Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Recovering Overwritten Data - SD Card

  1. #1
    Junior Member
    Join Date
    Jan 2012
    Posts
    1

    Lightbulb Recovering Overwritten Data - SD Card

    Hi,

    I've been dredging the internet for information on recovering overwritten data from a SD Card. Now, before you tell me it's not possible let me explain the circumstances and that I'm already aware of that opinion.

    The card was used in a Canon Powershot camera to take photos and video (.jpg and .avi.) and afterwards was erased with a "low level format" from within the camera. This writes 0's to all sectors of the card, making conventional recovery techniques impossible. However, I've seen several posts by users in this forum suggesting that recovery may still be possible but am not sure what those techniques would be. If I were to send it to a professional recovery service do you think it would be possible for them and what techniques would they employ?

    I should mention that I do have some experience in data recovery such as using hex to identify file headers in the recovery process. Even if recovery isn't possible I'm still interested in trying and would appreciate any advice anyone has to offer.

    Thanks! Please let me know.



    L0

  2. #2
    Administrator Steve R Jones's Avatar
    Join Date
    Apr 2011
    Location
    USA
    Posts
    390
    Have you tried any of the softwares you find when you google-> data recovery sd card

  3. #3
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    This writes 0's to all sectors of the card, making conventional recovery techniques impossible.
    Exactly! and that is not an opinion; that is a fact. This leaves you with only the possibility of a forensics solution which will be destructive.

    The problem with that is you would need a micro-electronics forensics laboratory and the staff to operate it.

    Personally, I am not aware of any commercial data recovery service that even offers to recover overwritten data from electro-mechanical drives, let alone solid state media.

    The forensics techniques used here are reliant on magnetic remnance and track overlay, neither of which apply to solid state media.

    The only people who might have a chance are the laboratories owned by or working for law enforcement and national security agencies.

    You may well have heard of recovering passords from RAM, which is a volatile form of solid state memory. For this to work you need to catch it within 30 minutes or so, and before it has been overwritten by a reboot for example. This does not apply to your case because your data have been deliberately erased.

  4. #4
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    I have personally done it with a ton of products.....however, the Format is not necessarily the problem....Have you replaced the sectors that once contained the formatted data with new data is the determining factor of a recovery....try Wondershare, here:

    http://download.wondershare.com/phot...ry_full543.exe

    Easus also has a free edition here: (recovery up to 1 Gig only)

    http://download.cnet.com/3001-2248_4...0e398469626220

    I can only post legit software links but you get the idea....let us know how it goes!!!
    Last edited by Wazz; January 20th, 2012 at 08:13 PM.
    "It is a shame that stupidity is not painful" - Anton LaVey

  5. #5
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Have you replaced the sectors that once contained the formatted data with new data is the determining factor of a recovery
    He says the entire card has been overwritten with zeroes........................

  6. #6
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    Yes nihil, I think he just meant it was formatted (not secure erased), but I could be mistaken.....

    erased with a "low level format" from within the camera. This writes 0's to all sectors of the card
    Was it a standard Format L0gic or a Secure "Wipe"


    Now that you mention it....sounds like maybe not.....Oh well, give the software a shot anyway if I mis-interpreted....long week :-\
    Last edited by Wazz; January 20th, 2012 at 10:53 PM.
    "It is a shame that stupidity is not painful" - Anton LaVey

  7. #7
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Hmmmm,

    It was a Canon compact camera, I believe? I have only ever recovered data from one of those once, but I recall that it has some very proprietary software bundled with it.

    This makes me wonder if it actually has totally overwritten (wiped/erased) rather than done some sort of proprietary "secure delete". The reason that I am thinking this is that if you can do it on the move, it is using a fair bit of battery power, so the erasing process may not be the full shilling so to speak?

    This is pure speculation, but a reasonable compromise would be to overwrite the index and file headers? that would leave the raw data that would take much more time and battery power to erase.

    If you use a hex editor you should be able to see if the card has been totally wiped or just logically wiped.

    Most of the free data recovery tools (and even the paid for ones) wouldn't be able to do anything in this scenario, and would tell you that there were no data present.

    I haven't tried it in these circumstances, but with difficult recoveries I will go to roadkil's "Unstoppable Copier". This will read damaged media (as long as you can access it) and does not care about operating systems or media format types. It reassembles what it can at a very low level, even partial records. There are versions to run under both Windows and Linux, but as I said, the application itself doesn't care about the OS or disk format of the target device.

    Warning: it takes one hell of a long time

    http://www.roadkil.net/

    He has a number of other free tools you might find interesting?

  8. #8
    Junior Member
    Join Date
    Jul 2013
    Posts
    1
    There are various reasons behind deletion of memory card files. One of the major reason is accidental deletion. While previewing some important files on the card you may hit the delete all button by mistake and thus in that way it is possible to recover lost data or files from sd card for android or camera

    Once you realize you've deleted a file, DON'T TOUCH ANY other file on that drive. That's because, when you delete a file, it's not really erased from the drive, instead, what the operating system does is to erase the "index" entry for that file (the location on the "drive map" where the actual file is located),

    Learn more: how to recover deleted files from micro sd card
    Last edited by Haiweisully; September 14th, 2013 at 09:52 AM.

  9. #9
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Read the above posts first, it really helps you know

    I shall delete your spam links for you as well..............being as how I am a nice guy

  10. #10
    Junior Member
    Join Date
    Jul 2013
    Posts
    1
    Quote Originally Posted by Haiweisully View Post
    There are various reasons behind deletion of memory card files. One of the major reason is accidental deletion. While previewing some important files on the card you may hit the delete all button by mistake and thus in that way it is possible to recover lost data or files from sd card for android or camera

    Once you realize you've deleted a file, DON'T TOUCH ANY other file on that drive. That's because, when you delete a file, it's not really erased from the drive, instead, what the operating system does is to erase the "index" entry for that file (the location on the "drive map" where the actual file is located),
    with the help pf Data Recovery software, you can recover your lost data of SD Card. Read more at: http://www.transfer-iphone-recovery.com/

Similar Threads

  1. Forensic Process and Tricks
    By Tiger Shark in forum The Security Tutorials Forum
    Replies: 3
    Last Post: January 12th, 2007, 10:44 PM
  2. An Introduction to Cryptography, and Common Electronic Cryptosystems – Part I
    By 576869746568617 in forum Cryptography, Steganography, etc.
    Replies: 1
    Last Post: July 10th, 2006, 10:38 PM
  3. HJTlog and the ISP ads
    By coolcamel in forum Spyware / Adware
    Replies: 8
    Last Post: September 29th, 2004, 02:54 PM
  4. The Worlds Longest Thread!
    By Noble Hamlet in forum AntiOnline's General Chit Chat
    Replies: 1100
    Last Post: March 17th, 2002, 09:38 AM
  5. Hacking DirecTV Lesson 1
    By KapperDog in forum Security Archives
    Replies: 0
    Last Post: September 5th, 2001, 06:34 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •