SD Card Data Recovery

[Armin]

So a filmmaker buddy of mine accidentally formatted an SD card with his Canon 60D. On this card he had around 29GB of important footage that he hadn't backed up. From what I hear, SD card recovery is similar to any other recovery in the sense that when formatted, only the partition tables are overwritten and the actual data is left intact. luckily, my friend hadn't written any files onto the card after formatting.

So I ran a deep scan with the lovely program Recuva, and after an hour, it found all 29GB of 416 deleted jpg's, mov's and tif's. I recovered all of the files onto a separate external hard drive. The file sizes all seemed appropriate, and the image files worked 100%.

But none of the video files are able to be read by any video media program. VLC crashes, Final Cut imports a few minutes of "empty" video files filled with white noise, and none of my converting programs are able to load and convert the file to another format. The name of the files don't have any illegal characters in them that may confuse the media programs.

I'm in the process of using another program named Data LifeSaver to do a similar deep scan recovery process and hoping to have better success. I'll post an update on this soon.


Does anyone have any other ideas? Does anyone know much about paying for a professional data recovery service? As I said, the footage is of critical importance.

[while1]

http://diskdigger.org/

Supports recovery of MOV files.  Try that.

[Armin]

DiskDigger was able to recover less data than Recuva, and has the same problem with opening the media. I tried two other recovery programs with similar lack-of-success.

Right now I'm lead to believe that Recuva had successfully recovered all of the important media, but just fudged the headers. I'm looking to obtain a working, non-recovered media file from his camera and use it as a reference to recover the header on the recovered media.

I'm also hoping that maybe with TestDisk I can somehow recover the old partition table, but I'm not sure if that's possible if the old partition table was formatted and not just corrupted.


Any other ideas?

[Falcon]

I don't see how you can recover the old partition table if indeed it has been formatted, unless there's a partition table of the partition table. Maybe the user guide for the camera can provide some useful info on recovering lost data?

[Rule]

OT:  Hey Armin, come on AIM! (I'm on right now). :)

[iago]

Formatting doesn't destroy the partition table - it overwrites pointers that tell the OS where to find data. Unfortunately, it can't be undone (the same way a partition table can be recovered) - all a program can do is search the raw memory for chunks of files and put them back together.

It's possible that the videos are being truncated or something - it's only getting one segment, because the rest was stored elsewhere. Hard to say - I don't know much about recovery, really.

Something you guys should do - if you haven't - is make a bit-by-bit backup of the card, and don't mount the original at all. Every time you mount it, there's the chance that the computer is going to modify it. You can also flip the 'read only' switch, but I'm not sure if that does anything. I know for a fact that it's a logical thing, not a hardware, but I assume the OS respects it.

On Linux, you can mount read only by passing the "-o ro" flag to 'mount'. On Windows, there's no way that I know of.

<edit> of course, you shouldn't be mounting it anyway. You don't need to to recover data.

[Armin]

OT:  Hey Armin, come on AIM! (I'm on right now). :)

awww, I was on a plane back to the states by the time you posted this. :(

iago, what is a good program to use to make a bit-by-bit backup of the drive?

[iago]

OT:  Hey Armin, come on AIM! (I'm on right now). :)

awww, I was on a plane back to the states by the time you posted this. :(

iago, what is a good program to use to make a bit-by-bit backup of the drive?

I use dd on linux...

dd if=/dev/sda of=camera.img

where /dev/sda is the path to the sdcard drive.

[Armin]

cool. :) Does anyone have any recommendations for a Windows equivalent? I'll probably run a search for one later tonight. :)

[Newby]

cool. :) Does anyone have any recommendations for a Windows equivalent? I'll probably run a search for one later tonight. :)

I second this request. I tried a Windows dd-equivalent, but it was pretty much worthless.

[Chavo]

If you were just migrating your OS, the Windows 7 installer images now come with their own image backup/restore functionality that works just fine.  For daily/weekly backups, I would normally recommend something like Ghost.

For your case, neither of these tools are correct (Ghost could make an image, but its not really what you're wanting).  If it were me in this scenario, I would just load a linux VM/livecd and use dd :).

[Joe]

cool. :) Does anyone have any recommendations for a Windows equivalent? I'll probably run a search for one later tonight. :)

If any of your creative guys have a Mac, it's got dd.

I wouldn't trust Windows to make a bit-by-bit copy of it. And it's not just cause I hate Windows. I just really don't trust it to do it perfectly.

EDIT -
I wouldn't even trust a Linux VM in a Windows hypervisor. The way Windows handles its devices just leaves me with a bad taste. With POSIX you have direct access to them. I won't pretend to know exactly what Windows does wrong, but I think I remember someone mentioning somewhere that it did something wrong, and it scares me. :)

[Armin]

If it were me in this scenario, I would just load a linux VM/livecd and use dd :).

This is what I ended up doing with Knoppix, and it worked swimmingly. :)

But I still have the problem of recovering working videos. I called one professional data recovery company, and they were saying it's very unlikely to successfully recover video data. I'm going to call around a few places today, and even if it's unlikely, I'll send in the SD card anyways and hope for the best. I'll post any subsequent updates.

[Armin]

So after shopping around, I sent the SD card to a Data Doctors storefront in Arizona. The person I had spoken with seemed very optimistic, despite my very detailed description of the situation, and this provided me with hope in a seemingly hopeless situation. I later discovered this person participated as only a "middle-man" between myself and the "experts".

The diagnosis had cost a nonrefundable $90, and successful data recovery would cost an additional $210. I awaited three business days for a response.

The call I received was very unnerving. The "expert" had shared with me the results of the diagnosis, which were exactly equivalent with what I had independently discovered using free diagnosis software from the internet. (416 data chunks, 10 of which were recoverable pictures, the remaining were unrecoverable, fragmented video files).

What was most unnerving was that I had told the "middle-man" that I was very concerned the video files were truncated, and this "middle-man" didn't even know what truncated meant, but reassured me regardless that Data Doctors has over a 95% recovery rate.

I spoke with the "expert's" supervisor (to here on out be referred to as "super-expert"), and requested a refund for the nonrefundable diagnosis on the basis of the "middle-man's" ignorance of his own profession. The "super-expert" made a few fallible arguments that there was indeed a possibility to recover the data regardless of the original information I had presented to the "middle-man" (IE: that the file allocation table is sometimes recoverable, but really, this is only true if the partition table had been damaged and not formatted). The "super-expert" started talking in very long circles, apparently trying to confuse me with irrelevant technical jargon that would likely confuse his average customer. To avoid any further aggravation, I cut my losses of $90 and left to pick-up the SD card.

When I returned to the Data Doctors store front to pick up the SD card, the invoice stated, "data-recovery not possible due to low-level format". Really? Now they're claiming I did a low-level format? Fucking horseshit.



tl;dr:
Use Recuva (Windows only) to recover data from formatted partitions. (will not piece together fragmented files, but if the file-type is not complicated, it may be possible for you to piece it back together yourself)

Use TestDisk (All OSes) to fix damaged partition tables. (will not recover a formatted partition table)

Use a professional data recovery company ONLY IF your drive has been physically damaged or cannot be accessed by your computer, or if all else has failed and you have good reason to believe they can help you out.

[Blaze]

Doesn't sound like you had a 'professional data recovery' company.