HDD GURU FORUMS :: View topic - recovery of deleted videos

I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.

The first thing I did was plug the card into my computer and make an image of it to work off of.
I tried various recovery software (Recuva, R-undelete, photorec,etc )
They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan"
The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.

Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card.

I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.

I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it.

I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.

The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.

I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.

Per my original post, I've already tried photorec

The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data.

blkls opens the named image(s) and copies file system data units (blocks). By default, blkls copies the contents of unallocated data blocks.

Author:	eng3 [ May 2nd, 2017, 8:11 ]
Post subject:	recovery of deleted videos
I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal. The first thing I did was plug the card into my computer and make an image of it to work off of. I tried various recovery software (Recuva, R-undelete, photorec,etc ) They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan" The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's) If I do a deep scan, it doesnt find the videos. Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card. I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version. I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it.

Author:	Amarbir[CDR-Labs] [ May 2nd, 2017, 23:18 ]
Post subject:	Re: recovery of deleted videos
eng3 wrote: I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal. The first thing I did was plug the card into my computer and make an image of it to work off of. I tried various recovery software (Recuva, R-undelete, photorec,etc ) They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan" The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's) If I do a deep scan, it doesnt find the videos. Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card. I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version. I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it. Well, what camera was this ?

Author:	eng3 [ May 3rd, 2017, 7:48 ]
Post subject:	Re: recovery of deleted videos
This was from my cell phone camera. Sony Xperia Z5 Compact

Author:	northwind [ May 3rd, 2017, 10:58 ]
Post subject:	Re: recovery of deleted videos
Try PhotoRec and let it go through the entire card. It's free.

Author:	eng3 [ May 3rd, 2017, 14:52 ]
Post subject:	Re: recovery of deleted videos
Per my original post, I've already tried photorec

HDD GURU FORUMS http://forum.hddguru.com/

recovery of deleted videos http://forum.hddguru.com/viewtopic.php?f=10&t=35309	Page 1 of 1

Author:	fzabkar [ May 3rd, 2017, 15:28 ]
Post subject:	Re: recovery of deleted videos
eng3 wrote: I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal. The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's) If I do a deep scan, it doesnt find the videos. Does the file structure report the correct sizes? If so, then perhaps the camera "wiped" the files instead of merely deleting them. eng3 wrote: I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version. I presume you mean your other videos, not the two in question.

Author:	northwind [ May 4th, 2017, 1:16 ]
Post subject:	Re: recovery of deleted videos
eng3 wrote: Per my original post, I've already tried photorec Sorry I missed that. OK now I'm interested. If you can upload the image somewhere I can take a look.

Author:	fzabkar [ May 4th, 2017, 4:07 ]
Post subject:	Re: recovery of deleted videos
You could experiment by taking a blank card (zero filled), saving a short video to it, and then imaging the card. Then delete the video in the camera and take another image. A comparison of the two dumps should tell you how the camera deals with a deleted video.

Author:	eng3 [ May 4th, 2017, 11:59 ]
Post subject:	Re: recovery of deleted videos
Its not a camera, its a cell phone. Deleting is "instant" so I do not thing it is zero (or one) filling the file. When I do a quick scan, it finds the two videos. File names and sizes look correct. When I do a deep scan, it finds lots of deleted videos but none are those videos. The sizes are not even close. The facebook was just a comment on facebook. I uploaded the two videos thinking it was "backed up" but facebook converted them to a low resolution version. So that really has nothing to do with the issue. Sorry I can't upload the image. Its 128gb and has some sensitive stuff on it that I'd rather not be posted online. As I understand "photorec", it will search for headers of specific file types and that is how it can identify an MP4. I'm guessing that the headers may have gotten over written. Therefore, is there a tool that can search for "video data". I assume video data has some unique signature making it look different than say a text file or so.

Author:	fzabkar [ May 4th, 2017, 18:57 ]
Post subject:	Re: recovery of deleted videos
Another way to approach this problem might be to zero-fill the contents of every valid file in the image. This would only leave the deleted stuff, thereby making the data easier to distinguish in a disc/hex editor Alternatively, configure your recovery tool to scan unused clusters only.

Author:	fzabkar [ May 4th, 2017, 19:17 ]
Post subject:	Re: recovery of deleted videos
https://superuser.com/questions/91961/saving-imaging-free-disk-space-unused-clusters-to-recover-deleted-files

Author:	fzabkar [ May 4th, 2017, 20:14 ]
Post subject:	Re: recovery of deleted videos
http://www.sleuthkit.org/sleuthkit/ Quote: The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. You could use blkls to clone the unused clusters. http://www.sleuthkit.org/sleuthkit/man/blkls.html Quote: blkls opens the named image(s) and copies file system data units (blocks). By default, blkls copies the contents of unallocated data blocks.

Page 1 of 1	All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group http://www.phpbb.com/