Please help, SD Card formatted

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
JoJo88
Posts: 6
Joined: 29 Mar 2021, 05:59

Please help, SD Card formatted

#1 Post by JoJo88 »

Hello, I just joined.

I have a 64 GB Sandisk SD Card, which I use in an Android phone. Earlier, I had formatted it into two different partitions and was using it with Link2SD to move apps to the SD Card. The smaller ext3/4 partition contained the moved apps and was about 6 GBs; the other partition was probably FAT32 and was used to store other files.

Some time back, I factory reset the phone, and installed another ROM. I continued using the same SD Card, and in File Manager, it would show up as two partitions - the larger one for my files and the other smaller unused one which I had earlier used to move apps.

Since the disk space had become low on the larger partition, I decided to format the second Link2SD app partition so that I could use it store files. In Windows, you can format one partition while the other stays intact (for eg. formatting D: drive doesn't affect C: drive). I thought it would be the same here, and so I used the default file manager to format the second smaller partition. It started the process, and then I suddenly thought that it might mess up the larger partition, so I closed the app. When I opened file manager again, I found that it had formatted the whole SD Card (both partitions), and it was showing up now as exFAT. I immediately took out the card from the phone and inserted into the computer.

I tried using PhotoRec to recover the files, but it finds 0 files. I have tried both options, the first as whole disk and the second as exFAT. I have also tried the ext2/3/4 as well as the FAT/NTFS/HFS+ file systems. In all cases, it comes up with the nothing.

In summary: I had a 64 GB SD Card split into two partitions - a larger probably FAT32 that contained my files, and the other smaller ext3/4 that contained moved apps. Accidentally formatting the card has made it into a single exFAT partition. I want to recover data from the first larger partition.

I have created an image.dd file and now am working from that, but I also have the SD Card and can work from that if required.

Please help. :(

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help, SD Card formatted

#2 Post by recuperation »

Please post your log file.

JoJo88
Posts: 6
Joined: 29 Mar 2021, 05:59

Re: Please help, SD Card formatted

#3 Post by JoJo88 »

Thanks for replying. How do I create a log file? In PhotoRec, there doesn't seem to be an option. In TestDisk, it asks in the beginning, but I didn't find any testdisk.log file in the testdisk folder or anywhere else in the computer.

Edit: Is this the correct way to create a log file - 1. Open command prompt as administrator. 2. Navigate to photorec folder. 3. Type "photorec_win.exe /log". ?

Edit 2: I ran PhotoRec with the above command. First it showed me two options for the disk, of which I selected the SD Card; in the next step, I selected whole disk and didn't make any changes to the Options tab; in the third step, I selected the 'other - FAT/NTFS/...' option, and it started the process.

Contents of the "photorec.txt" file in the folder from which I ran PhotoRec:

Code: Select all

Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63 (RO), sector size=512 - ST500LT012-1DG142, S/N:XXXXXXXX, FW:XXXXXXXX
Disk /dev/sdb - 63 GB / 59 GiB - CHS 7764 255 63 (RO), sector size=512 - Generic- xD/SD/M.S., FW:1.00

Can't open photorec.ses file: No such file or directory
Partition table type (auto): Intel
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 514080
check_part_i386 failed for partition type 0C
     No partition             0   0  1  7764 108 24  124735488 [Whole disk]
 1 P FAT32 LBA                0  32 33  7764 107 54  124733407
733 first-level signatures enabled

Analyse
     No partition             0   0  1  7764 108 24  124735488 [Whole disk]
Pass 0 (blocksize=512) STATUS_FIND_OFFSET
PhotoRec has been stopped
blocksize=65536, offset=0
Elapsed time 0h05m43s
Pass 1 (blocksize=65536) STATUS_EXT2_OFF
PhotoRec has been stopped
Elapsed time 0h06m15s
Pass 1 +0 file
Total: 0 files found

Pass 2 (blocksize=65536) STATUS_EXT2_OFF
Elapsed time 0h36m53s
Pass 2 +0 file
Total: 0 files found

124735488 sectors contain unknown data, 0 invalid files found and rejected.

PhotoRec exited normally.
I think because I stopped the process to get the log, it changed the pass from 0 to 1 and then pass 2.

Is this enough, or do I need to furnish more info?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help, SD Card formatted

#4 Post by recuperation »

Have you let Photorec run until the end?
Do not enable brute force.
Did you select a recovery folder?

JoJo88
Posts: 6
Joined: 29 Mar 2021, 05:59

Re: Please help, SD Card formatted

#5 Post by JoJo88 »

recuperation wrote: 29 Mar 2021, 15:52 Have you let Photorec run until the end?
Do not enable brute force.
Did you select a recovery folder?
Yes, it ran till the end but did not find anything.
I didn't enable brute force; I didn't make any changes to the default settings.
I also selected a recovery folder before the scan began; I don't think it allows running without a recovery folder selected.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help, SD Card formatted

#6 Post by recuperation »

That is weird.
Use a hex editor like HxD for instance to look at the content of your SD card. Is it all zeroed out or has it always the same byte value multiple times?

JoJo88
Posts: 6
Joined: 29 Mar 2021, 05:59

Re: Please help, SD Card formatted

#7 Post by JoJo88 »

recuperation wrote: 29 Mar 2021, 18:42 That is weird.
Use a hex editor like HxD for instance to look at the content of your SD card. Is it all zeroed out or has it always the same byte value multiple times?
I didn't find any option in HxD to open the SD Card, so I ran it with the image.dd file. It seems to be all zeroed out:

Image

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Please help, SD Card formatted

#8 Post by recuperation »

Using the slider you should be able to visually inspect the SD card pretty fast.
If it is all zero, you are kind of lost or the card may be broken somehow (professional recovery service)?
Anyway, when read commands only recover heaps of zeros, there is nothing to recover.

30.3.2021 10:47 MEZ: added verb in last sentence

JoJo88
Posts: 6
Joined: 29 Mar 2021, 05:59

Re: Please help, SD Card formatted

#9 Post by JoJo88 »

recuperation wrote: 29 Mar 2021, 19:24 Using the slider you should be able to visually inspect the SD card pretty fast.
If it is all zero, you are kind of lost or the card may be broken somehow (professional recovery service)?
Anyway, when read commands only recover heaps of zeros, there is nothing to recover.
If by slider you mean scrolling down, I did that, and it is zeroes all the way down.

So no recovery is possible from this card, by myself?

And how can it be all zeroes? I don't know if the phone did a quick format or a longer one, but whatever it was doing, within a few seconds, I realized that it might be deleting everything and so I stopped it (when it was showing 20%) and removed the card, so it can't have had time to overwrite everything with zeroes.

JoJo88
Posts: 6
Joined: 29 Mar 2021, 05:59

Re: Please help, SD Card formatted

#10 Post by JoJo88 »

I've been trying to recover data all this time but haven't been able to find anything.

I used IsoBuster yesterday, and it shows some files found via their signature, but on double-clicking that section, says no files or folders were found using this method. I'm attaching a screenshot; I think it shows that there are files that can be recovered, but I don't know how. If anyone has any experience using IsoBuster, please help.

Image

In the Properties dialog box, in the Root tab, it shows Address, Size (Blocks), Size (Bytes), Offset (Bytes), and Extents as all 0, Attributes as 'W'.

Locked