All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 15 posts ] 
Author Message
 Post subject: Formatted SD card by mistake, with different file system.
PostPosted: March 31st, 2021, 8:49 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
Hello, I just joined.

I have a 64 GB Sandisk SD Card, which I use in an Android phone. Earlier, I had formatted it into two different partitions and was using it with Link2SD to move apps to the SD Card. The smaller ext3/4 partition contained the moved apps and was about 6 GBs; the other partition was probably FAT32 and was used to store other files.

Some time back, I factory reset the phone, and installed another ROM. I continued using the same SD Card, and in File Manager, it would show up as two partitions - the larger one for my files and the other smaller unused one which I had earlier used to move apps.

Since the disk space had become low on the larger partition, I decided to format the second Link2SD app partition so that I could use it store files. In Windows, you can format one partition while the other stays intact (for eg. formatting D: drive doesn't affect C: drive). I thought it would be the same here, and so I used the default file manager to format the second smaller partition. It started the process, and then I suddenly thought that it might mess up the larger partition, so I closed the app. When I opened file manager again, I found that it had formatted the whole SD Card (both partitions), and it was showing up now as exFAT. I immediately took out the card from the phone and inserted into the computer.

I tried using PhotoRec to recover the files, but it finds 0 files. I have tried both options, the first as whole disk and the second as exFAT. I have also tried the ext2/3/4 as well as the FAT/NTFS/HFS+ file systems. In all cases, it comes up with the nothing. I have also tried a few other softwares - Recuva, Easeus Data Recovery, etc, but none find anything.

HxD shows most of the data as zeroes:

https://i.postimg.cc/JmHqV7ZZ/Hx-D-image-dd.png

In summary: I had a 64 GB SD Card split into two partitions - a larger probably FAT32 that contained my files, and the other smaller ext3/4 that contained moved apps. Accidentally formatting the card has made it into a single exFAT partition. I want to recover data from the first larger partition.

I have created an image.dd file and now am working from that, but I also have the SD Card and can work from that if required.

Please help.


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 1st, 2021, 6:26 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Quote:
I tried using PhotoRec to recover the files, but it finds 0 files.


Either you'll find mostly zeros where the FAT32 once was or high entropy data due to encryption. Rather than screen-dumping boot sector in HxD you better use it to examine further out on the drive.

I have always found it rather frustrating that most tools tell so little, other than 'I found zero files'. It's why I added an entropy map to my own raw scanner so you can see if there's any data found, and if so a color indication of entropy so can spot potentially encrypted data. Black is zero entropy (so no data, just zeros or repeating single byte value pattern), the brighter the green, the higher entropy is. Highest entropy is probably encrypted data, which has it's own color cyan.

Attachment:
entropy-map.png
entropy-map.png [ 42.45 KiB | Viewed 17874 times ]

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 1st, 2021, 11:31 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
Arch Stanton wrote:
Quote:
I tried using PhotoRec to recover the files, but it finds 0 files.


Either you'll find mostly zeros where the FAT32 once was or high entropy data due to encryption. Rather than screen-dumping boot sector in HxD you better use it to examine further out on the drive.

I have always found it rather frustrating that most tools tell so little, other than 'I found zero files'. It's why I added an entropy map to my own raw scanner so you can see if there's any data found, and if so a color indication of entropy so can spot potentially encrypted data. Black is zero entropy (so no data, just zeros or repeating single byte value pattern), the brighter the green, the higher entropy is. Highest entropy is probably encrypted data, which has it's own color cyan.

Attachment:
entropy-map.png


Scrolling all the way down, HxD shows that apart from the screenshot I've most of the beginning, it is all zeroes, all the way down.

As far as I remember, my SD Card wasn't encrypted.

I'll try out JpegDigger, but from what I've understood, this tool is only for recovering jpeg image files, and not .zip or .mp4, etc, right?


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 2nd, 2021, 5:27 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Yes, JPEG only, but I mention it because it would still allow you see if there's any data at all. But if you see zeros all the way you have already verified this. Zeros = no data. There's no use in trying one more tool and one more if there's no data.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 2nd, 2021, 11:19 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
Arch Stanton wrote:
Yes, JPEG only, but I mention it because it would still allow you see if there's any data at all. But if you see zeros all the way you have already verified this. Zeros = no data. There's no use in trying one more tool and one more if there's no data.


Thanks for the reply.

If all zeros means no data, that is going to be a big problem. Can you tell how this happened? I mean, in Windows, there are two types of formatting - a quick one, which does not overwrite the data with zeroes and files can be recovered later, and a longer one which overwrites the whole disk with zeroes. After I started formatting my SD card, I quicky realized it might be deleting everything and so I stopped the formatting and removed the card, in about ten seconds. How could it have overwritten 64 GBs with zeroes in ten seconds?

From what I understand, a quick format in Windows performed on an HDD only deletes the information about where each file is located, not the file itself. I don't know if it is the same with SD cards as well.


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 4th, 2021, 8:43 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Format was executed using what? From what OS or device? Sounds like it could be TRIM like mechanism, on SD Card implemented as an ERASE. I know many Sony cameras implement it, don't know about phones/android.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 4th, 2021, 11:39 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
Arch Stanton wrote:
Format was executed using what? From what OS or device? Sounds like it could be TRIM like mechanism, on SD Card implemented as an ERASE. I know many Sony cameras implement it, don't know about phones/android.


The card was formatted in the Android phone, using its own software, and it formatted the card as exFat.


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 5th, 2021, 3:56 
Offline

Joined: March 11th, 2019, 6:41
Posts: 13
Location: Romania
Have you tried another card reader?


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: April 5th, 2021, 11:30 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
ghimpe-- wrote:
Have you tried another card reader?


I haven't tried that; I don't have another card reader at present. I'll see if I can get another one.


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: June 7th, 2021, 1:48 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
I've been trying to recover data all this time but haven't been able to find anything.

I used IsoBuster yesterday, and it shows some files found via their signature, but on double-clicking that section, says no files or folders were found using this method. I'm attaching a screenshot; I think it shows that there are files that can be recovered, but I don't know how. If anyone has any experience using IsoBuster, please help.

Image

In the Properties dialog box, in the Root tab, it shows Address, Size (Blocks), Size (Bytes), Offset (Bytes), and Extents as all 0, Attributes as 'W'.


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: June 7th, 2021, 5:05 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: June 8th, 2021, 12:50 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
Arch Stanton wrote:
I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.


Oh...

I came across this site called recoverfab which answered one of my previous questions about how everything could have been overwritten as zeroes in the short time I started the formatting and removed the card; it says that it has not been overwritten by zeroes, but the memory card controller was programmed to return zeroes, while the data is still there.

Seems like no software solution is going to work... :(


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: June 8th, 2021, 13:38 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
JoJo88 wrote:
Arch Stanton wrote:
I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.


Oh...

I came across this site called recoverfab which answered one of my previous questions about how everything could have been overwritten as zeroes in the short time I started the formatting and removed the card; it says that it has not been overwritten by zeroes, but the memory card controller was programmed to return zeroes, while the data is still there.

Seems like no software solution is going to work... :(


Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: June 9th, 2021, 0:38 
Offline

Joined: March 31st, 2021, 8:44
Posts: 8
Location: India
Arch Stanton wrote:
Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.


I had set up the SD card as portable storage, not as an extension of internal memory. Also, the card and the phone, both, are not encrypted.


Top
 Profile  
 
 Post subject: Re: Formatted SD card by mistake, with different file system
PostPosted: June 9th, 2021, 5:38 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
JoJo88 wrote:
Arch Stanton wrote:
Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.


I had set up the SD card as portable storage, not as an extension of internal memory. Also, the card and the phone, both, are not encrypted.


Okay, Then a lab may be able to recover data depending on how much time card had power after the 'accident'.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 15 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 40 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group