| HDD GURU FORUMS http://forum.hddguru.com/ |
|
| Restore MBR and data on SDXC card? http://forum.hddguru.com/viewtopic.php?f=10&t=35059 |
Page 1 of 2 |
| Author: | Gregor [ February 26th, 2017, 14:00 ] |
| Post subject: | Restore MBR and data on SDXC card? |
Hi, Just confused between 2 cards and performed "quick wipe" (remove partitions and MBR) on SDXC card 64GB. It is done by HDD Low Level Format Tool 4.40 Pray that it is still possible to restore the data. Please, help. |
|
| Author: | fzabkar [ February 26th, 2017, 15:04 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
Can you show us the Partitions window in DMDE (freeware disc editor): http://dmde.com/ |
|
| Author: | Gregor [ February 26th, 2017, 17:57 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar wrote: Can you show us the Partitions window in DMDE Thank you for your answer. Is that right screenshot? https://drive.google.com/open?id=0B34Te ... XlOUUM0OGs |
|
| Author: | fzabkar [ February 26th, 2017, 19:57 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
It appears that the LLF tool wiped all copies of the boot sector(s).  Select Tools -> NTFS/FAT Search (depending on the file system). If the FATs (FAT32) or MFT (NTFS) are intact, then the search should find them within a minute or so. Then r-click the found item and select Open Volume. Do you see your file/folder structure? |
|
| Author: | Gregor [ February 27th, 2017, 2:06 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar, is seems like nothing was found.. https://drive.google.com/open?id=0B34Te ... 2xZTXhPLTg |
|
| Author: | Kum Ruzvelt [ February 27th, 2017, 3:21 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
After low level format data is over written with 00 and nothing can recover data. You can see on DMDE that all sectors are 00, data is lost forever. |
|
| Author: | fzabkar [ February 27th, 2017, 4:11 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
@Gregor, I didn't expect that you would end up scanning the entire drive. Anyway, if you drag your vertical scrollbar from top to bottom, do you see anything other than zeros from LBA 0 to LBA 125564927? |
|
| Author: | Gregor [ February 27th, 2017, 16:39 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar, Yes, there is lot of data other than zeros. Zeros are at the beginning. Do you need the exact LBA numbers? (don't know how to jump to different numbers for checking. running with PgUp/PgDn buttons takes hours..) Kum Ruzvelt, Is was not complete low level format, but a "quick wipe" (partitions and MBR removal). Hope it it still possible to restore important video files. |
|
| Author: | fzabkar [ February 27th, 2017, 16:52 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
You would be best advised to clone your card, sector by sector, to an image file on your HDD, and then run a data recovery tool (eg Photorec) against the image. If the card was formatted as FAT32, then it appears that both copies of the FAT have been destroyed, in which case it will not be possible to recover all your files intact, unless your file system was unfragmented. Can you show us a hex dump of the first non-zero sector? |
|
| Author: | fzabkar [ February 27th, 2017, 19:15 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
Gregor wrote: don't know how to jump to different numbers for checking. running with PgUp/PgDn buttons takes hours.. Editor -> Goto Offset |
|
| Author: | Gregor [ February 28th, 2017, 5:33 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar wrote: Can you show us a hex dump of the first non-zero sector? Is that the right picture? https://drive.google.com/open?id=0B34Te ... TktZV9JRm8 |
|
| Author: | Gregor [ February 28th, 2017, 18:44 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar wrote: Can you show us a hex dump of the first non-zero sector? Is this the right picture? Attachment: Untitled-4.jpg [ 988.87 KiB | Viewed 14950 times ] |
|
| Author: | fzabkar [ February 28th, 2017, 19:29 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
This post shows the structure of the FAT32 file system on my 16GB Toshiba flash drive: viewtopic.php?f=10&p=244411 This is my 64GB Lexar drive: From the boot sector ... Code: Reserved Sectors 32 Bytes per Sector 512 Sectors per Cluster 64 Big Sectors per FAT 15260 These are the locations and sizes of the various components of the FAT32 file system:
32 reserved sectors FAT#1 at LBA:2152 (= 2120 + 32) FAT#2 at LBA:17412 (= 2152 + 15260) root dir at LBA:32672 (= 17412 + 15260) Your first non-empty sector is at LBA 212992 whereas my root directory begins at LBA 32672. The hex dump looks like data, so this would confirm that all the important file system components have been destroyed. AFAICS, all that remains is a raw recovery. |
|
| Author: | Gregor [ March 1st, 2017, 3:42 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar wrote: AFAICS, all that remains is a raw recovery. Thank you very much for your answers. I've googled the term "raw recovery" and have not find clear references to that. Do you mean, as you've said before, to make an image and use the PhotoRec tool? Which tool do you recoment for creating the image? Acronis? Paragon? |
|
| Author: | fzabkar [ March 1st, 2017, 14:28 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
A raw recovery is how PhotoRec works. It looks for file signatures rather than file system components. For example, a JPEG file might have a header that looks like this: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F Code: 00000000 FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01 ÿØÿà..JFIF...... Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F A GIF file header might look like this: Code: 00000000 47 49 46 38 39 61 0B 02 E2 01 F7 00 00 00 00 00 GIF89a..â.÷..... The recovered files will not have their original filenames. |
|
| Author: | Gregor [ March 2nd, 2017, 14:54 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar, So, I've made a scan with PhotoRec. A default run, without entering the expert mode (I'm not an expert at all). Before the accident there were about 20 MTS files, that I wanted to recover. After a scan, there were created 6 directories with about 300 fragments in each of them. Unfortunately, they are unusable. They are out of order and are missing frames at the beginnings and at the ends. Maybe I should use some another mode? Is there any hope still? |
|
| Author: | fzabkar [ March 2nd, 2017, 15:29 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
All I can suggest is that you run different data recovery software against your cloned image. Several commercial tools have demo versions. The problem you are seeing is that your files are not contiguous, ie they consist of two or more cluster chains. Normally in such cases the OS can assemble the file from the information in the FAT. However, since both copies of the FAT have been destroyed, your software has no way of piecing together the cluster chains that it has found. I'm not a data recovery professional, and I have never needed to use PhotoRec, but if this were my data, and if I had plenty of time, I would scan the image looking for FAT directories. These should contain your filenames, their size, the location of the first cluster, and date/time stamp. This information would enable me to locate the corresponding LBA in the image. I would also search the image to determine the starting LBA of each of the MTS 300 fragments. Then it would be a matter of painstakingly stitching together the various fragments. Perhaps there are data recovery software that are more intelligent than PhotoRec, or perhaps there are some options in PhotoRec's expert mode. Sorry, I don't know. |
|
| Author: | fzabkar [ March 2nd, 2017, 15:41 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
Here is my FOXIT directory (DMDE dumps): Code: LBA:6617929 vol.sec:6617866 Clus:206213 sec:0 . > 0 206213 ----D--- 2013-03-01 17:40:00 2013-03-01 17:39:58.20 2013-03-01 .. > 0 0 ----D--- 2013-03-01 17:40:00 2013-03-01 17:39:58.20 2013-03-01 . 2 exe.......... 0 RHSV---- 56 1 Foxit Reader. 0 RHSV---- 56 FOXITR~1 EXE 23979688 206214 -----A-- 2012-09-20 15:12:12 2012-11-06 17:55:56.39 2017-03-01 CRASHLOG TXT 13433156 299524 -----A-- 2016-07-16 16:13:12 2013-05-01 17:18:21.99 2016-07-16 0 0 -------- 0000-00-00 00:00:00 0000-00-00 00:00:00.00 0000-00-00 ... 0 0 -------- 0000-00-00 00:00:00 0000-00-00 00:00:00.00 0000-00-00 Code: LBA:6617929 vol.sec:6617866 Clus:206213 sec:0
0000: 2E 20 20 20 20 20 20 20 20 20 20 10 00 14 FD 8C . ...ýŒ 0010: 61 42 61 42 03 00 00 8D 61 42 85 25 00 00 00 00 aBaB...ÂaBÂ…%.... 0020: 2E 2E 20 20 20 20 20 20 20 20 20 10 00 14 FD 8C .. ...ýŒ 0030: 61 42 61 42 00 00 00 8D 61 42 00 00 00 00 00 00 aBaB...ÂaB...... 0040: 42 65 00 78 00 65 00 00 00 FF FF 0F 00 56 FF FF Be.x.e...ÿÿ..Vÿÿ 0050: FF FF FF FF FF FF FF FF FF FF 00 00 FF FF FF FF ÿÿÿÿÿÿÿÿÿÿ..ÿÿÿÿ 0060: 01 46 00 6F 00 78 00 69 00 74 00 0F 00 56 20 00 .F.o.x.i.t...V . 0070: 52 00 65 00 61 00 64 00 65 00 00 00 72 00 2E 00 R.e.a.d.e...r... 0080: 46 4F 58 49 54 52 7E 31 45 58 45 20 00 27 FC 8E FOXITR~1EXE .'üŽ 0090: 66 41 61 4A 03 00 86 79 34 41 86 25 A8 E6 6D 01 fAaJ..†y4A†%¨æm. 00a0: 43 52 41 53 48 4C 4F 47 54 58 54 20 00 C7 4A 8A CRASHLOGTXT .ÇJŠ 00b0: A1 42 F0 48 04 00 A6 81 F0 48 04 92 44 F9 CC 00 ¡BðH..¦ÂðH.Â’DùÌ. 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ ... 01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
|
| Author: | fzabkar [ March 2nd, 2017, 16:08 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
In DMDE, select Tools -> Full Scan. Tick the Raw and FAT checkboxes. Under Raw:File Signatures, uncheck everything and then Add your MTS file's signature and properties. |
|
| Author: | Gregor [ March 2nd, 2017, 16:26 ] |
| Post subject: | Re: Restore MBR and data on SDXC card? |
fzabkar wrote: Here is my FOXIT directory (DMDE dumps) Sorry, unfortunately, it looks for me like an extraterrestial message. I'll try to run enother recovery apps. Thank you very much for you empathy ) |
|
| Page 1 of 2 | All times are UTC - 5 hours [ DST ] |
| Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group http://www.phpbb.com/ |
|