Will Off-chip data recovery succeeded if raw recovery fails?

[Matiw]

I have one customer's SD card. It is 256 Mbyte. The card is detected but shows no data. I succeeded in recoverring some photos using logical recovery, raw recovery (PC3000 Flash, Photorec). But, the customer said that the photos that he needs have not been recovered using the logical recovery.

What is the chance of getting the data back using Off-chip recovery (remember that raw recovery was unable to detect those jpg files but it has recovered other jpg files) ?

In what conditions could this happen ? I mean the condition under which raw recovery fails but off-chip recovery succeeds ?

Thanks

[HaQue]

I have one customer's SD card. It is 256 Mbyte. The card is detected but shows no data. I succeeded in recoverring some photos using logical recovery, raw recovery (PC3000 Flash, Photorec). But, the customer said that the photos that he needs have not been recovered using the logical recovery.

What is the chance of getting the data back using Off-chip recovery (remember that raw recovery was unable to detect those jpg files but it has recovered other jpg files) ?

You don't know the chances until you try. I would try taking an image of the card (not the partition though, the whole device like I said in another recent thread) using DMDE. Then do DR on the whole disk image.

In what conditions could this happen ? I mean the condition under which raw recovery fails but off-chip recovery succeeds ?

Mainly controller failure, but I suspect broken connectors that then cause some issue as well, but that is hard to prove. Also broken PCB, component failure.

I think in this case, if what I suggested does not get anything else, you might be out of luck. Chip off recovery usually involves work getting the blocks un-mixed so we can produce an image.. which is what you would get from DMDE, or possibly already have(a working card).

As you suspect, I don't think chip off will help in this case.

[Matiw]

Yes Haque, it seems a lost cause. If the seemingly working actual controller could not get those files, it is unlikely that a simulated Software controller will get them.

Thanks for the feedback.

Mainly controller failure, but I suspect broken connectors that then cause some issue as well, but that is hard to prove. Also broken PCB, component failure.

I think in this case, if what I suggested does not get anything else, you might be out of luck. Chip off recovery usually involves work getting the blocks un-mixed so we can produce an image.. which is what you would get from DMDE, or possibly already have(a working card).

As you suspect, I don't think chip off will help in this case.

[positivebit]

I usually check if controller can write. Cut power and try to Read out the bit i wrote.

[HaQue]

I usually check if controller can write. Cut power and try to Read out the bit i wrote.

I don't understand what you mean.. If you get a Flash drive in for recovery, you try and write it, then try to read it?
Could you detail what you mean here? cheers

[positivebit]

I test functionality of controller

[Matiw]

I am able to recover other jpg files, other than the ones that I need. Does not this classify it as a working controller ?

I test functionality of controller

[HaQue]

I am able to recover other jpg files, other than the ones that I need. Does not this classify it as a working controller ?

I test functionality of controller

I would say yes, but DATA is overwritten.

[bithound]

I have encountered flash recovery cases where internal tables or markers were corrupted. Reading certain blocks via the normal card interface would return garbage or zeroes, but reading the flash chip and reconstructing the translation layer produced workable data.

Another possible cause (already mentioned) is a card with several flash chips, where one chip has a bad connection. The card might reach ready state on the other flash chip, and will return garbage or zeroes when reading data from the disconnected flash chip.

In both cases, the controller chip fails to retrieve data for certain LBA's and returns 'invented' data.

Advice for the original poster:

You could try analyzing the clone you made from the card. If parts of the file system look overwritten by garbage or zeroes, see if you can find a repeating pattern in that corruption. For example, corruption might always come in blocks of 16KB (or another power of 2). Or the same garbage pattern shows up in many different places. Those are telltale signs of a controller that fails to read the original data.

On the other hand: If the original data is lost because it is overwritten, the filesystem should contain information (artefacts / artifacts, choose your continent that that match that scenario, like files with recent creation dates and/or deleted dir entries (assuming FAT32).

Good luck,

Erik