Recovering deleted data from SD card

TheCenturion · 23 Apr 2013 at 22:54

A mate accidentally deleted a load of photos and videos from his SD card. He then used a bit of software (I'm not sure which) and was able to recover the photos. However he can't recover the videos. Does anyone know a way to do this?

I'll try to find out the name of the software he used.

Thanks guys

PapaLazaru · 23 Apr 2013 at 23:09

It may well have been this but if not, it is worth a try - http://www.piriform.com/recuva

nelviss · 23 Apr 2013 at 23:09

one word. Reuva, had to use it yesterday works good took 2h for a 16g and <20m for 1g

http://www.filehippo.com/download_recuva

FinglisHobbit · 23 Apr 2013 at 23:11

Another one for Recuva

I've used it a few times.

anything I don't mind · 23 Apr 2013 at 23:12

best recovery company I am aware of is ontrack, saved me a few times, If they can't recovery it, its gone

MooMoo444 · 23 Apr 2013 at 23:14

Kinda makes you lose faith in the delete function if everything is still there <_<

TheCenturion · 23 Apr 2013 at 23:18

Thanks guys. Apparently he tried recuva but that could only recover a few pictures. He bought some software called card recovery for $40 and that recovered all the pictures but not the videos.

bainbridge · 23 Apr 2013 at 23:21

Makes me glad I format my portable drives after emptying them, though I wouldn't put it past these recovery companies still being able to recover the data.

Strife212 · 23 Apr 2013 at 23:23

MooMoo444 said:
Kinda makes you lose faith in the delete function if everything is still there <_<

It literally just puts a mark on the files that notes it's "deleted" and then hides it.

Then if you put another file there it will overwrite it.

bainbridge said:
Makes me glad I format my portable drives after emptying them, though I wouldn't put it past these recovery companies still being able to recover the data.

If it's "quick format" that's the same, anyone can recover it.

Sin_Chase · 23 Apr 2013 at 23:26

photorec / testdisk is my favourite.

bainbridge · 23 Apr 2013 at 23:39

Strife212 said:
It literally just puts a mark on the files that notes it's "deleted" and then hides it.

Then if you put another file there it will overwrite it.

If it's "quick format" that's the same, anyone can recover it.

And if I untick quick format next time does that mean it's gone?

VTR · 23 Apr 2013 at 23:44

bainbridge said:
And if I untick quick format next time does that mean it's gone?

No use CC cleaner and the drive overwrite option with advanced 7 write to be sure it's gone.

MaximusV · 23 Apr 2013 at 23:45

bainbridge said:
And if I untick quick format next time does that mean it's gone?

If someone really wants to they can usually always get the data back, unless you run something thorough over 100's of passes.

infernox · 23 Apr 2013 at 23:46

Another Vote for testdisk, have got videos in the past with it fine.

It lists all the files available for restore on the directory, fixes partition tables the lot, and its free, what more can you ask??

Richie · 24 Apr 2013 at 06:36

MaximusV said:
If someone really wants to they can usually always get the data back, unless you run something thorough over 100's of passes.

I still cant quite get this. Why would it need more than 1 pass. Quick example:

If a disc has a file which takes up 10 blocks and the file is deleted then these blocks are overwritten ONCE, either by a eraser program or by another file, how is it possible to recover the previous file?

If someone can show me then I will believe it but the practical and common sense side of my brain states that it is not possible.

arknor · 24 Apr 2013 at 06:42

A lot of cameras don't actually delete the videos and photos when you delete them btw they sit on the card until the camera overwrites them.

I learned this when I was asked to recover some movies deleted on a sony handycams memory card, upon opening the card in windows I discovered everything deleted was still intact on the memory card so the camera must just remove them from its database and then delete the files as needed or something.

If someone can show me then I will believe it but the practical and common sense side of my brain states that it is not possible.

Yea I don't see how it would be possible to recover data that has been overwritten already its not like media has some hidden cache of the whole hdd or the previous data stays underneath....

Surely its no different to filling the hdd with 0's ?

AshD93 · 24 Apr 2013 at 08:54

I thought a full format and then fill the storage medium totally with random files would do the job too.

Oz!asM!dwinter · 24 Apr 2013 at 09:14

Richie said:
I still cant quite get this. Why would it need more than 1 pass. Quick example:

If a disc has a file which takes up 10 blocks and the file is deleted then these blocks are overwritten ONCE, either by a eraser program or by another file, how is it possible to recover the previous file?

If someone can show me then I will believe it but the practical and common sense side of my brain states that it is not possible.

Magnetic hysteresis - basically when you write data to a magnetic hard drive the final state of a particular memory 'unit' will depend on all the operations performed on it before, making it possible to infer the previous operations based on current state.

http://computer-forensics.sans.org/blog/2009/01/15/overwriting-hard-drive-data/

I doubt this applies to solid state memory devices however, with flash memory once you overwrite something it's gone.

arknor · 24 Apr 2013 at 09:18

You would not get continoues data though only parts of it and the guy even says a coin toss to determine what was there would be more accurate

Delvis · 24 Apr 2013 at 22:29

I use test disk personally, completely free.

The only downside is the drive does need to be assigned a drive letter, otherwise its not failed me.