File carving explained for Tesla owners

The idea in one sentence

File carving recovers files by reading the raw bytes of a storage device directly — ignoring the file system — and looking for recognisable file signatures that mark the start of known file types.

It's the digital equivalent of walking through a warehouse with no inventory list, identifying boxes by the labels printed on their sides rather than by looking up a shelf number in a ledger. When the ledger is missing (formatted drive) or unreliable (corrupted file system), the labels-on-boxes approach still works.

Why the file system matters, and when it doesn't

Normally, when you double-click a video file on your computer, this is what happens:

1. The operating system looks up the filename in the drive's directory table.
2. The directory table tells it which physical sectors hold the file's data.
3. Those sectors are read, assembled, and handed to your video player.

Two things can go wrong with that chain. The directory table can be wiped (that's what formatting does) or it can become corrupted (that's what happens when a Tesla USB drive is yanked mid-write or develops bad sectors). In either case, the operating system has no idea which sectors hold your clips, so it reports the drive as empty or unreadable.

File carving sidesteps the whole problem. It reads the raw sectors and looks for file-type fingerprints directly in the data — no directory table required.

What the "signature" is for MP4 files

Every standard MP4 file starts with an ftyp atom. The word "ftyp" appears in ASCII at byte offset 4 of the file, preceded by a 4-byte size field. If you see the four bytes 66 74 79 70 (ASCII "ftyp") at offset 4 of a block, you're almost certainly looking at the start of an MP4.

The carver scans through the drive, one cluster at a time, and checks each cluster's fifth through eighth bytes for that pattern. When it finds one, it's found a candidate clip.

Cluster-aligned scanning — why it's fast on Tesla drives

Tesla formats USB drives as exFAT with 128 KB clusters. exFAT always writes files aligned to cluster boundaries, which means the ftyp signature of every Tesla clip will appear at a multiple of 128 KB — never in the middle.

This matters because it lets the carver skip ahead. Instead of checking every single byte of a 128 GB drive (a trillion comparisons), it only checks one position per 128 KB cluster — roughly a million comparisons. Same coverage, ~131,000x faster. A full 128 GB scan finishes in minutes rather than hours.

Validating each candidate

Finding an ftyp signature doesn't mean the file is complete or playable — it just means there was an MP4 that started in that cluster. The carver then parses the internal structure:

1. ftyp atom — checks the brand identifier. Tesla uses mp42, so anything else is deprioritised.
2. mdat atom — locates the video-data block and checks its size is in a plausible Tesla range (typically 15–75 MB for a one-minute clip).
3. moov atom — Tesla writes the metadata atom at the end of the file, so the carver seeks to the end of the mdat region and parses what follows. A valid moov with parseable mvhd and trak sub-atoms is a strong signal the clip is intact.

Confidence scoring

The parsing steps feed a confidence score from 0 to 100. Seven factors contribute: valid ftyp brand, mdat size in range, moov presence, moov parseability, timestamp plausibility (Tesla era 2018–present), file-size sanity, and cluster alignment. There's a small bonus for Tesla-specific video dimensions (1280×960, 1280×720, or 1920×1080).

A 0–100 score means you can see upfront, before saving anything to disk, which clips will play back perfectly and which might have gaps. A score above 85 means the clip is structurally complete; below 40 means something's meaningfully wrong and you may get playback glitches.

Where filename recovery fits in

File carving alone produces a folder of MP4 files with generic names — clip-000001.mp4, clip-000002.mp4. That's fine for the raw data but terrible for organising a Sentry event across six cameras.

A good Tesla-aware carver does a second pass over the drive's directory entries — even deleted ones, which exFAT marks but doesn't immediately overwrite — and matches each carved clip to its original Tesla filename by disk offset and file size. When that matching works, you get clips named 2026-04-17_14-30-22-front.mp4, grouped by Sentry event folder, with camera-angle badges. That's the difference between "I found your videos" and "here's your Sentry event, with all six cameras, just like Tesla wrote it."