HDD GURU FORUMS
http://forum.hddguru.com/

Formatted SD card by mistake, with different file system.
http://forum.hddguru.com/viewtopic.php?f=10&t=41146		 Page 1 of 1
Author:  JoJo88 [ March 31st, 2021, 8:49 ]
Post subject:  Formatted SD card by mistake, with different file system.
Hello, I just joined.

I have a 64 GB Sandisk SD Card, which I use in an Android phone. Earlier, I had formatted it into two different partitions and was using it with Link2SD to move apps to the SD Card. The smaller ext3/4 partition contained the moved apps and was about 6 GBs; the other partition was probably FAT32 and was used to store other files.

Some time back, I factory reset the phone, and installed another ROM. I continued using the same SD Card, and in File Manager, it would show up as two partitions - the larger one for my files and the other smaller unused one which I had earlier used to move apps.

Since the disk space had become low on the larger partition, I decided to format the second Link2SD app partition so that I could use it store files. In Windows, you can format one partition while the other stays intact (for eg. formatting D: drive doesn't affect C: drive). I thought it would be the same here, and so I used the default file manager to format the second smaller partition. It started the process, and then I suddenly thought that it might mess up the larger partition, so I closed the app. When I opened file manager again, I found that it had formatted the whole SD Card (both partitions), and it was showing up now as exFAT. I immediately took out the card from the phone and inserted into the computer.

I tried using PhotoRec to recover the files, but it finds 0 files. I have tried both options, the first as whole disk and the second as exFAT. I have also tried the ext2/3/4 as well as the FAT/NTFS/HFS+ file systems. In all cases, it comes up with the nothing. I have also tried a few other softwares - Recuva, Easeus Data Recovery, etc, but none find anything.

HxD shows most of the data as zeroes:

https://i.postimg.cc/JmHqV7ZZ/Hx-D-image-dd.png

In summary: I had a 64 GB SD Card split into two partitions - a larger probably FAT32 that contained my files, and the other smaller ext3/4 that contained moved apps. Accidentally formatting the card has made it into a single exFAT partition. I want to recover data from the first larger partition.

I have created an image.dd file and now am working from that, but I also have the SD Card and can work from that if required.

Please help.
Author:  Arch Stanton [ April 1st, 2021, 6:26 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Quote:
I tried using PhotoRec to recover the files, but it finds 0 files.


Either you'll find mostly zeros where the FAT32 once was or high entropy data due to encryption. Rather than screen-dumping boot sector in HxD you better use it to examine further out on the drive.

I have always found it rather frustrating that most tools tell so little, other than 'I found zero files'. It's why I added an entropy map to my own raw scanner so you can see if there's any data found, and if so a color indication of entropy so can spot potentially encrypted data. Black is zero entropy (so no data, just zeros or repeating single byte value pattern), the brighter the green, the higher entropy is. Highest entropy is probably encrypted data, which has it's own color cyan.

Attachment:
entropy-map.png
entropy-map.png [ 42.45 KiB | Viewed 18035 times ]
Author:  JoJo88 [ April 1st, 2021, 11:31 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Arch Stanton wrote:
Quote:
I tried using PhotoRec to recover the files, but it finds 0 files.


Either you'll find mostly zeros where the FAT32 once was or high entropy data due to encryption. Rather than screen-dumping boot sector in HxD you better use it to examine further out on the drive.

I have always found it rather frustrating that most tools tell so little, other than 'I found zero files'. It's why I added an entropy map to my own raw scanner so you can see if there's any data found, and if so a color indication of entropy so can spot potentially encrypted data. Black is zero entropy (so no data, just zeros or repeating single byte value pattern), the brighter the green, the higher entropy is. Highest entropy is probably encrypted data, which has it's own color cyan.

Attachment:
entropy-map.png


Scrolling all the way down, HxD shows that apart from the screenshot I've most of the beginning, it is all zeroes, all the way down.

As far as I remember, my SD Card wasn't encrypted.

I'll try out JpegDigger, but from what I've understood, this tool is only for recovering jpeg image files, and not .zip or .mp4, etc, right?
Author:  Arch Stanton [ April 2nd, 2021, 5:27 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Yes, JPEG only, but I mention it because it would still allow you see if there's any data at all. But if you see zeros all the way you have already verified this. Zeros = no data. There's no use in trying one more tool and one more if there's no data.
Author:  JoJo88 [ April 2nd, 2021, 11:19 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Arch Stanton wrote:
Yes, JPEG only, but I mention it because it would still allow you see if there's any data at all. But if you see zeros all the way you have already verified this. Zeros = no data. There's no use in trying one more tool and one more if there's no data.


Thanks for the reply.

If all zeros means no data, that is going to be a big problem. Can you tell how this happened? I mean, in Windows, there are two types of formatting - a quick one, which does not overwrite the data with zeroes and files can be recovered later, and a longer one which overwrites the whole disk with zeroes. After I started formatting my SD card, I quicky realized it might be deleting everything and so I stopped the formatting and removed the card, in about ten seconds. How could it have overwritten 64 GBs with zeroes in ten seconds?

From what I understand, a quick format in Windows performed on an HDD only deletes the information about where each file is located, not the file itself. I don't know if it is the same with SD cards as well.
Author:  Arch Stanton [ April 4th, 2021, 8:43 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Format was executed using what? From what OS or device? Sounds like it could be TRIM like mechanism, on SD Card implemented as an ERASE. I know many Sony cameras implement it, don't know about phones/android.
Author:  JoJo88 [ April 4th, 2021, 11:39 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Arch Stanton wrote:
Format was executed using what? From what OS or device? Sounds like it could be TRIM like mechanism, on SD Card implemented as an ERASE. I know many Sony cameras implement it, don't know about phones/android.


The card was formatted in the Android phone, using its own software, and it formatted the card as exFat.
Author:  ghimpe-- [ April 5th, 2021, 3:56 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Have you tried another card reader?
Author:  JoJo88 [ April 5th, 2021, 11:30 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
ghimpe-- wrote:
Have you tried another card reader?


I haven't tried that; I don't have another card reader at present. I'll see if I can get another one.
Author:  JoJo88 [ June 7th, 2021, 1:48 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
I've been trying to recover data all this time but haven't been able to find anything.

I used IsoBuster yesterday, and it shows some files found via their signature, but on double-clicking that section, says no files or folders were found using this method. I'm attaching a screenshot; I think it shows that there are files that can be recovered, but I don't know how. If anyone has any experience using IsoBuster, please help.

Image

In the Properties dialog box, in the Root tab, it shows Address, Size (Blocks), Size (Bytes), Offset (Bytes), and Extents as all 0, Attributes as 'W'.
Author:  Arch Stanton [ June 7th, 2021, 5:05 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.
Author:  JoJo88 [ June 8th, 2021, 12:50 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Arch Stanton wrote:
I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.


Oh...

I came across this site called recoverfab which answered one of my previous questions about how everything could have been overwritten as zeroes in the short time I started the formatting and removed the card; it says that it has not been overwritten by zeroes, but the memory card controller was programmed to return zeroes, while the data is still there.

Seems like no software solution is going to work... :(
Author:  Arch Stanton [ June 8th, 2021, 13:38 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
JoJo88 wrote:
Arch Stanton wrote:
I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.


Oh...

I came across this site called recoverfab which answered one of my previous questions about how everything could have been overwritten as zeroes in the short time I started the formatting and removed the card; it says that it has not been overwritten by zeroes, but the memory card controller was programmed to return zeroes, while the data is still there.

Seems like no software solution is going to work... :(


Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.
Author:  JoJo88 [ June 9th, 2021, 0:38 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
Arch Stanton wrote:
Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.


I had set up the SD card as portable storage, not as an extension of internal memory. Also, the card and the phone, both, are not encrypted.
Author:  Arch Stanton [ June 9th, 2021, 5:38 ]
Post subject:  Re: Formatted SD card by mistake, with different file system
JoJo88 wrote:
Arch Stanton wrote:
Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.


I had set up the SD card as portable storage, not as an extension of internal memory. Also, the card and the phone, both, are not encrypted.


Okay, Then a lab may be able to recover data depending on how much time card had power after the 'accident'.
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/