Zero filled (camera formatted ) micro SD card recovery query

[terminator2]

I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.

[Lardman]

I think you're misunderstanding what is going on with the cards, why they're presenting like that and why some can be recovered (others can't). I think Erkin has done a video about a sony (a7?) recovery of the situation you are describing, search the youtube channel it'll be there somewhere.

[melvin]

Most of such cases can be done and data recoved over NAND protocol. Is some cases when a card is formated in camera controller gives info that there's no data. Something like a fake TRIM. Same as in T2 based HDDs.

[arvika]

At current time around 80% of flash cases is developing (pinout, xor, ecc, assembler etc) - thats why cases is mostly solved by technical supports, not by labs itself. Simple cases is very rare. After format if you read zeroes, usually it means that the controller is cheating on you and return zeroes. If you read data via nand protocol bypass the controller, usually we can get data back.

Customers have a very bad imagination about the difficulty of retrieving data from flash memory, due to the laboratories themselves, which record the videos, which show that "it is so simple". Flash recovery isn't easy. Imagine if you had to develop new solutions every time for 80% of disk recovery jobs.

[Arch Stanton]

I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.

Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns as seen here (an additional SD_ERASE resulted in reading zeros everywhere). I assume the more powered-on idle time the card experiences the higher the chance blocks actually get erased and thus become unrecoverable.

entropy map before and after sd-erase

Last edited by Arch Stanton on October 1st, 2022, 7:05, edited 1 time in total.

[terminator2]

At current time around 80% of flash cases is developing (pinout, xor, ecc, assembler etc) - thats why cases is mostly solved by technical supports, not by labs itself. Simple cases is very rare. After format if you read zeroes, usually it means that the controller is cheating on you and return zeroes. If you read data via nand protocol bypass the controller, usually we can get data back.

Customers have a very bad imagination about the difficulty of retrieving data from flash memory, due to the laboratories themselves, which record the videos, which show that "it is so simple". Flash recovery isn't easy. Imagine if you had to develop new solutions every time for 80% of disk recovery jobs.

Thanks arvika for pointing out complexities of Nand flash recoveries which is not magic job. Even If one owns any flash tool he needs to have equal technical background and knowledge as well. After looking Sony A7 video I was planning to buy pc3000 flash,but considering complexity of work I have dropped that plan.

[terminator2]

I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.

Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns.

before-after-trim.png

Joep is the super guru when it comes to video/ photo recovery having many decades of experience.
His words will be definnately final and authorative .
Thanks for sharing such important information . Entropy after format shows lots of original sectors are modified.

[terminator2]

I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.

Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns as seen here (an additional SD_ERASE resulted in reading zeros everywhere). I assume the more powered-on idle time the card experiences the higher the chance blocks actually get erased and thus become unrecoverable.

before-after-trim.png

Thank you so much for your help. I am planning to start video recovery services and will be needing gopro recovery software / jpg repair tools etc.
I will contact you again once my website is ready.
Thank you. Wish you a nice weekend ahead.
kiran

[pepe]

the point of trim is to free up unused areas to perform Block Erase commands on these. This probably involves relocating pages still in use in the target block, then erasing it.
After this point the block won't contain pattern or anything, just FFs, prepared for subsequent write OPs.
Trimming is probably performed in the background, so it does not complete instantly, but i think it does not take too much time to happen.
So if you find anything else than FFs (except for a low number of bit errors) in a block, it wasn't trimmed for sure (yet). It might get trimmed by the bkgnd process though, if the unit already received such command.
SD erase command is far from being equivalent to Trim, since the latter one is selective while SD erase actually erases ~all the blocks in the flash, without thinking.

pepe

[Arch Stanton]

I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.

Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns.

before-after-trim.png

Joep is the super guru when it comes to video/ photo recovery having many decades of experience.
His words will be definnately final and authorative .
Thanks for sharing such important information . Entropy after format shows lots of original sectors are modified.

I am an amateur, really. I like to say others like for example arvika are waaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaay more experienced and knowledgeable when it comes to NAND recovery. So when it comes to actually recovering data from the NAND chip, better listen to what he has to say rather than me.

[Lardman]

After looking Sony A7 video I was planning to buy pc3000 flash,but considering complexity of work I have dropped that plan.

I've said before, mine sits on the shelf gathering dust. Trying to extract enough payment out of clients to justify the effort (time) required for even a simple chip off where the solutions is known is hard enough, for the odd case it makes much more sense to outsource the job.

[terminator2]

the point of trim is to free up unused areas to perform Block Erase commands on these. This probably involves relocating pages still in use in the target block, then erasing it.
After this point the block won't contain pattern or anything, just FFs, prepared for subsequent write OPs.
Trimming is probably performed in the background, so it does not complete instantly, but i think it does not take too much time to happen.
So if you find anything else than FFs (except for a low number of bit errors) in a block, it wasn't trimmed for sure (yet). It might get trimmed by the bkgnd process though, if the unit already received such command.
SD erase command is far from being equivalent to Trim, since the latter one is selective while SD erase actually erases ~all the blocks in the flash, without thinking.

pepe

Wo Thanks a ton for the information . Though FFs are not present they might appear later if trim command is already issued. Thank you for pointing out differnce between Trim and sd erase

[terminator2]

After looking Sony A7 video I was planning to buy pc3000 flash,but considering complexity of work I have dropped that plan.

I've said before, mine sits on the shelf gathering dust. Trying to extract enough payment out of clients to justify the effort (time) required for even a simple chip off where the solutions is known is hard enough, for the odd case it makes much more sense to outsource the job.

yes you are right , rewards must be proportional with complexity ,technology , time & efforts.

[pepe]

rewards must be proportional with complexity ,technology , time & efforts.

SOMETIMES the reward is the gain of knowledge and experience, plus a happy client. (and some funds)

pepe

[Lardman]

SOMETIMES the reward is the gain of knowledge and experience...

Who are you and what have you done with the real pepe

[pepe]

(could not post only one of these

[terminator2]

Thank you all of you . I learnt much about this unique recovery technique.