March 31st, 2021, 8:49
April 1st, 2021, 6:26
I tried using PhotoRec to recover the files, but it finds 0 files.
April 1st, 2021, 11:31
Arch Stanton wrote:I tried using PhotoRec to recover the files, but it finds 0 files.
Either you'll find mostly zeros where the FAT32 once was or high entropy data due to encryption. Rather than screen-dumping boot sector in HxD you better use it to examine further out on the drive.
I have always found it rather frustrating that most tools tell so little, other than 'I found zero files'. It's why I added an entropy map to my own raw scanner so you can see if there's any data found, and if so a color indication of entropy so can spot potentially encrypted data. Black is zero entropy (so no data, just zeros or repeating single byte value pattern), the brighter the green, the higher entropy is. Highest entropy is probably encrypted data, which has it's own color cyan.
April 2nd, 2021, 5:27
April 2nd, 2021, 11:19
Arch Stanton wrote:Yes, JPEG only, but I mention it because it would still allow you see if there's any data at all. But if you see zeros all the way you have already verified this. Zeros = no data. There's no use in trying one more tool and one more if there's no data.
April 4th, 2021, 8:43
April 4th, 2021, 11:39
Arch Stanton wrote:Format was executed using what? From what OS or device? Sounds like it could be TRIM like mechanism, on SD Card implemented as an ERASE. I know many Sony cameras implement it, don't know about phones/android.
April 5th, 2021, 3:56
April 5th, 2021, 11:30
ghimpe-- wrote:Have you tried another card reader?
June 7th, 2021, 1:48
June 7th, 2021, 5:05
June 8th, 2021, 12:50
Arch Stanton wrote:I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.
June 8th, 2021, 13:38
JoJo88 wrote:Arch Stanton wrote:I never used it. I think it shows the size of a 'virtual volume' rather than individual files though.
Oh...
I came across this site called recoverfab which answered one of my previous questions about how everything could have been overwritten as zeroes in the short time I started the formatting and removed the card; it says that it has not been overwritten by zeroes, but the memory card controller was programmed to return zeroes, while the data is still there.
Seems like no software solution is going to work...
June 9th, 2021, 0:38
Arch Stanton wrote:Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.
June 9th, 2021, 5:38
JoJo88 wrote:Arch Stanton wrote:Yes, very well possible. ERASE is a TRIM like command for SD Cards. A lab may still be able to recover the data, but depending on how card was used/configured in the phone, it may have been encrypted. Sounds like in your case it was configured as internal memory, so then it is encrypted. Indeed all in all highly unrealistic data can be recovered.
I had set up the SD card as portable storage, not as an extension of internal memory. Also, the card and the phone, both, are not encrypted.
Powered by phpBB © phpBB Group.