File Carving Explained for Tesla Owners

Q: How does confidence scoring work?

Each candidate clip gets a 0–100 score from seven factors: valid ftyp brand, mdat size in range, moov presence, moov parseability, timestamp plausibility, file-size sanity, and cluster alignment — with a small bonus for Tesla-specific video dimensions.

What is file carving?

File carving recovers files by reading the raw bytes of a storage device directly — ignoring the file system — and looking for recognisable file signatures that mark the start of known file types.

It's the digital equivalent of walking through a warehouse with no inventory list, identifying boxes by the labels printed on their sides rather than by looking up a shelf number in a ledger. When the ledger is missing (formatted drive) or unreliable (corrupted file system), the labels-on-boxes approach still works.

Why the file system matters, and when it doesn't

Normally, when you double-click a video file on your computer, this is what happens:

The operating system looks up the filename in the drive's directory table.
The directory table tells it which physical sectors hold the file's data.
Those sectors are read, assembled, and handed to your video player.

Two things can go wrong with that chain. The directory table can be wiped (that's what formatting does) or it can become corrupted (that's what happens when a Tesla USB drive is yanked mid-write or develops bad sectors). In either case, the operating system has no idea which sectors hold your clips, so it reports the drive as empty or unreadable.

File carving sidesteps the whole problem. It reads the raw sectors and looks for file-type fingerprints directly in the data — no directory table required.

What the "signature" is for MP4 files

Every standard MP4 file starts with an ftyp atom. The word "ftyp" appears in ASCII at byte offset 4 of the file, preceded by a 4-byte size field. If you see the four bytes 66 74 79 70 (ASCII "ftyp") at offset 4 of a block, you're almost certainly looking at the start of an MP4.

The carver scans through the drive, one cluster at a time, and checks each cluster's fifth through eighth bytes for that pattern. When it finds one, it's found a candidate clip.

Why is cluster-aligned scanning so fast on Tesla drives?

On an exFAT drive with 128 KB clusters, files begin at cluster boundaries. For a standard MP4, the ftyp marker is four bytes after the file start, so the scanner checks each cluster start for an MP4 header.

This matters because the carver can check cluster boundaries for candidate MP4 signatures. It does not need to compare every byte as a possible file start. Scan time also depends on the drive and its connection.

Validating each candidate

Finding an ftyp signature doesn't mean the file is complete or playable — it just means there was an MP4 that started in that cluster. The carver then parses the internal structure:

ftyp atom — checks the brand identifier. Tesla uses mp42, so anything else is deprioritised.
mdat atom — locates the video-data block and checks its size is in a plausible Tesla range (typically 15–75 MB for a one-minute clip).
moov atom — Tesla writes the metadata atom at the end of the file, so the carver seeks to the end of the mdat region and parses what follows. A valid moov with parseable mvhd and trak sub-atoms is a strong signal the clip is intact.

How does confidence scoring work?

The parsing steps feed a confidence score from 0 to 100. Seven factors contribute: valid ftyp brand, mdat size in range, moov presence, moov parseability, timestamp plausibility (Tesla era 2018–present), file-size sanity, and cluster alignment. There's a small bonus for Tesla-specific video dimensions (1280×960, 1280×720, or 1920×1080).

A 0–100 score means you can see upfront, before saving anything to disk, which clips will play back without visible problems, though a score cannot guarantee this and which might have gaps. A score above 85 means the clip is structurally complete; below 40 means something's meaningfully wrong and you may get playback glitches.

Where filename recovery fits in

File carving alone produces a folder of MP4 files with generic names — clip-000001.mp4, clip-000002.mp4. That's fine for the raw data but terrible for organising a Sentry event across all of its camera angles.

A good Tesla-aware carver does a second pass over the drive's directory entries — even deleted ones, which exFAT marks but doesn't immediately overwrite — and matches each carved clip to its original Tesla filename by disk offset and file size. When that matching works, you get clips named 2026-04-17_14-30-22-front.mp4, grouped by Sentry event folder, with camera-angle badges. That's the difference between "I found your videos" and "here's your Sentry event, with all its camera angles, just like Tesla wrote it."

Plain-English summary

File carving reads the drive sector by sector, looks for MP4 fingerprints, parses what it finds to validate the files are complete, and provides available recovery assessments before you select footage to export and check. It works on formatted and corrupted drives because it doesn't rely on the file system — only on the data itself.

Sources & references

ISO/IEC 14496-12:2022 — ISO base media file format (the MP4 / ftyp / moov / mdat atom specification)
Microsoft exFAT file system specification (cluster size, allocation, directory entry layout)
Tesla owner's manual — Dashcam & Sentry Mode storage
Which software should I use to recover deleted Tesla dashcam footage?

What if your clips are encrypted?

On supported cars — those with the AMD Ryzen infotainment computer — new Dashcam and Sentry clips on the USB drive are encrypted by default, since Tesla software 2026.20. An encrypted clip is not an ordinary MP4: carving it back off the drive recovers the data, but the file will not play until it is also decrypted. ClipSalvage does both in one pass — it carves the encrypted containers out of unallocated space and decrypts them into playable MP4s, so a deleted or formatted drive is not a dead end.

Clips recorded before the update, clips recorded with Controls > Safety > Encrypt Dashcam Recordings switched off, and clips from cars without the feature (older Intel-based cars, and vehicles in mainland China, where Tesla has not enabled it) are ordinary MP4 files, and everything on this page applies to them unchanged. Full detail: Tesla dashcam encryption: what it means for recovery.

File carving explained for Tesla owners