Author Topic: SD Card Data Recovery  (Read 9938 times)

0 Members and 1 Guest are viewing this topic.

Offline Armin

  • Honorary Leader
  • x86
  • Hero Member
  • *****
  • Posts: 2480
    • View Profile
SD Card Data Recovery
« on: November 14, 2011, 08:42:37 pm »
So a filmmaker buddy of mine accidentally formatted an SD card with his Canon 60D. On this card he had around 29GB of important footage that he hadn't backed up. From what I hear, SD card recovery is similar to any other recovery in the sense that when formatted, only the partition tables are overwritten and the actual data is left intact. luckily, my friend hadn't written any files onto the card after formatting.

So I ran a deep scan with the lovely program Recuva, and after an hour, it found all 29GB of 416 deleted jpg's, mov's and tif's. I recovered all of the files onto a separate external hard drive. The file sizes all seemed appropriate, and the image files worked 100%.

But none of the video files are able to be read by any video media program. VLC crashes, Final Cut imports a few minutes of "empty" video files filled with white noise, and none of my converting programs are able to load and convert the file to another format. The name of the files don't have any illegal characters in them that may confuse the media programs.

I'm in the process of using another program named Data LifeSaver to do a similar deep scan recovery process and hoping to have better success. I'll post an update on this soon.


Does anyone have any other ideas? Does anyone know much about paying for a professional data recovery service? As I said, the footage is of critical importance.
« Last Edit: November 14, 2011, 08:45:07 pm by Armin »
Hitmen: art is gay

Offline while1

  • x86
  • Hero Member
  • *****
  • Posts: 1013
    • View Profile
Re: SD Card Data Recovery
« Reply #1 on: November 14, 2011, 09:06:36 pm »
http://diskdigger.org/

Supports recovery of MOV files.  Try that.
« Last Edit: November 14, 2011, 09:08:09 pm by while1 »
I tend to edit my topics and replies frequently.

http://www.operationsmile.org

Offline Armin

  • Honorary Leader
  • x86
  • Hero Member
  • *****
  • Posts: 2480
    • View Profile
Re: SD Card Data Recovery
« Reply #2 on: November 15, 2011, 02:20:44 am »
DiskDigger was able to recover less data than Recuva, and has the same problem with opening the media. I tried two other recovery programs with similar lack-of-success.

Right now I'm lead to believe that Recuva had successfully recovered all of the important media, but just fudged the headers. I'm looking to obtain a working, non-recovered media file from his camera and use it as a reference to recover the header on the recovered media.

I'm also hoping that maybe with TestDisk I can somehow recover the old partition table, but I'm not sure if that's possible if the old partition table was formatted and not just corrupted.


Any other ideas?
Hitmen: art is gay

Offline Falcon

  • Full Member
  • ***
  • Posts: 241
  • I haven't visited my profile!
    • View Profile
Re: SD Card Data Recovery
« Reply #3 on: November 15, 2011, 12:23:14 pm »
I don't see how you can recover the old partition table if indeed it has been formatted, unless there's a partition table of the partition table. Maybe the user guide for the camera can provide some useful info on recovering lost data?

Offline Rule

  • x86
  • Hero Member
  • *****
  • Posts: 1588
    • View Profile
Re: SD Card Data Recovery
« Reply #4 on: November 15, 2011, 12:40:20 pm »
OT:  Hey Armin, come on AIM! (I'm on right now). :)

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: SD Card Data Recovery
« Reply #5 on: November 15, 2011, 02:20:44 pm »
Formatting doesn't destroy the partition table - it overwrites pointers that tell the OS where to find data. Unfortunately, it can't be undone (the same way a partition table can be recovered) - all a program can do is search the raw memory for chunks of files and put them back together.

It's possible that the videos are being truncated or something - it's only getting one segment, because the rest was stored elsewhere. Hard to say - I don't know much about recovery, really.

Something you guys should do - if you haven't - is make a bit-by-bit backup of the card, and don't mount the original at all. Every time you mount it, there's the chance that the computer is going to modify it. You can also flip the 'read only' switch, but I'm not sure if that does anything. I know for a fact that it's a logical thing, not a hardware, but I assume the OS respects it.

On Linux, you can mount read only by passing the "-o ro" flag to 'mount'. On Windows, there's no way that I know of.

<edit> of course, you shouldn't be mounting it anyway. You don't need to to recover data.
« Last Edit: November 15, 2011, 02:22:36 pm by iago »

Offline Armin

  • Honorary Leader
  • x86
  • Hero Member
  • *****
  • Posts: 2480
    • View Profile
Re: SD Card Data Recovery
« Reply #6 on: November 17, 2011, 06:23:00 pm »
OT:  Hey Armin, come on AIM! (I'm on right now). :)
awww, I was on a plane back to the states by the time you posted this. :(

iago, what is a good program to use to make a bit-by-bit backup of the drive?
Hitmen: art is gay

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: SD Card Data Recovery
« Reply #7 on: November 17, 2011, 06:25:04 pm »
OT:  Hey Armin, come on AIM! (I'm on right now). :)
awww, I was on a plane back to the states by the time you posted this. :(

iago, what is a good program to use to make a bit-by-bit backup of the drive?
I use dd on linux...

dd if=/dev/sda of=camera.img

where /dev/sda is the path to the sdcard drive.

Offline Armin

  • Honorary Leader
  • x86
  • Hero Member
  • *****
  • Posts: 2480
    • View Profile
Re: SD Card Data Recovery
« Reply #8 on: November 17, 2011, 07:02:48 pm »
cool. :) Does anyone have any recommendations for a Windows equivalent? I'll probably run a search for one later tonight. :)
Hitmen: art is gay

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: SD Card Data Recovery
« Reply #9 on: November 17, 2011, 07:06:01 pm »
cool. :) Does anyone have any recommendations for a Windows equivalent? I'll probably run a search for one later tonight. :)

I second this request. I tried a Windows dd-equivalent, but it was pretty much worthless.
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline Chavo

  • x86
  • Hero Member
  • *****
  • Posts: 2219
  • no u
    • View Profile
    • Chavoland
Re: SD Card Data Recovery
« Reply #10 on: November 21, 2011, 10:10:00 am »
If you were just migrating your OS, the Windows 7 installer images now come with their own image backup/restore functionality that works just fine.  For daily/weekly backups, I would normally recommend something like Ghost.

For your case, neither of these tools are correct (Ghost could make an image, but its not really what you're wanting).  If it were me in this scenario, I would just load a linux VM/livecd and use dd :).

Offline Joe

  • B&
  • x86
  • Hero Member
  • *****
  • Posts: 10319
  • In Soviet Russia, text read you!
    • View Profile
    • Github
Re: SD Card Data Recovery
« Reply #11 on: November 21, 2011, 12:07:03 pm »
cool. :) Does anyone have any recommendations for a Windows equivalent? I'll probably run a search for one later tonight. :)

If any of your creative guys have a Mac, it's got dd.

I wouldn't trust Windows to make a bit-by-bit copy of it. And it's not just cause I hate Windows. I just really don't trust it to do it perfectly.

EDIT -
I wouldn't even trust a Linux VM in a Windows hypervisor. The way Windows handles its devices just leaves me with a bad taste. With POSIX you have direct access to them. I won't pretend to know exactly what Windows does wrong, but I think I remember someone mentioning somewhere that it did something wrong, and it scares me. :)
« Last Edit: November 21, 2011, 12:42:30 pm by Joe »
I'd personally do as Joe suggests

You might be right about that, Joe.


Offline Armin

  • Honorary Leader
  • x86
  • Hero Member
  • *****
  • Posts: 2480
    • View Profile
Re: SD Card Data Recovery
« Reply #12 on: November 21, 2011, 12:44:13 pm »
If it were me in this scenario, I would just load a linux VM/livecd and use dd :).
This is what I ended up doing with Knoppix, and it worked swimmingly. :)

But I still have the problem of recovering working videos. I called one professional data recovery company, and they were saying it's very unlikely to successfully recover video data. I'm going to call around a few places today, and even if it's unlikely, I'll send in the SD card anyways and hope for the best. I'll post any subsequent updates.
« Last Edit: November 21, 2011, 03:47:25 pm by Armin »
Hitmen: art is gay

Offline Armin

  • Honorary Leader
  • x86
  • Hero Member
  • *****
  • Posts: 2480
    • View Profile
Re: SD Card Data Recovery
« Reply #13 on: December 17, 2011, 04:46:45 pm »
So after shopping around, I sent the SD card to a Data Doctors storefront in Arizona. The person I had spoken with seemed very optimistic, despite my very detailed description of the situation, and this provided me with hope in a seemingly hopeless situation. I later discovered this person participated as only a "middle-man" between myself and the "experts".

The diagnosis had cost a nonrefundable $90, and successful data recovery would cost an additional $210. I awaited three business days for a response.

The call I received was very unnerving. The "expert" had shared with me the results of the diagnosis, which were exactly equivalent with what I had independently discovered using free diagnosis software from the internet. (416 data chunks, 10 of which were recoverable pictures, the remaining were unrecoverable, fragmented video files).

What was most unnerving was that I had told the "middle-man" that I was very concerned the video files were truncated, and this "middle-man" didn't even know what truncated meant, but reassured me regardless that Data Doctors has over a 95% recovery rate.

I spoke with the "expert's" supervisor (to here on out be referred to as "super-expert"), and requested a refund for the nonrefundable diagnosis on the basis of the "middle-man's" ignorance of his own profession. The "super-expert" made a few fallible arguments that there was indeed a possibility to recover the data regardless of the original information I had presented to the "middle-man" (IE: that the file allocation table is sometimes recoverable, but really, this is only true if the partition table had been damaged and not formatted). The "super-expert" started talking in very long circles, apparently trying to confuse me with irrelevant technical jargon that would likely confuse his average customer. To avoid any further aggravation, I cut my losses of $90 and left to pick-up the SD card.

When I returned to the Data Doctors store front to pick up the SD card, the invoice stated, "data-recovery not possible due to low-level format". Really? Now they're claiming I did a low-level format? Fucking horseshit.



tl;dr:
Use Recuva (Windows only) to recover data from formatted partitions. (will not piece together fragmented files, but if the file-type is not complicated, it may be possible for you to piece it back together yourself)

Use TestDisk (All OSes) to fix damaged partition tables. (will not recover a formatted partition table)

Use a professional data recovery company ONLY IF your drive has been physically damaged or cannot be accessed by your computer, or if all else has failed and you have good reason to believe they can help you out.
« Last Edit: December 17, 2011, 10:15:30 pm by Armin »
Hitmen: art is gay

Offline Blaze

  • x86
  • Hero Member
  • *****
  • Posts: 7136
  • Canadian
    • View Profile
    • Maide
Re: SD Card Data Recovery
« Reply #14 on: December 17, 2011, 06:11:42 pm »
Doesn't sound like you had a 'professional data recovery' company.
And like a fool I believed myself, and thought I was somebody else...