Data Recovery Case File · Solid State & Flash · The Zero-KB Files

Files reporting "zero KB": the name survives, the substance is unlisted — what a zero-byte entry really means, why the footage usually still exists, and the recovery from a stabilised image of the 4TB drive

His report was precise about a precisely strange symptom. A Samsung T7 Shield 4TB portable SSD holding a professional mix of ".mov and .mp4 files — some of these files are no longer opening, stating that the file size is zero KB. It is essential that we recover these files." A request for a quote on full recovery of the drive. The zero-KB file is a specific and diagnostically rich artifact, and this page decodes it properly: what it actually means when a file's name sits in its folder but its size reads as nothing (the entry survives; the filesystem has lost its link to the substance), why the video data itself usually still exists on the drive, what tends to cause the disconnection on a portable SSD — and why "full recovery of the 4TB" was exactly the right scope to request.

The decode: what zero KB really means, and where the footage went

The anatomy of a zero-byte file: a file, to a filesystem, is two things joined: a directory entry (the name, dates, and size you see in a folder) and an allocation record (the map of exactly where on the drive the file's actual data lives). A file reporting zero KB is a file where the join has failed: the directory entry survives — which is why the name still sits in its folder, taunting — but its size and allocation information have been damaged or severed, so the filesystem believes the file has no substance and can offer nothing when asked to open it. Crucially, this is bookkeeping damage, not data destruction: the megabytes of video that entry once pointed to were not erased when the link broke — they remain written on the drive, unlisted, at the addresses the damaged record no longer names. A zero-KB file is a signpost whose destination has been rubbed off the sign, not a destination that burned down.

What tends to cause it, on a portable SSD: the join usually breaks during a write that didn't complete cleanly — and a portable drive lives in exactly that risk: unplugged mid-copy, disconnected before the system finished flushing, a cable or port flicker during a transfer session. Filesystem metadata is updated constantly during writes, and one unclean interruption at the wrong instant can leave a batch of entries half-updated — which is why the pattern is characteristically some files zeroed while their neighbours are fine, exactly as he describes. Professional video work compounds the exposure: large files mean long writes, and long writes mean wide windows for interruption.

Why "full recovery of the 4TB" was the right ask: his scoping instinct was correct, for two reasons. First, the footage behind the zero-KB entries must be found — recovered either by repairing the metadata (re-linking entries to their data) or by carving the video directly from the drive's contents by signature — and both operations work from a complete image of the whole drive. Second, metadata damage discovered in one corner argues for verifying the entire archive: files that currently list normal sizes deserve confirmation they actually open, because the interruption that zeroed some entries may have grazed others less visibly. Imaging everything and verifying everything is the professional version of his request — and for an archive he calls essential, the only responsible one.

On the bench

The T7 was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb — its native high-speed USB path handling the 4TB completely, the original untouched thereafter. On the image, the recovery ran both roads: the damaged metadata analysed and the zero-KB entries re-linked to their surviving data where the allocation records could be repaired, and the footage carved directly by signature where they couldn't — the video's own internal structure identifying and bounding each clip independent of the broken bookkeeping. Verification was the standard that video demands: every recovered clip played — openings, middles, endings — and the rest of the archive was opened and confirmed alongside, the full-drive scope honoured to the letter.

The outcome

The essential footage recovered from behind its zero-KB entries and the full archive delivered verified by playback. Free assessment, one fixed written figure including VAT, no recovery, no fee. The artifact, decoded for every owner who meets it: zero KB means the name survived and the link to the substance didn't — bookkeeping damage over intact data, usually from an interrupted write — and the footage is typically still on the drive, waiting to be re-linked or carved from an image of the whole.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.