot replace
| Check | Record | Limit |
|---|---|---|
| Retained bytes | File length and SHA-256; reference used | A hash without a trusted reference is an identifier, not a completeness result. |
| Playback | Sections examined and any decoder errors | Opening the first frame does not establish that the ending or every stream is decodable. |
| Source context | Image or device identifier and available offset or extents | An offset is a location in that source, not proof of authorship. |
| Dates | Each available value with its recorded source | A filesystem creation date can reflect copying rather than recording. |
| Coverage | Scope, selected mode, interruptions and failed reads | Reading the selected scope does not prove that every original file was recovered. |
Check full decoding separately when it matters to the test. Keep a note of which streams and portions were examined. Do not silently turn an unknown date, an untested ending or a failed read into a successful result.
4. Keep the exercise separate from a product claim
I build Frame Witness, a Windows photo and video recovery application. Its gallery, player and source details are intended to keep these observations together. The official workspace screenshot below uses generated test media in a licensed full-scan workspace; it is a demonstration, not a result from this exercise.
The free account has different limits: a quick scan of the first 8 GB, up to 100 results, previews and saving recovered files up to 1 MB each. Full scans, larger exports and advanced tools require a paid licence. A preview alone should not be presented as proof of complete recovery.
Recovery depends on surviving bytes. Overwrites, SSD TRIM and cryptographic erasure can prevent it. Preserve important sources independently and use a different physical destination for exports. Frame Witness is not a certified forensic product; independent field validation is still needed for institutional use.
For a broader testing reference, NIST's Computer Forensics Tool Testing program develops specifications, procedures and test sets for forensic tools. Linking that methodology is not a claim that Frame Witness was evaluated or endorsed by NIST.
Which check would you add to a media recovery test before calling a candidate a complete original?
Top comments (0)