All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 34 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Restore MBR and data on SDXC card?
PostPosted: February 26th, 2017, 14:00 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
Hi,
Just confused between 2 cards and performed "quick wipe" (remove partitions and MBR) on SDXC card 64GB.
It is done by HDD Low Level Format Tool 4.40
Pray that it is still possible to restore the data.
Please, help.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 26th, 2017, 15:04 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
Can you show us the Partitions window in DMDE (freeware disc editor):

http://dmde.com/

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 26th, 2017, 17:57 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar wrote:
Can you show us the Partitions window in DMDE

Thank you for your answer. Is that right screenshot? https://drive.google.com/open?id=0B34Te ... XlOUUM0OGs


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 26th, 2017, 19:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
It appears that the LLF tool wiped all copies of the boot sector(s). :-(

Select Tools -> NTFS/FAT Search (depending on the file system). If the FATs (FAT32) or MFT (NTFS) are intact, then the search should find them within a minute or so. Then r-click the found item and select Open Volume. Do you see your file/folder structure?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 27th, 2017, 2:06 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar, is seems like nothing was found..
https://drive.google.com/open?id=0B34Te ... 2xZTXhPLTg


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 27th, 2017, 3:21 
Offline

Joined: December 17th, 2009, 22:57
Posts: 138
Location: Macedonia
After low level format data is over written with 00 and nothing can recover data.
You can see on DMDE that all sectors are 00, data is lost forever.

_________________
Sistrum Data Recovery
http://www.sistrum.mk/en


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 27th, 2017, 4:11 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
@Gregor, I didn't expect that you would end up scanning the entire drive. Anyway, if you drag your vertical scrollbar from top to bottom, do you see anything other than zeros from LBA 0 to LBA 125564927?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 27th, 2017, 16:39 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar,
Yes, there is lot of data other than zeros. Zeros are at the beginning. Do you need the exact LBA numbers? (don't know how to jump to different numbers for checking. running with PgUp/PgDn buttons takes hours..)

Kum Ruzvelt,
Is was not complete low level format, but a "quick wipe" (partitions and MBR removal).
Hope it it still possible to restore important video files.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 27th, 2017, 16:52 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
You would be best advised to clone your card, sector by sector, to an image file on your HDD, and then run a data recovery tool (eg Photorec) against the image. If the card was formatted as FAT32, then it appears that both copies of the FAT have been destroyed, in which case it will not be possible to recover all your files intact, unless your file system was unfragmented.

Can you show us a hex dump of the first non-zero sector?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 27th, 2017, 19:15 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
Gregor wrote:
don't know how to jump to different numbers for checking. running with PgUp/PgDn buttons takes hours..

Editor -> Goto Offset

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 28th, 2017, 5:33 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar wrote:
Can you show us a hex dump of the first non-zero sector?


Is that the right picture? https://drive.google.com/open?id=0B34Te ... TktZV9JRm8


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 28th, 2017, 18:44 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar wrote:
Can you show us a hex dump of the first non-zero sector?

Is this the right picture?
Attachment:
Untitled-4.jpg
Untitled-4.jpg [ 988.87 KiB | Viewed 906 times ]


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: February 28th, 2017, 19:29 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
This post shows the structure of the FAT32 file system on my 16GB Toshiba flash drive:

viewtopic.php?f=10&p=244411

This is my 64GB Lexar drive:

From the boot sector ...

Code:
Reserved Sectors        32
Bytes per Sector        512
Sectors per Cluster     64
Big Sectors per FAT     15260

These are the locations and sizes of the various components of the FAT32 file system:

    boot sector at LBA:2120
    32 reserved sectors
    FAT#1 at LBA:2152 (= 2120 + 32)
    FAT#2 at LBA:17412 (= 2152 + 15260)
    root dir at LBA:32672 (= 17412 + 15260)

Your first non-empty sector is at LBA 212992 whereas my root directory begins at LBA 32672. The hex dump looks like data, so this would confirm that all the important file system components have been destroyed. AFAICS, all that remains is a raw recovery.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: March 1st, 2017, 3:42 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar wrote:
AFAICS, all that remains is a raw recovery.


Thank you very much for your answers. I've googled the term "raw recovery" and have not find clear references to that. Do you mean, as you've said before, to make an image and use the PhotoRec tool? Which tool do you recoment for creating the image? Acronis? Paragon?


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: March 1st, 2017, 14:28 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
A raw recovery is how PhotoRec works. It looks for file signatures rather than file system components.

For example, a JPEG file might have a header that looks like this:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

Code:
00000000  FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01  ÿØÿà..JFIF......

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

A GIF file header might look like this:

Code:
00000000  47 49 46 38 39 61 0B 02 E2 01 F7 00 00 00 00 00  GIF89a..â.÷.....

The recovered files will not have their original filenames.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: March 2nd, 2017, 14:54 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar,
So, I've made a scan with PhotoRec. A default run, without entering the expert mode (I'm not an expert at all). Before the accident there were about 20 MTS files, that I wanted to recover. After a scan, there were created 6 directories with about 300 fragments in each of them. Unfortunately, they are unusable. They are out of order and are missing frames at the beginnings and at the ends.
Maybe I should use some another mode? Is there any hope still?


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: March 2nd, 2017, 15:29 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
All I can suggest is that you run different data recovery software against your cloned image. Several commercial tools have demo versions.

The problem you are seeing is that your files are not contiguous, ie they consist of two or more cluster chains. Normally in such cases the OS can assemble the file from the information in the FAT. However, since both copies of the FAT have been destroyed, your software has no way of piecing together the cluster chains that it has found.

I'm not a data recovery professional, and I have never needed to use PhotoRec, but if this were my data, and if I had plenty of time, I would scan the image looking for FAT directories. These should contain your filenames, their size, the location of the first cluster, and date/time stamp. This information would enable me to locate the corresponding LBA in the image. I would also search the image to determine the starting LBA of each of the MTS 300 fragments. Then it would be a matter of painstakingly stitching together the various fragments. Perhaps there are data recovery software that are more intelligent than PhotoRec, or perhaps there are some options in PhotoRec's expert mode. Sorry, I don't know.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: March 2nd, 2017, 15:41 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
Here is my FOXIT directory (DMDE dumps):

Code:
LBA:6617929            vol.sec:6617866 Clus:206213 sec:0
.           >         0    206213 ----D--- 2013-03-01 17:40:00 2013-03-01 17:39:58.20 2013-03-01
..          >         0         0 ----D--- 2013-03-01 17:40:00 2013-03-01 17:39:58.20 2013-03-01
. 2      exe..........          0 RHSV---- 56
  1      Foxit Reader.          0 RHSV---- 56
FOXITR~1 EXE   23979688    206214 -----A-- 2012-09-20 15:12:12 2012-11-06 17:55:56.39 2017-03-01
CRASHLOG TXT   13433156    299524 -----A-- 2016-07-16 16:13:12 2013-05-01 17:18:21.99 2016-07-16
                      0         0 -------- 0000-00-00 00:00:00 0000-00-00 00:00:00.00 0000-00-00
...
                      0         0 -------- 0000-00-00 00:00:00 0000-00-00 00:00:00.00 0000-00-00

Code:
LBA:6617929            vol.sec:6617866 Clus:206213 sec:0
0000: 2E 20 20 20 20 20 20 20  20 20 20 10 00 14 FD 8C  .          ...ýŒ
0010: 61 42 61 42 03 00 00 8D  61 42 85 25 00 00 00 00  aBaB...aBÂ…%....
0020: 2E 2E 20 20 20 20 20 20  20 20 20 10 00 14 FD 8C  ..         ...ýŒ
0030: 61 42 61 42 00 00 00 8D  61 42 00 00 00 00 00 00  aBaB...aB......
0040: 42 65 00 78 00 65 00 00  00 FF FF 0F 00 56 FF FF  Be.x.e...ÿÿ..Vÿÿ
0050: FF FF FF FF FF FF FF FF  FF FF 00 00 FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿ..ÿÿÿÿ
0060: 01 46 00 6F 00 78 00 69  00 74 00 0F 00 56 20 00  .F.o.x.i.t...V .
0070: 52 00 65 00 61 00 64 00  65 00 00 00 72 00 2E 00  R.e.a.d.e...r...
0080: 46 4F 58 49 54 52 7E 31  45 58 45 20 00 27 FC 8E  FOXITR~1EXE .'üŽ
0090: 66 41 61 4A 03 00 86 79  34 41 86 25 A8 E6 6D 01  fAaJ..†y4A†%¨æm.
00a0: 43 52 41 53 48 4C 4F 47  54 58 54 20 00 C7 4A 8A  CRASHLOGTXT .ÇJŠ
00b0: A1 42 F0 48 04 00 A6 81  F0 48 04 92 44 F9 CC 00  ¡BðH..¦ðH.Â’DùÌ.
00c0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
...
01f0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: March 2nd, 2017, 16:08 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9290
Location: Australia
In DMDE, select Tools -> Full Scan.

Tick the Raw and FAT checkboxes.

Under Raw:File Signatures, uncheck everything and then Add your MTS file's signature and properties.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Restore MBR and data on SDXC card?
PostPosted: March 2nd, 2017, 16:26 
Offline

Joined: February 26th, 2017, 13:49
Posts: 13
Location: SPB
fzabkar wrote:
Here is my FOXIT directory (DMDE dumps)

Sorry, unfortunately, it looks for me like an extraterrestial message.
I'll try to run enother recovery apps.
Thank you very much for you empathy )


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 34 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group