All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: recovery of deleted videos
PostPosted: May 2nd, 2017, 8:11 
Offline

Joined: May 2nd, 2017, 8:01
Posts: 4
Location: US - usa
I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.

The first thing I did was plug the card into my computer and make an image of it to work off of.
I tried various recovery software (Recuva, R-undelete, photorec,etc )
They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan"
The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.

Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card.

I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.

I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it.


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 2nd, 2017, 23:18 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
eng3 wrote:
I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.

The first thing I did was plug the card into my computer and make an image of it to work off of.
I tried various recovery software (Recuva, R-undelete, photorec,etc )
They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan"
The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.

Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card.

I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.

I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it.



Well,
what camera was this ?

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 3rd, 2017, 7:48 
Offline

Joined: May 2nd, 2017, 8:01
Posts: 4
Location: US - usa
This was from my cell phone camera. Sony Xperia Z5 Compact


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 3rd, 2017, 10:58 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
Try PhotoRec and let it go through the entire card. It's free.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 3rd, 2017, 14:52 
Offline

Joined: May 2nd, 2017, 8:01
Posts: 4
Location: US - usa
Per my original post, I've already tried photorec


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 3rd, 2017, 15:28 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
eng3 wrote:
I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.

The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.

Does the file structure report the correct sizes? If so, then perhaps the camera "wiped" the files instead of merely deleting them.
eng3 wrote:
I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.

I presume you mean your other videos, not the two in question.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 4th, 2017, 1:16 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
eng3 wrote:
Per my original post, I've already tried photorec


Sorry I missed that.
OK now I'm interested.
If you can upload the image somewhere I can take a look.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 4th, 2017, 4:07 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
You could experiment by taking a blank card (zero filled), saving a short video to it, and then imaging the card. Then delete the video in the camera and take another image. A comparison of the two dumps should tell you how the camera deals with a deleted video.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 4th, 2017, 11:59 
Offline

Joined: May 2nd, 2017, 8:01
Posts: 4
Location: US - usa
Its not a camera, its a cell phone.

Deleting is "instant" so I do not thing it is zero (or one) filling the file.

When I do a quick scan, it finds the two videos. File names and sizes look correct.

When I do a deep scan, it finds lots of deleted videos but none are those videos. The sizes are not even close.

The facebook was just a comment on facebook. I uploaded the two videos thinking it was "backed up" but facebook converted them to a low resolution version. So that really has nothing to do with the issue.

Sorry I can't upload the image. Its 128gb and has some sensitive stuff on it that I'd rather not be posted online.

As I understand "photorec", it will search for headers of specific file types and that is how it can identify an MP4. I'm guessing that the headers may have gotten over written. Therefore, is there a tool that can search for "video data". I assume video data has some unique signature making it look different than say a text file or so.


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 4th, 2017, 18:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Another way to approach this problem might be to zero-fill the contents of every valid file in the image. This would only leave the deleted stuff, thereby making the data easier to distinguish in a disc/hex editor

Alternatively, configure your recovery tool to scan unused clusters only.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 4th, 2017, 19:17 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
https://superuser.com/questions/91961/saving-imaging-free-disk-space-unused-clusters-to-recover-deleted-files

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: recovery of deleted videos
PostPosted: May 4th, 2017, 20:14 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
http://www.sleuthkit.org/sleuthkit/
Quote:
The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data.

You could use blkls to clone the unused clusters.

http://www.sleuthkit.org/sleuthkit/man/blkls.html
Quote:
blkls opens the named image(s) and copies file system data units (blocks). By default, blkls copies the contents of unallocated data blocks.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 27 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group