CompactFlash, SD, MMC, USB flash storage. Anything that does not have moving parts inside.
May 2nd, 2017, 8:11
I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.
The first thing I did was plug the card into my computer and make an image of it to work off of.
I tried various recovery software (Recuva, R-undelete, photorec,etc )
They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan"
The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.
Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card.
I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.
I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it.
May 2nd, 2017, 23:18
eng3 wrote:I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.
The first thing I did was plug the card into my computer and make an image of it to work off of.
I tried various recovery software (Recuva, R-undelete, photorec,etc )
They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan"
The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.
Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card.
I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.
I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it.
Well,
what camera was this ?
May 3rd, 2017, 7:48
This was from my cell phone camera. Sony Xperia Z5 Compact
May 3rd, 2017, 10:58
Try PhotoRec and let it go through the entire card. It's free.
May 3rd, 2017, 14:52
Per my original post, I've already tried photorec
May 3rd, 2017, 15:28
eng3 wrote:I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.
The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.
Does the file structure report the correct sizes? If so, then perhaps the camera "wiped" the files instead of merely deleting them.
eng3 wrote:I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.
I presume you mean your other videos, not the two in question.
May 4th, 2017, 1:16
eng3 wrote:Per my original post, I've already tried photorec
Sorry I missed that.
OK now I'm interested.
If you can upload the image somewhere I can take a look.
May 4th, 2017, 4:07
You could experiment by taking a blank card (zero filled), saving a short video to it, and then imaging the card. Then delete the video in the camera and take another image. A comparison of the two dumps should tell you how the camera deals with a deleted video.
May 4th, 2017, 11:59
Its not a camera, its a cell phone.
Deleting is "instant" so I do not thing it is zero (or one) filling the file.
When I do a quick scan, it finds the two videos. File names and sizes look correct.
When I do a deep scan, it finds lots of deleted videos but none are those videos. The sizes are not even close.
The facebook was just a comment on facebook. I uploaded the two videos thinking it was "backed up" but facebook converted them to a low resolution version. So that really has nothing to do with the issue.
Sorry I can't upload the image. Its 128gb and has some sensitive stuff on it that I'd rather not be posted online.
As I understand "photorec", it will search for headers of specific file types and that is how it can identify an MP4. I'm guessing that the headers may have gotten over written. Therefore, is there a tool that can search for "video data". I assume video data has some unique signature making it look different than say a text file or so.
May 4th, 2017, 18:57
Another way to approach this problem might be to zero-fill the contents of every valid file in the image. This would only leave the deleted stuff, thereby making the data easier to distinguish in a disc/hex editor
Alternatively, configure your recovery tool to scan unused clusters only.
May 4th, 2017, 20:14
http://www.sleuthkit.org/sleuthkit/The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data.
You could use
blkls to clone the unused clusters.
http://www.sleuthkit.org/sleuthkit/man/blkls.htmlblkls opens the named image(s) and copies file system data units (blocks). By default, blkls copies the contents of unallocated data blocks.
Powered by phpBB © phpBB Group.