File Corruption

File corruption means the bytes that make up a file’s contents have been altered, lost, or scrambled in a way that prevents the application from interpreting them correctly. The file itself is the unit of failure. The drive’s hardware may be reading and writing perfectly. The file system locating the file on disk may be entirely intact. Other files on the same drive may open without any issues. Only the affected file’s content has been damaged.¹

How a corrupted file looks to applications

The exact symptom depends on the file format and what was damaged:

• Refusal to open: the application reports the file is corrupted, damaged, or in an unrecognized format. Common with documents, archives, and structured formats where damaged headers prevent any interpretation.
• Partial open with missing content: the file opens but parts are blank, truncated, or replaced with placeholder content. Common with media files where damaged frames or sections become unreadable.
• Visual artifacts: images display with garbled colors, repeated patterns, or missing regions. Audio files play with static or skips. Videos play with blocky artifacts or playback failures.
• Application crashes when opening: the parser inside the application encounters malformed data and fails ungracefully. Less common in modern applications with defensive parsing.
• Silently incorrect content: the file opens normally but contains wrong data. The hardest type to detect; a numeric value in a spreadsheet may be subtly altered without any visual indication.

The “single file vs many files” diagnostic

The pattern of which files are affected tells you something about the cause. One specific file failing while others on the same drive open normally is a different problem from many files failing simultaneously.

Pattern	Likely cause	First step
Single file affected	Application crash during save, file-specific malware	Application repair tool (Open and Repair)
Files in one directory affected	Sync error, application bug, ransomware	Version history retrieval
Files across whole drive affected	File system corruption or media failure	SMART check, then CHKDSK or fsck
Files of same type across drives	Application bug, format incompatibility	Application update or reinstall
Files appearing fine but content wrong	Silent corruption, possibly hardware	Compare with known-good backup

Most articles about “corrupted files” conflate two different problems. The distinction matters because the recovery approaches are entirely different.²

File-level corruption

The file’s bytes are damaged. The file system that locates the file is intact: Windows or macOS finds the file at its correct path, reports its correct size, can read the bytes off disk. The damage is in the bytes themselves, not in finding them. Recovery happens at the application level (Open and Repair, version history) or with format-specific repair tools that understand the file format and can rebuild damaged sections.

File-system-level corruption

The structures that organize files on disk are damaged. The Master File Table (NTFS), the directory entries (FAT32), the catalog file (HFS+), or equivalent structures on other file systems hold pointers to where files live. If those structures are damaged, the operating system can’t find files even when the files themselves are intact on disk. Recovery happens at the file-system level: CHKDSK, fsck, or partition recovery tools like TestDisk. If the file system is severely damaged, the volume may show as RAW in Disk Management.

Why the distinction matters

Tools designed for one don’t work for the other. Running CHKDSK on a single corrupted file does nothing; CHKDSK only fixes file system structures. Conversely, opening a Word document with a corrupt MFT entry won’t help if the document file itself is fine but Windows can’t locate it. Diagnosis first, tool selection second. The “single file vs many files” pattern from above is the clearest indicator: single file = application or file-level, many files across the drive = file system or media level.

Several distinct mechanisms produce file corruption. Understanding which mechanism applies to your situation helps choose the right recovery path.³

Write interruption

The most common cause. When an application saves a file, it issues a series of write operations to the storage system. If those operations are interrupted before completion, the file ends up partially written. Causes include power loss during save, system crash, application crash, or improper disconnect of an external drive while a write is in progress. Modern applications mitigate this with techniques like write-then-rename (write to a temporary file, then atomically rename) but not all applications use these patterns.

Application bugs

Software bugs in the application that creates the file can produce malformed output. The file is “born corrupt” because the application generated invalid bytes. This is more common during rapid software releases, in beta versions, or after operating system updates that change underlying APIs. Affected files are often unrecoverable through file repair tools because the bytes were never correct; recovery means recreating the content.

Malware

Malware including ransomware deliberately damages files to make them inaccessible. Ransomware encrypts files; other malware variants randomly damage files to disrupt operations. Detection is usually obvious (many files affected at once, ransom notes appear, file extensions changed), but some variants damage files quietly to evade detection until extensive damage has accumulated. Recovery requires either restoration from backups or, in rare cases, decryption keys recovered from law enforcement takedowns.

Bit-flip errors

Storage media and memory occasionally suffer single-bit errors from electrical noise, cosmic ray interactions, or aging hardware. A single bit changing in a file can render it unreadable if the affected bit is in a header or critical structure. Modern drives include error-correction coding that catches and fixes most bit-flips before they reach the user, but some still get through. ECC RAM mitigates bit-flips in memory; consumer systems typically don’t include ECC.

Format mismatch

Files can appear corrupt when opened in applications that don’t fully support the format used to create them. The file isn’t actually corrupted; the destination application can’t interpret it correctly. Common scenarios: opening a newer Office document in older Office versions, opening a Pages document in Word, or opening a Photoshop file in a free editor that doesn’t support all features. The fix is opening with a compatible application or converting the format.

Media wear

Storage media eventually wears out. Hard drives develop bad sectors; SSDs reach NAND wear-out limits. Files stored on aging media can become corrupt as the underlying storage cells fail. SMART data and periodic surface scans catch this proactively. Files in the affected sectors may already be unreadable when discovered; the rest of the drive may still be healthy.

Silent corruption is file corruption that goes undetected for extended periods because the file appears to work normally on casual access. The corruption sits in parts of the file that aren’t usually read. Documents may have damage in pages users haven’t reached. Videos may have damage in late frames users haven’t watched. Database files may have corruption in records that haven’t been queried.⁴

The cascading-failure problem

Wikipedia describes silent corruption as causing cascading failures: a system runs for a period of time with undetected initial errors, causing increasingly more problems until ultimately detected. For example, file system metadata corruption can result in multiple files being partially damaged or made completely inaccessible as the file system continues being used in its corrupted state. By the time silent corruption surfaces, the damage may have spread.

Why backups can be silently corrupted

Backups copy whatever state the source is in. A backup taken from a silently-corrupted source contains the same silent corruption. If the corruption isn’t detected before the source is lost or overwritten, the backup that should have been the safety net contains the same damage. This is particularly insidious for archive backups not regularly tested; the corruption may go unnoticed for years until the archive is needed.

Detection requires active checking

Silent corruption can’t be detected by simply opening files casually. Detection requires:

• Checksums: file systems with built-in checksumming (ZFS, Btrfs) detect bit-level corruption automatically. Consumer file systems (NTFS, FAT32, APFS, exFAT) don’t include this.
• Periodic verification: running file integrity checks against known-good hashes catches corruption proactively.
• Backup test restores: periodically restoring from backups and verifying contents catches silent corruption in archives.
• Application-level integrity: some applications include their own checksum verification (Git, archive formats with internal CRC).

Recovery for corrupted files follows a tiered approach: start with the cheapest, fastest options that don’t require any specialized tools, escalate to format-specific repair if those fail, and reach for general data recovery software only when the corruption resulted from storage failure rather than application errors.⁵

Tier 1: Application-level repair

Many applications include built-in repair functions for their own file formats:

• Microsoft Office: Open and Repair. File → Open → Browse → select file → click drop-down arrow next to Open → Open and Repair. Works on Word, Excel, and PowerPoint files with header damage.
• Adobe applications: Photoshop, Illustrator, and InDesign have crash recovery that opens auto-saved versions automatically.
• Archive programs (7-Zip, WinRAR): have repair functions for damaged archives that can extract intact portions.
• VLC and other video players: can sometimes play damaged video files when other players cannot, by skipping unreadable sections.

Tier 2: Previous version retrieval

If the application doesn’t have a built-in repair, retrieve a previous version of the file:

• Windows File History: right-click the file → Properties → Previous Versions tab. Requires File History to have been enabled before the corruption.
• macOS Time Machine: open the file’s location → enter Time Machine → navigate to a date before corruption.
• OneDrive, Google Drive, Dropbox: all maintain version history. Check the cloud service’s web interface for previous versions.
• Office 365 AutoSave: if AutoSave was enabled, version history is available within the file’s Info pane.
• Source control: for code or text files in a Git repository, previous versions are always available.

Tier 3: Format-specific repair tools

Specialized tools for specific file types:

• JPEG/PNG: tools like Stellar Repair for Photo, JPEG Recovery, and others can rebuild image files with damaged headers.
• Video files: Stellar Repair for Video, Wondershare Repairit, and others repair MP4/MOV/AVI files.
• SQL databases: dbForge, Stellar Repair for SQL, and database vendor tools repair corrupt databases.
• PDF files: Adobe Acrobat’s repair function plus third-party tools for severely damaged PDFs.

Tier 4: Data recovery software

If the corruption resulted from storage failure rather than application errors, general data recovery approaches apply. Image the drive first with ddrescue, then run recovery software against the image to extract files via file carving based on file signatures. Tools like EaseUS Data Recovery, R-Studio, and PhotoRec can recover files when the file system is damaged, but they recover the file as it exists on disk; if the file’s bytes were corrupted before the file system damage, recovery yields the corrupted bytes.