SD Card Accidental Format

[Barbenae]

I've tried numerous Digital Image Recovery software applications with unsuccessful results. I accidentally formatted my SD Card on my Canon EOS T2i camera before downloading images I had taken. No pictures have been taken since the accidental format. I immediately resorted to data recovery applications and none have been able to locate the images on the card that I took just before the format. Are my images gone forever.....any suggestions? Thanks for your help!

[labtech]

1) What is the capacity of the media?
2) Before formatting, how much data did the media have approx?
3) How exactly did you format? Perhaps specify the way the camera works in terms of formatting.
4) Can you name some of the software you ran? And perhaps the mode within the software if it applies (e.g. deleted mode)?

[Barbenae]

1) What is the capacity of the media?
The card is a Transcend Class 10 16GB SDHC.
2) Before formatting, how much data did the media have approx?
Approximately 1GB maybe 2GB at the most was utilized in photos taken.
3) How exactly did you format? Perhaps specify the way the camera works in terms of formatting.
I took photos while out on an excursion. Upon returning home, I removed the card and inserted in card slot of computer to remove photos. I thought I had downloaded with Zoom Browser but I had not. I took out the card from the computer and replaced back in the camera and formatted using the menu options in my camera "format" (Canon EOS T2i Digital SLR).
4) Can you name some of the software your ran?
The software that I have utilized thus far is as follows: Asoftech Photo Recovery, Card Data Recovery, Card Recovery, EaseUS Data Recovery, Formatted SD Card Recovery Pro, GetDataBack for FAT, iCare Data Recovery, ICare Format Recovery, MJM Free Photo Recovery, Ontrack EasyRecovery, PhotoRescue, RecoveryFix For Windows, Recuva, Rescue Pro, SD Card Photo Recovery Pro, Stellar Phoenix Photo Recovery, Wondershare Photo Recovery, Yodot Photo Recovery, Zero Assumption Recovery, Remo Recover, and R-Undelete.

Each of the Data Recovery applications that I have tried basically render the same results. The card is detected and the folders that normally hold the photos are displayed but 0 files of 0 files recovered. Also, it indicates 0 files failed.

Thank you for your interest & help.

[Barbenae]

Here is a pdf snapshot of GetDataBack Recovery results

Attachments

GetDataBack Recovery.pdf

(299.69 KiB) Downloaded 928 times

[pcimage]

Try something like Winhex or other hex editor to scroll through the sectors to see if there is actually some data, or just zeros or "FFFFFFF" throughout the memory.

[Barbenae]

I tried HxD Editor and the attached shows the results, all zeros except the middle section in the photo. Does that mean anything? I guess my low level format was a high level format which wiped out the data. It only took 8 seconds when I formatted the card so I was thinking it was a quick format and not a complete wipeout. I immediately ceased using the card and tried data recovery. I do not know anything about data recovery but I knew this was a good place to ask. Any additional suggestions are appreciated.

Attachments

[HaQue]

HxD is a lightweight HEX Editor I use a lot. http://mh-nexus.de/en/hxd/.

You will have to run it as administrator to open a disk. I am using win 7 , adjust for your OS if you need to..

click start, all programs, HxD hex Editor.
right-click the HxD icon and choose "run as administrator"
Once in HxD choose "Extras" and "open disk" and choose the card.

As pcimage said, look through the disk a bit.

Well, I got sidetracked while answering, so looks like you found HxD..

It might be a good idea to take an image of the card.

One thing that might be interesting is if you could do a search/replace, and replace the hex values "FF" with nothing, then see what is left over. this would be how much data is actually on the disk. "FF" is basically blank/erased bytes, so if you get rid of those and there is nothing much else left, I would say you are out of luck.

EDIT, just thinking about this, if you look at the card normally through the OS, IE the card is working properly, you would see zeroes, meaning "00 00 00 00 00 00" is empty memory. If you unsolder the NAND and read/dump the chip, it would show as "FF F" so the above you would search/replace "00".

If there is still a lot of data left over, another tool produced by a good neighbour is here: Mediacarve. It is new, and I don't know a huge mount about its capabilities, but it might produce some better results. http://forum.hddguru.com/viewtopic.php?f=7&t=26947

[fzabkar]

Sector 0 contains a partition table with a single FAT32 volume beginning at sector 8192 (= 0x2000).

The size of the volume is ...

0x1E0B800 x 512 = 31504384 sectors x 512 bytes per sector = 16 130 244 608 bytes

AFAICT, the GetDataBack report is telling us that cluster #5 (logical sector 8384) is the last cluster of the newly formatted file system. Since the cluster size is 64 sectors, this means that the user data must start at logical sector 8448. That's physical sector 16640 (= 8448 + 8192). I'd start looking there.

BTW another freeware disc editor is DMDE. It's a lot more powerful than HxD.

http://dmde.com/

Another thing that might be worth doing is to insert a freshly formatted card in your camera, take a photo and a movie, and then examine the resulting files with HxD. The headers of each file may contain strings that would identify the file type. This might help in a MediaCarve search.

[Barbenae]

Wow, I am thankful for the suggestions but you are getting over my head. However, I did run DMDE and attached are the results. Did this give any additional insight? I'm going to work on digesting the remaining information you have provided. It's like Greek to me but I'm eager to work through this.

Attachments

[fzabkar]

pcimage asked you to search for non-zero data. You have responded with a dump of sectors 0 and 1. You now need to scan through the remaining 31 million sectors.

Launch DMDE
Uncheck the Show Partitions box
Select your Physical Drive and click OK

Select Editor -> Goto Offset
Sector -> 16640
Sector Offset -> 0
click OK

You should now be at LBA:16640

Now use the PageDown key or scrollbar to search through the remainder of the drive.

[HaQue]

Or you could take the card to a data recovery company - make sure they actually do flash.. research that

[arvika]

It could be checked by Teamviewer. I can check it for you. Maybe card is full of zeros... Contact me on PW.

[Barbenae]

Thanks to everyone for your help. Fzabkar, got your instructions and I'm working on it. Goodness, this may take awhile. I'll be more appreciative of what data recovery specialists do! Arvika, thanks for your offer but I'd like to give it a shot myself.....I love learning. My background is pharmaceuticals but when I've taken any career test (years ago), it always came back research, scientist or investigator. Guess that's why I like trying to figure this out. HaQue, I did call the Geek Squad at Best Buy, just out of curiosity, who states they send out SD cards for recovery. Price starts at $249 and that is a minimum charge whether or not they recover. Just thought you might want to know.

I'll check back in when I get my search done.

[arvika]

One hit more. Make a image of the card to file by DMDE program. Then pack this image (use RAR or ZIP). If result file will be small, card it full of zero and nothing can be recovered.

[Barbenae]

Well, how helpful Arvika. I did as you said and my resulting file was 18MB. I figured out I had approx. 113 high resolution photos on the card. Each photo is approx. 7MB = 791MB. I guess the 18MB in the zip folder indicates that my photos are not there....."nevermore!"

[arvika]

Yes. Your card was filled by zero (or FF). I'm sorry but your photo is gone forever

[Barbenae]

You sure saved me a lot of time. GREAT tip!!! Again, a "low level" format is not what it is cracked up to be......nothing low about it! AND it is pretty misleading for all the data recovery programs that tout recovering images from a formatted card.

Anyway, I learned a lot along the way. I find your knowledge fascinating! Thanks!!!!!!!!!

[fzabkar]

Read pages 42 and 43 of the user manual:
http://www.css.washington.edu/w/images/ ... Manual.pdf

The camera offers two choices -- normal format or a low-level format.

"Since low-level formatting will erase all recordable sectors in the card, the formatting will take slightly longer than normal formatting."

"When the card is formatted or data is erased, only the file management information is changed. The actual data is not completely erased. ... When discarding the card, execute low-level formatting or destroy the card physically to prevent the data from being leaked."

[Barbenae]

Thanks. It's still hard to believe a "low-level" format is more severe than a just plain format. In terms of security, for me "low-level" implies not much or at least less than normal. I think I will uncheck the "low-level" format box in my camera's format menu. I'd say "low-level" is a bit of a misnomer. Anyway, lesson learned. Clearly, the manual states that low-level formatting will erase all recordable sectors in the card. Well, before this forum, I'm not sure I even knew what a sector was. Thanks, HDDGURU.

By the way, I agree, "a backup a day keeps DR away." I have 7 external hard drives for daily backups. I even have backups of my backups (lots of photos). Of course, in this case, I never got the photos off the card so I was in deep trouble from the get-go. Again, lesson learned.

Again, thanks!