I accidentally deleted two videos off my exFAT formatted SD card. One 700mb another 1GB. I didn't notice for a few days but I haven't written anything else to the SD so any activity on the SD should be minimal.

The first thing I did was plug the card into my computer and make an image of it to work off of.
I tried various recovery software (Recuva, R-undelete, photorec,etc )
They all seem to do similar things. Most will provide two options, a "quick scan" and a "deep scan"
The quick scan will show the file structure including the two missing files. However if I look at the contents of the file in a hex editor its all "FFFFFF" (all 1's)
If I do a deep scan, it doesnt find the videos.

Even if the videos were overwritten, I find it hard to believe that 1.7GB has been overwritten. Maybe the file header has been overwritten but a large portion of the video must still be somewhere on the card.

I uploaded the videos to Facebook, however for some reason it only uploaded an extremely low quality SD version.

I'd appreciate any suggestions. I believe I need something that can search for any data that looks like "video". Even if I have 100 pieces, I can slowly reconstruct it.

Well,
what camera was this ?

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

This was from my cell phone camera. Sony Xperia Z5 Compact

Try PhotoRec and let it go through the entire card. It's free.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Per my original post, I've already tried photorec

Does the file structure report the correct sizes? If so, then perhaps the camera "wiped" the files instead of merely deleting them.

I presume you mean your other videos, not the two in question.

_________________
A backup a day keeps DR away.

Sorry I missed that.
OK now I'm interested.
If you can upload the image somewhere I can take a look.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

You could experiment by taking a blank card (zero filled), saving a short video to it, and then imaging the card. Then delete the video in the camera and take another image. A comparison of the two dumps should tell you how the camera deals with a deleted video.

_________________
A backup a day keeps DR away.

Its not a camera, its a cell phone.

Deleting is "instant" so I do not thing it is zero (or one) filling the file.

When I do a quick scan, it finds the two videos. File names and sizes look correct.

When I do a deep scan, it finds lots of deleted videos but none are those videos. The sizes are not even close.

The facebook was just a comment on facebook. I uploaded the two videos thinking it was "backed up" but facebook converted them to a low resolution version. So that really has nothing to do with the issue.

Sorry I can't upload the image. Its 128gb and has some sensitive stuff on it that I'd rather not be posted online.

As I understand "photorec", it will search for headers of specific file types and that is how it can identify an MP4. I'm guessing that the headers may have gotten over written. Therefore, is there a tool that can search for "video data". I assume video data has some unique signature making it look different than say a text file or so.

Another way to approach this problem might be to zero-fill the contents of every valid file in the image. This would only leave the deleted stuff, thereby making the data easier to distinguish in a disc/hex editor

Alternatively, configure your recovery tool to scan unused clusters only.

_________________
A backup a day keeps DR away.

_________________
A backup a day keeps DR away.

http://www.sleuthkit.org/sleuthkit/

You could use blkls to clone the unused clusters.

http://www.sleuthkit.org/sleuthkit/man/blkls.html

_________________
A backup a day keeps DR away.