SD Card data recovery

[morekid]

Hi there, I'm trying to recover data from an unreadable SD Card.

When attempting repair I get the following:

Code:


sudo fsck_hfs -ryd /dev/rdisk3s1

Unable to open block device /dev/disk3s1: Permission deniedjournal_replay(/dev/disk3s1) returned 13
** /dev/rdisk3s1 (NO WRITE)
   Using cacheBlockSize=32K cacheTotalBlock=32768 cacheSize=1048576K.
   Executing fsck_hfs (version hfs-407.50.6).
   Block 2 is not an MDB or Volume Header
   Block 15597566 is not an MDB or Volume Header
volumeType is 0
0000:  5553 4243 50c3 f80b 0004 0000 0001 0a2a       |USBCP...........|
0010:  0000 0020 0000 0002 0000 0000 0000 0040       |................|
0020:  6d9c 26e1 8c7a e3d7 a54c ab24 a253 e6c5       |m....z...L...S..|
0030:  0c8d 9f24 c8c3 8c77 c77a c8da 36b6 83e1       |.......w.z..6...|
0040:  eb00 9053 4420 2020 2020 2000 0240 2011       |...SD...........|
0050:  0200 0000 00f8 0000 3f00 ff00 0020 0000       |................|
0060:  0000 ee00 7007 0000 0000 0000 0200 0000       |....p...........|
0070:  0100 0600 0000 0000 0000 0000 0000 0000       |................|
0080:  8000 2901 0203 0420 2020 2020 2020 2020       |................|
0090:  2020 4641 5433 3220 2020 0000 0000 0000       |..FAT32.........|
00a0:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
. . .
01f0:  0000 0000 0000 0000 0000 0000 0000 0000       |................|
   unknown volume type
   primary MDB is at block 0 0x00
   alternate MDB is at block 0 0x00
   primary VHB is at block 0 0x00
   alternate VHB is at block 0 0x00
   sector size = 512 0x200
   VolumeObject flags = 0x01
   total sectors for volume = 15597568 0xee0000
   total sectors for embedded volume = 0 0x00
   CheckHFS returned 6, fsmodified = 0



Any pointers are appreciated on what the next steps would be!

Thanks

[Arch Stanton]

Don't attempt repair, it may ruin your chances. Try imaging/cloning it first (ddrescue or similar), then use file recovery software to recover the data.
What type of device was the card use in? What type of data do you expect to be on there?

[morekid]

Don't attempt repair, it may ruin your chances. Try imaging/cloning it first (ddrescue or similar), then use file recovery software to recover the data.
What type of device was the card use in? What type of data do you expect to be on there?

Hi Arch, thanks. It's a mini SD with photographic material from a camera, I'm accessing it through an SD adapter > macbook port controller.

[Arch Stanton]

OK. Yes, advise still stands. Image card, then recover the data, using DMDE, R-Studio or UFS Explorer (assuming you're trapped in a Mac environment).

If data is worth > say $250 - $300 ask a lab to do it for you, some may even charge less for logical recovery.

[morekid]

OK. Yes, advise still stands. Image card, then recover the data, using DMDE, R-Studio or UFS Explorer (assuming you're trapped in a Mac environment).

If data is worth > say $250 - $300 ask a lab to do it for you, some may even charge less for logical recovery.

Thanks, advice worked! ddrescue > DMDE.

I was able to clone the SD card and work exclusively on the image, read and restore files through DMDE.

[Arch Stanton]

Awesome, thanks for follow up!

[fzabkar]

If we strip off the first 0x40 bytes from the OP's sector dump, we are left with a standard FAT32 boot sector.

Code:

OEM identifier         "SD      "
Bytes per Sector        512
Sectors per Cluster     64
Reserved Sectors        4384
Number of FATs          2
Root Dir Entries        0
Total Sectors           0
Media Descriptor        F8h
Sectors per FAT         0
Sectors per Track       63
Number of Heads         255
Hidden Sectors          8192
Total Sectors           15597568
Big Sectors per FAT     1904
Extended Flags          0000h
FS Version              0000h
Root Start Cluster      2
FS Info Sector          1
Backup Boot Sector      6
Reserved                00000000h
Reserved                00000000h
Reserved                00000000h
Drive Number            80h
Reserved                00h
Ext. Boot Sign. (0x29)  29h
Serial Number           04030201h
Volume Name            "           "
File System Type       "FAT32   "
Boot Signature (0xAA55) 0000h

Is this normal?

[Arch Stanton]

Oh, good catch. TBH I skipped the output but now you mention it, it is so bloody obvious that I wonder how I missed that. AFAIK this isn't normal.

[Spotmen]

Hello fzabkar,

Can you explain how you do that from the output from customer ? (it's Christmas week and very quiet in the office, good time to learn something).

Thanks in advance.

[Arch Stanton]

I don't know how Frank did, but you can just grab this

eb00 9053 4420 2020 2020 2000 0240 2011
0200 0000 00f8 0000 3f00 ff00 0020 0000
0000 ee00 7007 0000 0000 0000 0200 0000
0100 0600 0000 0000 0000 0000 0000 0000
8000 2901 0203 0420 2020 2020 2020 2020
2020 4641 5433 3220 2020 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000

Pad it with zeros until you have 512 bytes and paste into a hex editor with a FAT32 boot sector template.

[fzabkar]

I picked an empty sector in DMDE, say LBA 3, and then pasted the hex data into it (Edit -> Edit Mode, Edit -> Paste). Then select Mode -> FAT/FAT32/NTFS Boot Record and Edit -> Export to Text File.

Of course you would discard changes on exit (DMDE prompts you to Write or Discard).

The procedure would be safer (and longer) if you were to write the data to a BIN file using a hex editor (eg HxD), and then view the file in DMDE.

[Spotmen]

Thank you for sharing