scratchy wrote:
Accessing the TOC or whatever he calls it will not recover the photos.
once wiped, memory cards do not leave any trace of data as they are not magnetic. They consist of transistors which are in an on or an off state giving binary 1 or 0 there are no intermediate phases, so reading would be impossible. So as drc says a simple overwrite would render the card unrecoverable.
if the memory card had the 'master partition' or 'TOC' it would then need to contain exactly double the existing memory in order to rebuild it.
.
While I agree the data would likely not be recovered, I disagree with Scratchy's explanation.
The data is not typically a transistor. It may behave in a way that resembles it, but better described as logic gates.
a charge is trapped in a gated environment, and the presence of this charge, or not, is typically classed as a 1 or a 0. binary data. In SLC NAND this is easy to understand .. SLC Single level cell ... 1 or 0.. off or on.
There is also MLC (Multi Level Cell) and TLC (Triple Level Cell). so in a MLC "cell" you can store 2 bits per cell...you could store states like 00,01,10, 11 in the same single cell, by varying the strength of the charge. Further to this you can store in a TLC 3 bits per cell, states like 000,001,010,011,100,101,110,111 or 8 different states.
Some MLC will only use a single bit, to make it faster.
So what I am getting at is if you have a cell that can hold different voltage strengths, you could feasibly do high level research on the properties of the NAND, and infer some data by what is there now and what could have been previous states.
It is extremely unlikely any significant amount of data be recovered, more like traces of data. In a forensic case, a single 1 byte file with a time stamp, proven to be authentic could be enough data to prove a certain action or event at a given time. Very unlikely any regular person would be recovering in any form such as what I was talking about there.
Also, lets say you have a 16GB NAND with a bad block reserve of 512K, and it is almost exhausted, then a full format of 00's will write over the good blocks, yes, making file recovery impossible. But if you can change your reading method to read bad blocks, these would still contain(probably corrupted) data, and again some fragments of data could be recoverable. Software is typically not able to be configured to read the bad blocks, though if you want to know about it, I think last year Josh Thomas (Monk) did some work, and a presentation at a few conferences of using Linux to read the bad blocks, change them, mark good ones bad etc.
basically formatting and writing 00's won't touch the bad blocks, most of the read chain ignores them altogether.
all this is my own interpretation, and Ive never done any institution based training on storage technology, so forgive any errors or terminology oopsies.
BTW if you want to stop someone reading a card, just snap it in a few pieces, why worry about software then leave the evidence around when the cards are so cheap. It is like hiding your kids Xmas presents in the master bedroom, the be shocked when they find the new iPad under the socks!!!!!
FAQ
Search
Login
Register
HDDGURU FILES
) i want to try this way lol
