All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 17 posts ] 
Author Message
 Post subject: Zero filled (camera formatted ) micro SD card recovery query
PostPosted: October 1st, 2022, 0:26 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 2:47 
Offline

Joined: November 7th, 2020, 5:31
Posts: 1084
Location: The_UK
I think you're misunderstanding what is going on with the cards, why they're presenting like that and why some can be recovered (others can't). I think Erkin has done a video about a sony (a7?) recovery of the situation you are describing, search the youtube channel it'll be there somewhere.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 4:21 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 258
Location: Poland
Most of such cases can be done and data recoved over NAND protocol. Is some cases when a card is formated in camera controller gives info that there's no data. Something like a fake TRIM. Same as in T2 based HDDs.

_________________
odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 4:37 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
At current time around 80% of flash cases is developing (pinout, xor, ecc, assembler etc) - thats why cases is mostly solved by technical supports, not by labs itself. Simple cases is very rare. After format if you read zeroes, usually it means that the controller is cheating on you and return zeroes. If you read data via nand protocol bypass the controller, usually we can get data back.

Customers have a very bad imagination about the difficulty of retrieving data from flash memory, due to the laboratories themselves, which record the videos, which show that "it is so simple". Flash recovery isn't easy. Imagine if you had to develop new solutions every time for 80% of disk recovery jobs.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 6:52 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
terminator2 wrote:
I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.


Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns as seen here (an additional SD_ERASE resulted in reading zeros everywhere). I assume the more powered-on idle time the card experiences the higher the chance blocks actually get erased and thus become unrecoverable.

Attachment:
File comment: entropy map before and after sd-erase
before-after-trim.png
before-after-trim.png [ 57.79 KiB | Viewed 5689 times ]

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Last edited by Arch Stanton on October 1st, 2022, 7:05, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:01 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
arvika wrote:
At current time around 80% of flash cases is developing (pinout, xor, ecc, assembler etc) - thats why cases is mostly solved by technical supports, not by labs itself. Simple cases is very rare. After format if you read zeroes, usually it means that the controller is cheating on you and return zeroes. If you read data via nand protocol bypass the controller, usually we can get data back.

Customers have a very bad imagination about the difficulty of retrieving data from flash memory, due to the laboratories themselves, which record the videos, which show that "it is so simple". Flash recovery isn't easy. Imagine if you had to develop new solutions every time for 80% of disk recovery jobs.


Thanks arvika for pointing out complexities of Nand flash recoveries which is not magic job. Even If one owns any flash tool he needs to have equal technical background and knowledge as well. After looking Sony A7 video I was planning to buy pc3000 flash,but considering complexity of work I have dropped that plan.


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:14 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Arch Stanton wrote:
terminator2 wrote:
I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.


Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns.

Attachment:
before-after-trim.png


Joep is the super guru when it comes to video/ photo recovery having many decades of experience.
His words will be definnately final and authorative .
Thanks for sharing such important information . Entropy after format shows lots of original sectors are modified.


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:18 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Arch Stanton wrote:
terminator2 wrote:
I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.


Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns as seen here (an additional SD_ERASE resulted in reading zeros everywhere). I assume the more powered-on idle time the card experiences the higher the chance blocks actually get erased and thus become unrecoverable.

Attachment:
before-after-trim.png



Thank you so much for your help. I am planning to start video recovery services and will be needing gopro recovery software / jpg repair tools etc.
I will contact you again once my website is ready.
Thank you. Wish you a nice weekend ahead.
kiran


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:21 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4311
Location: Hungary
the point of trim is to free up unused areas to perform Block Erase commands on these. This probably involves relocating pages still in use in the target block, then erasing it.
After this point the block won't contain pattern or anything, just FFs, prepared for subsequent write OPs.
Trimming is probably performed in the background, so it does not complete instantly, but i think it does not take too much time to happen.
So if you find anything else than FFs (except for a low number of bit errors) in a block, it wasn't trimmed for sure (yet). It might get trimmed by the bkgnd process though, if the unit already received such command.
SD erase command is far from being equivalent to Trim, since the latter one is selective while SD erase actually erases ~all the blocks in the flash, without thinking.

pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:27 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
terminator2 wrote:
Arch Stanton wrote:
terminator2 wrote:
I get many cases of memory cards accidentally formatted in camera.
As per popular belief no software can recover data due to complete overwriting.
However Its possible for those we have pc3000 flash or compatible tools and necessary skillset to work with monolithic nand.
I am wondering where previous data is stored in this case as there must be exactly same spare capacity to hold data.
Besides I would like to know process /entire video of the process. Does it need grinding of card ?
Where can I get all the information so that I can educate my customers. It must be complex manual process as I have asked my industry friend who has pc3000 flash he said he can do it @ aprox $300 to $400 for the same. I did not find it good to ask for video as it is his business secret.


Let's not make it more difficult or mysterious than it is.. Camera can do:

Equivalent of quick format > recoverable - Majority of cases can be recovered as many camera's do a 'quick format' and nothing else. You can use DMDE, R-Studio or any file recovery tool. Using HEX viewer will see data.

Equivalent of full format aka zero fill, not recoverable - Then there's chance a camera offers 'full format', so write zeros to entire card, typically this takes time, more than a few seconds! This can not be recovered. Using hex viewer you will see zeros.

Equivalent of TRIM, recoverable by chip-off / off-chip (PC3000, VNR, FE) - Then there's specific brands/models that send SD_ERASE command which is kind of SD card equivalent of SATA TRIM. Command typically finishes this in less than 10 seconds. Sony camera's are often doing this. Using hex viewer you will see zeros or in some cases patterns.

Attachment:
before-after-trim.png


Joep is the super guru when it comes to video/ photo recovery having many decades of experience.
His words will be definnately final and authorative .
Thanks for sharing such important information . Entropy after format shows lots of original sectors are modified.


I am an amateur, really. I like to say others like for example arvika are waaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaay more experienced and knowledgeable when it comes to NAND recovery. So when it comes to actually recovering data from the NAND chip, better listen to what he has to say rather than me.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:40 
Offline

Joined: November 7th, 2020, 5:31
Posts: 1084
Location: The_UK
terminator2 wrote:
After looking Sony A7 video I was planning to buy pc3000 flash,but considering complexity of work I have dropped that plan.
I've said before, mine sits on the shelf gathering dust. Trying to extract enough payment out of clients to justify the effort (time) required for even a simple chip off where the solutions is known is hard enough, for the odd case it makes much more sense to outsource the job.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:46 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
pepe wrote:
the point of trim is to free up unused areas to perform Block Erase commands on these. This probably involves relocating pages still in use in the target block, then erasing it.
After this point the block won't contain pattern or anything, just FFs, prepared for subsequent write OPs.
Trimming is probably performed in the background, so it does not complete instantly, but i think it does not take too much time to happen.
So if you find anything else than FFs (except for a low number of bit errors) in a block, it wasn't trimmed for sure (yet). It might get trimmed by the bkgnd process though, if the unit already received such command.
SD erase command is far from being equivalent to Trim, since the latter one is selective while SD erase actually erases ~all the blocks in the flash, without thinking.

pepe


Wo Thanks a ton for the information . Though FFs are not present they might appear later if trim command is already issued. Thank you for pointing out differnce between Trim and sd erase :D


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 7:47 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Lardman wrote:
terminator2 wrote:
After looking Sony A7 video I was planning to buy pc3000 flash,but considering complexity of work I have dropped that plan.
I've said before, mine sits on the shelf gathering dust. Trying to extract enough payment out of clients to justify the effort (time) required for even a simple chip off where the solutions is known is hard enough, for the odd case it makes much more sense to outsource the job.


yes you are right , rewards must be proportional with complexity ,technology , time & efforts.


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 11:07 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4311
Location: Hungary
terminator2 wrote:
Lardman wrote:
terminator2 wrote:
rewards must be proportional with complexity ,technology , time & efforts.


SOMETIMES the reward is the gain of knowledge and experience, plus a happy client. (and some funds)

pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 15:12 
Offline

Joined: November 7th, 2020, 5:31
Posts: 1084
Location: The_UK
pepe wrote:
SOMETIMES the reward is the gain of knowledge and experience...
Who are you and what have you done with the real pepe :lol:

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 1st, 2022, 16:33 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4311
Location: Hungary
:?: :?: :?: (could not post only one of these :)

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: Zero filled (camera formatted ) micro SD card recovery q
PostPosted: October 2nd, 2022, 8:53 
Offline

Joined: November 23rd, 2010, 13:32
Posts: 461
Location: brisbane
Thank you all of you . I learnt much about this unique recovery technique. :D :good:


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 17 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 32 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group