Tarjeta SD dañada, medios de cámara ilegibles y recuperación de fotografías RAW¶

For a wedding photographer, filmmaker, journalist, or parent returning from a once-in-a-lifetime trip, few words on an LCD screen are more terrifying than "Card Cannot Be Accessed, Reinsert/Change Card or Format Card with Camera," followed by Windows or macOS popping up "You need to format the disk in drive E: before you can use it." When an SDXC, microSD, CFexpress Type A/B, or XQD memory card suddenly turns into an unmountable RAW partition or appears completely empty (0 bytes used) after a battery dies mid-write or a card reader disconnects prematurely, the raw binary data of your photographs and 4K video frames is almost always still sitting intact inside the NAND flash memory cells.

However, the next 60 seconds are critical. Clicking "Format," running Windows CHKDSK, letting macOS Spotlight index the failing card, or shooting even three "test photos" to see if the camera still works will permanently overwrite the FAT32/exFAT File Allocation Table and destroy contiguous RAW image headers. Rescuing 100 percent of your wedding or event shoot requires flipping the physical write-protect lock immediately, creating a bit-for-bit sector image of the card using a read-only forensic cloning tool, carving sensor-specific RAW formats (.CR3, .ARW, .NEF, .RAF, .DNG), and reconstructing fragmented non-contiguous camera video streams (.MP4 / .MOV / .RSV) that standard file-carving tools split into unplayable pieces.

Haz esto ahora¶

1. Pull the memory card out of the camera immediately and slide the physical Write-Protect Switch (on full-size SDXC/SDHC cards) down to the LOCK position. Never shoot another photo, never run the camera's internal "Image Database Repair / Recover DB" tool before backing up the raw sectors, and never swap the card back and forth between multiple cameras. Every time a camera or operating system mounts a read-write card, it writes hidden system metadata folders (.Spotlight-V100, .Trashes, System Volume Information, o SONY/AVF_INFO) directly over unallocated flash blocks containing your lost photos.
2. Dismiss every "Format Disk" or "Initialize" dialog box immediately by clicking Cancel. When the Master Boot Record (MBR) or exFAT Volume Boot Record corrupts, Windows and macOS assume the card is brand-new unformatted silicon and immediately ask to format it. Clicking Format (especially inside a modern Sony, Canon, or Nikon mirrorless camera) can send a hardware SD ERASE / DISCARD command to the card's internal flash controller that zeroes every block in less than 2 seconds.
3. NEVER run Windows CHKDSK /f or macOS Disk Utility "First Aid" on a corrupted camera card. CHKDSK is not a photo recovery program; it is a file-system sanitizer. When CHKDSK runs on a corrupted exFAT camera card, it forcefully rewrites the allocation bitmap right on top of your fragile card, chops fragmented 4K video files into useless .CHK scraps inside a hidden FOUND.000 folder, and permanently scrambles the cluster chains needed by specialized video-reassembly software.
4. Check if the card feels blisteringly hot to the touch within 5 seconds of plugging it into a USB card reader. If a microSD, SD, or CFexpress card immediately heats up above 60 degrees Celsius (140 degrees Fahrenheit) or smells faintly of ozone/hot plastic when inserted into a reader, unplug it within 1 second. A scorching-hot card has a shorted ceramic capacitor or damaged controller circuit; leaving it plugged in for even 30 seconds will thermally burn a hole straight through the silicon NAND die, making lab recovery impossible.
5. Create a raw byte-for-byte sector image file (.img o .bin) of the entire card onto your computer's hard drive FIRST. Never run recovery scans repeatedly against a worn or glitching flash card. Image the card once using GNU ddrescue, DMDE, or R-Studio, put the physical SD card safely in a protective case, and run all photo and video recovery tools against the .img file on your computer.
6. If you are a wedding or commercial event photographer facing a catastrophic hardware failure (Card shows 0 MB in Disk Management), stop DIY attempts immediately. When a card's internal flash controller fails and reports 0 MB, No Media, o Generic USB Loader in Windows Disk Management / macOS diskutil list, no downloadable software on Earth can see the card. It requires a specialized monolithic NAND pinout / chip-off lab (details in Phase 5 below), and running voltage through it repeatedly accelerates NAND charge bleed.

flowchart TD
    A["Camera displays Card Error / Corrupted / Format Required"] --> B["Remove card immediately and slide SD physical switch to LOCK (Read-Only)"]
    B --> C["Insert into high-quality USB 3.0 card reader and click CANCEL on any OS Format popup"]
    C --> D{"Does the card get burning hot (>60 C / 140 F) within 5 seconds?"}
    D -->|"Yes: Electrical short"| E["Unplug within 1 second; send to Monolithic NAND Chip-Off Data Recovery Lab"]
    D -->|"No: Normal temperature"| F{"Does Disk Management / diskutil list show the card's true capacity (e.g., 64 GB / 128 GB)?"}
    F -->|"No: muestra 0 MB, sin medios o invisible"| E
    F -->|"Sí: muestra la capacidad total de GB como RAW, no asignada o vacía"| G["Cree una imagen de sector sin formato 1:1 (.img) en el disco duro de su PC usando GNU ddrescue o DMDE"]
    G --> H{"¿Qué tipo de archivos estás rescatando?"}
    H -->|"Fotografías fijas (.CR3, .ARW, .NEF, .RAF, .JPG)"| I["Escanee el archivo .img con DMDE, R-Studio, PhotoRec o Disk Drill para extraer archivos RAW + JPEG intactos"]
    H -->|"Cámara/Dron/Vídeo GoPro (.MP4, .MOV, .RSV, .CRM)"| J["Tenga cuidado con la fragmentación de video: use CleverFiles/Disk Drill Advanced Camera Recovery, SanDisk RescuePRO Deluxe o Grau/untrunc con un video de referencia saludable"]

Matriz de diagnóstico: identificación del modo exacto de falla de su tarjeta SD / CFexpress¶

Antes de ejecutar cualquier herramienta, abra Administración de discos de Windows (Win + X -> Disk Management), terminal macOS (diskutil list), o Terminal Linux (lsblk -b) con la tarjeta conectada a un lector de tarjetas USB 3.0 externo dedicado (evite las ranuras SD integradas para portátiles, que a menudo se encuentran detrás de puentes PCIe a SD con errores).

Fase 1: Inspección física y creación de una imagen del sector forense (.img)¶

Before downloading any recovery software, protect the physical card from further electrical or logical wear:

1. Clean oxidized gold contacts and engage the Write-Protect Lock¶

• Inspect the gold contact pads on the back of the SD, microSD, or XQD/CFexpress card. If the card was exposed to ocean salt spray, rain, humidity, or skin oils, gently wipe the gold contacts with a lint-free microfiber swab dampened with 99% Isopropyl Alcohol (IPA) and let it dry for 60 seconds.
• On a full-size SDHC/SDXC card (or a microSD-to-SD adapter), slide the tiny white or gray plastic tab on the left edge down toward the bottom edge (LOCK). (Note: The physical SD lock switch is actually a mechanical feeler read by the card reader slot, not an internal electronic circuit inside the SD card itself; therefore, we also mount the card read-only in software).

2. Create a 1:1 Bit-Stream Image (.img o .dsk) of the Card FIRST¶

Never run three different photo-recovery programs directly against a glitching SD card. Flash memory cards experiencing controller read errors can suddenly lock up into permanent 0 MB controller safe mode if hammered by millions of random seeks.

Instead, copy every sector of the card sequentially in one single pass onto your computer's internal SSD or hard drive:

Option A: Using GNU ddrescue (Linux or macOS Terminal, Best for cards with bad sectors or slow reads)¶

# 1. Identify the exact block device name of your SD/CFexpress card (e.g., /dev/sdb on Linux or /dev/disk4 on macOS)
lsblk -o NAME,SIZE,MODEL,RO   # (On macOS use: diskutil list)

# 2. First pass: Copy all healthy, fast-reading sectors into a single .img file on your PC hard drive
# (On macOS, use /dev/rdisk4 instead of /dev/disk4 for 10x faster raw unbuffered I/O)
sudo ddrescue -b 512 -c 128 -n /dev/sdb ~/Desktop/wedding_card1_backup.img ~/Desktop/wedding_card1.map

# 3. Second pass: Scrape any remaining slow or damaged sectors using direct I/O
sudo ddrescue -d -r 3 /dev/sdb ~/Desktop/wedding_card1_backup.img ~/Desktop/wedding_card1.map

Option B: Using DMDE or R-Studio on Windows / macOS (Free GUI Imaging)¶

1. Download DMDE (DM Disk Editor and Data Recovery) (free edition works unrestricted for disk imaging and full-directory recovery) or R-Studio.
2. Open DMDE as Administrator -> Select Physical Devices -> Highlight your SD/CFexpress card -> Click Tools -> Copy Sectors.
3. Set Source as the entire physical SD card (Start Sector 0 to End Sector), and set Destination to a File on your computer's hard drive named wedding_card1_backup.img.
4. Once the .img file reaches 100 percent, unplug the physical SD card from your computer and put it in a safe. For the rest of this guide, you will open and scan wedding_card1_backup.img dentro de sus herramientas de recuperación, lo que significa cero riesgo de dañar su tarjeta original.

Phase 2: Recovering RAW Photographs (.CR3, .CR2, .ARW, .NEF, .RAF, .ORF, .DNG) and JPEGs¶

Once you have your wedding_card1_backup.img file safely stored on your computer, how you extract your still photographs depends on whether the file system metadata can be reconstructed or whether you need raw signature carving:

Step 1: Check the First Few Sectors in a Hex Viewer (The 10-Second "Hardware Erase" Check)¶

If the card was accidentally formatted inside a camera (especially a Sony Alpha or CFexpress Type A/B camera), open wedding_card1_backup.img inside DMDE or a free hex editor (HxD on Windows, Hex Fiend on macOS) and scroll down through the middle of the image (around offset 1 GB a 10 GB): * If you see rich blocks of random hexadecimal characters (A4 7F 19 C2 88...) and ASCII strings like Canon EOS R5, SONY ILCE-7M4, o NIKON Z 8: Breathe a huge sigh of relief. Your photos are physically intact inside the image file and 99 to 100 percent recoverable. * If the entire image from start to finish contains nothing but solid 00 00 00 00 o FF FF FF FF: The camera executed a hardware CMD38 SD Erase / NVMe TRIM command. Because the flash translation layer (FTL) was wiped at the controller level, no software can read the sectors through the USB interface (only an advanced lab with direct NAND chip access has any chance, and even then only if controller background garbage collection has not yet zeroed the raw NAND pages).

Step 2: Reconstruct the Original Folder Tree and Filenames First (DMDE / R-Studio)¶

Always try File System Reconstruction before pure "File Carving." Why? File System Reconstruction reads the surviving backup exFAT/FAT32 directory tables to recover your exact original filenames (_DSC4812.ARW, 100CANON/IMG_9021.CR3), subfolders, and contiguous chains: 1. Open wedding_card1_backup.img in DMDE or R-Studio. 2. Select the main partition (or run Full Volume Scan if the partition table was wiped). 3. Expand the $Root / DCIM directory tree. 4. Select your camera folder (e.g., 100MSDCF, 100CANON, 101ND850, 100_FUJI) and click Recover to save all files to a new folder on your computer.

Step 3: Deep RAW Signature Carving with PhotoRec (When the File Table is Completely Destroyed)¶

If the directory table was overwritten and filenames are gone, use PhotoRec (bundled free with TestDisk by CGSecurity for Windows, macOS, and Linux). Unlike generic consumer tools that only understand .JPG, PhotoRec has native binary header/footer parsers for almost every professional camera RAW format ever made: * Canon: .CR3 (ISO Base Media ftypcrx container used by EOS R5/R6/R3/R1), .CR2, .CRW * Sony: .ARW (TIFF-based Sony Alpha RAW) * Nikon: .NEF y .NRW * Fujifilm: .RAF (FUJIFILMCCD-RAW header) * Leica / Hasselblad / DJI / Pentax / Olympus: .DNG, .3FR, .FFF, .PEF, .ORF / .ORI

# Run PhotoRec directly against your rescued .img disk image file:
photorec ~/Desktop/wedding_card1_backup.img

1. En PhotoRec, seleccione [File Opt] primero en la parte inferior, presione s para anular la selección de formatos de texto oscuros y habilitar tif (que cubre .ARW, .NEF, .CR2, .DNG), mov/mp4 (que también cubre Canon .CR3 ftypcrx), raf, y jpg.
2. Seleccionar [Whole] (escanee toda la partición, no solo el espacio no asignado) y elija una carpeta de destino en su PC.
3. Consejo importante para archivos RAW basados ​​en TIFF (.ARW, .NEF, .CR2, .DNG): Porque Sony .ARW, nikon .NEFy adobe .DNG files share the exact same TIFF magic bytes (49 49 2A 00 / II*) como estándar .tif archivo, PhotoRec puede ocasionalmente nombrar una foto RAW recuperada f123456.tif. Simplemente inspeccione los metadatos EXIF ​​con exiftool y cambiar el nombre de esos archivos por lotes a .ARW o .NEF using one command:

# Automatically rename and organize all PhotoRec-carved RAW and JPEG photos by Camera Model and Date Taken using ExifTool:
exiftool -r '-FileName<CreateDate' -d '%Y%m%d_%H%M%S%%-c.%%le' ~/Desktop/photorec_recovered_folder/

Phase 3: The Video Recovery Trap, How to rescue fragmented 4K/8K .MP4, .MOV, y .RSV files¶

He aquí un doloroso shock que golpea a los videógrafos de bodas, YouTubers, usuarios de GoPro y pilotos de drones DJI durante una emergencia con una tarjeta: Ejecutas PhotoRec, R-Studio o Recuva en la imagen de tu tarjeta SD corrupta; 100 por ciento de tu .CR3 / .ARW las fotos fijas quedan nítidas y la herramienta también recupera cuarenta archivos de 8 GB .MP4 o .MOV video files, but when you double-click any of those recovered .MP4 files in VLC or Premiere Pro, NONE of them will play.

Why standard recovery software fails on modern camera video (Fragmented Interleaved Streams)¶

• Still Photos (25 MB a 80 MB): Stored by the camera as one single contiguous block of sectors on the card. A standard file carver finds the JPEG/RAW start header, reads straight forward until the end-of-file footer, and saves a working photo.
• Modern 4K/6K/8K Camera, Drone, and Action Cam Video (2 GB a 64 GB): Modern cameras do NOT write video contiguously. As you record, the camera writes three or four simultaneous data streams to different clusters across the card at the same time:
• The high-bitrate Main Video + Audio stream (.MP4 o .MOV);
• A simultaneous Low-Res Proxy Video stream (.LRV on GoPro/DJI, or sub-stream proxy on Sony FX3/A7SIII);
• A Real-Time Telemetry / Gyro Stabilization XML or .SRT stream (Sony Catalyst Gyro metadata, DJI flight logs); and
• Periodic Thumbnail .THM snapshots.
• Because these streams are interleaved every few megabytes across the flash card, your main 10 GB .MP4 wedding ceremony video is actually broken into thousands of non-contiguous fragments scattered across the disk. If the exFAT cluster allocation table is wiped, a standard file carver just grabs a contiguous 10 GB chunk of raw sectors containing mixed-up pieces of main video, proxy .LRV video, and XML telemetry, producing a corrupt, unplayable file.

Cómo recuperar con éxito el vídeo de la cámara fragmentado o no finalizado¶

Dependiendo de cuál de los dos modos de falla de video tenga, utilice estos flujos de trabajo especializados:

Escenario A: El archivo de vídeo existe en la tarjeta (o tiene el nombre .RSV en Sony / .TMP), tiene un tamaño de gigabyte completo, pero no reproduce¶

Cuando la batería de una cámara se agota, una tarjeta se sobrecalienta o un dron se estrella en pleno vuelo, el vídeo no está fragmentado, simplemente nunca se cierra moov Índice de átomo/encabezado escrito antes del corte de energía (las cámaras Sony guardan estas grabaciones interrumpidas en el archivo PRIVATE/M4ROOT/CLIP/ carpeta con un .RSV extensión).

Puedes reparar un encabezado faltante .MP4, .MOV, o .RSV archivo a 100% de calidad original en menos de 60 segundos usando un "Archivo de referencia saludable" grabado exactamente en la misma cámara con exactamente la misma resolución, velocidad de fotogramas y configuración de códec:

# Free Open-Source Method: Use 'untrunc' (specifically the anthwlock/untrunc fork, which supports modern Sony XAVC-S/HS, Canon XF-AVC/HEVC, GoPro, and DJI codecs)
# 1. Supply ONE healthy, playable .MP4/.MOV file recorded on the same camera with identical settings (healthy_reference.mp4)
# 2. Supply your unplayable corrupted video or Sony .RSV file (corrupted_clip.RSV)
untrunc -s healthy_reference.mp4 corrupted_clip.RSV

Scenario B: The Card Was Formatted or turned RAW, so Video Clusters Are Fragmented Without an Allocation Table¶

If the exFAT file table was wiped by an accidental Quick Format or severe corruption, standard file carvers cannot reassemble interleaved video fragments. You must use a Fragment-Aware Video Carver that inspects individual H.264/HEVC/ProRes frame headers and stitches fragmented clusters back together separate from .LRV proxy streams: 1. SanDisk RescuePRO Deluxe (by LC Technology; works on any brand of SD/CFexpress .img file, not just SanDisk, specifically engineered with a dedicated "Fragmented GoPro/Sony/Canon/DJI Video Recovery" engine that de-interleaves main video from proxy streams). 2. Disk Drill 5+ ("Advanced Camera Recovery" Mode): In recent versions, Disk Drill added a dedicated Advanced Camera Recovery (ACR) module that parses fragmented GoPro, DJI, Sony, Canon, and Insta360 cluster patterns inside .img disk images and rebuilds playable .MP4/.MOV containers. 3. AeroQuartet Treasured (macOS/Servicio forense profundo multiplataforma): Para rodajes comerciales de alto riesgo o Cinema RAW Light (.CRM), RED .R3D, or Blackmagic .BRAW cards where automated de-interleaving fails, AeroQuartet's diagnostic tool inspects the raw .img sectors and writes a custom cluster-stitching script for your specific camera model's allocation stride.

Phase 4: Rescuing files hidden by the Windows "Shortcut / Hidden Attribute" Malware¶

Sometimes a photographer plugs their event SD card into a client's or hotel's infected Windows laptop to preview photos, and suddenly all folders inside the SD card turn into 1 KB .lnk shortcuts while the actual photos vanish (even though Windows Properties still shows 48 GB Used Space). * Do NOT format the card. The malware simply changed the FAT/exFAT file system attributes of your real DCIM folder to Hidden (+H) and System (+S). * To instantly unhide and copy your real photos without running any recovery scan: * On macOS or Linux: Simply plug the card in (with the physical switch set to LOCK) and press Cmd + Shift + . (macOS) or Ctrl + H (Linux) to show hidden files. Your real DCIM folder will appear immediately, completely unharmed, ready to copy to your drive. * On Windows (after unlocking only once backed up, or browsing via 7-Zip / Total Commander in read-only mode): Open the free 7-Zip File Manager (7zFM.exe), navigate to your locked SD card drive letter (E:\), and 7-Zip will completely ignore Windows Hidden/System attributes, showing your real DCIM folder so you can copy all photos out while keeping the SD card hardware-locked.

Phase 5: When the Card Controller Dies (0 MB / No Media), Monolithic NAND Chip-Off Recovery¶

What if your SD card, microSD card, or CFexpress card does not show its capacity in Disk Management at all, reporting 0 MB, No Media, 31.5 MB RAW, or disconnecting every 3 seconds?

How Monolithic Flash Cards Are Built and How Labs Recover Them¶

1. Standard PCB vs. Monolithic Package:
2. CFexpress Type B / XQD Cards and Older Full-Size SD Cards: Often contain a miniature internal Printed Circuit Board (PCB) with discrete BGA NAND flash chips and a separate controller chip (often an NVMe PCIe controller inside CFexpress cards). If a power surge blows a tiny SMD capacitor or TVS diode on the CFexpress PCB, a lab can replace the component in 20 minutes and read 100 percent of your files.
3. All microSD Cards and Most Modern Tough/Waterproof SD Cards ("Monoliths"): The controller, circuits, and raw NAND silicon die are all fused together inside a single solid block of black epoxy resin.
4. How a Monolithic Recovery Lab Rescues a Dead SD/microSD Card:
5. You cannot fix a 0 MB monolithic card with software because the internal ARM microcontroller is brain-dead or locked out by a corrupted firmware translator table.
6. A specialized flash recovery lab places the back of your microSD or SD card under a stereomicroscope and gently sands away a hair-thin 0.1 mm layer of black paint on the back of the card, exposing a hidden constellation of microscopic gold/copper diagnostic test pads.
7. Using a multi-probe spider jig (PC-3000 Flash Spider Board or micro-soldering 0.05 mm enamel wires to 20+ pads), the engineer bypasses the dead SD controller entirely and connects a logic analyzer directly to the raw 8-bit NAND flash data bus (D0-D7, ALE, CLE, WE, RE, CE, R/B).
8. The lab dumps the raw binary NAND pages, applies hardware ECC (Error-Correcting Code / LDPC), reverses the controller's XOR data scrambling pattern, and rebuilds the Flash Translation Layer (FTL) block table to output your original .CR3 / .ARW / .MP4 archivos.
9. Lab Cost and Avoiding Scams: True monolithic NAND pinout recovery requires expensive hardware and deep reverse-engineering skill, typically costing $300 to $900 USD at dedicated flash-recovery specialist labs (never take a 0 MB monolithic SD card to a retail big-box computer repair store, which will only plug it into a standard USB reader, run consumer software that does nothing, and risk cracking the silicon die).

Prevention checklist for wedding, event, and field photographers¶

Once your current emergency is resolved, implement these five field rules so a single SD card failure can never threaten a shoot again:

1. Always Shoot Redundant (Dual Slot RAW+RAW Backup) on Critical Events: If your camera has two card slots, never configure them as Overflow / Relay o RAW to Slot 1 + Small JPEG to Slot 2 during a wedding or paid event. Set the camera to Simultaneous Redundant Recording (RAW + RAW to both Slot 1 and Slot 2) so every shutter press writes an identical RAW file to two separate physical cards simultaneously.
2. Format Cards ONLY Inside the Camera Before Each Shoot (Never Delete Individual Files on a Computer): Never plug an SD card into your Mac or Windows PC, highlight last week's photos, drag them to the Trash/Recycle Bin, and put the card back into your camera without formatting. Deleting files on a computer fragments the exFAT cluster map and leaves hidden OS trash directories on the card, which is the #1 trigger for mid-shoot camera database corruption. Instead, verify your previous shoot is backed up in 3 places (see Copias de seguridad informáticas: estrategia 3-2-1 y recuperación ante desastres), then format the card cleanly inside the camera menu before starting the new event.
3. Never Let a Camera Battery Hit 0% While Recording Video: Swap camera batteries at 15% to 20% remaining charge. A sudden voltage drop during a heavy 4K/60p buffer flush can corrupt the exFAT allocation bitmap or leave video files without a moov header.
4. Espere 3 segundos completos después de que se apague el LED rojo de acceso a la tarjeta antes de abrir la puerta de la tarjeta: Las cámaras modernas de alta megapíxeles almacenan en el buffer docenas de fotografías RAW en la RAM interna y continúan escribiendo en la tarjeta SD/CFexpress durante varios segundos después de dejar de presionar el obturador o girar el interruptor de encendido para OFF. Al abrir la puerta de la ranura para tarjetas mientras la luz roja de acceso está encendida, se interrumpe la actualización de la tabla de traducción flash y la tarjeta se gira instantáneamente. RAW.

Preguntas frecuentes¶

Guías relacionadas¶

• Eliminación accidental de archivos, unidad formateada y recuperación de fotografías
• Fallo del disco duro y recuperación de datos.
• Copias de seguridad informáticas: estrategia 3-2-1 y recuperación ante desastres
• Rescate de datos de teléfonos rotos o dañados por el agua
• Fallo de la matriz RAID, grupo de almacenamiento NAS dañado y seguridad de reconstrucción
• Números de emergencia globales

Fuentes verificadas¶

• Asociación SD (SDA) (internacional): Especificación simplificada de capa física SD versión 9.00 (CMD32/CMD33/CMD38 Protocolo de borrado/descarte y arquitectura de interruptor mecánico de protección contra escritura).
• CGSecurity (Internacional): Oficial TestDisk y PhotoRec Documentación técnica para el tallado de Canon basado en firmas .CR3/.CR2, sony .ARW, nikon .NEFy Fujifilm .RAF Formatos RAW de cámara.
• Proyecto GNU/Fundación de Software Libre (Internacional): GNU ddrescue Manual de imágenes a nivel de bloque para medios flash degradados.
• Organización Internacional de Normalización (ISO/IEC) (Internacional): ISO/IEC 14496-12 (Formato de archivo multimedia base ISO: ftyp, mdat, y moov Estructura del encabezado del átomo en .MP4, .MOV, y .CR3 Contenedores).
• Instituto Nacional de Estándares y Tecnología (NIST) (Estados Unidos): Publicación especial 800-86 y SP 800-101 Rev. 1 (Directrices sobre análisis forense de dispositivos móviles y medios de memoria flash).