Page 1 of 1

trying to recover corrput SD camera card

Posted: 19 Jun 2014, 17:06
by deschnell
I've got a PNY 16GB which was fairly new that corrupted yesterday (a family trip to the zoo!). Camera is Nikon D610, but that shouldn't matter.

Photorec goes through the whole card and comes out with 0 files.

I am running Mavericks OS X, using the latest download for OS X Intel.

Here's the report.xml file:

Code: Select all

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
  <metadata 
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' 
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
  xmlns:dc='http://purl.org/dc/elements/1.1/'>
    <dc:type>Carve Report</dc:type>
  </metadata>
  <creator>
    <package>PhotoRec</package>
    <version>7.0-WIP</version>
    <build_environment>
      <compiler>GCC 4.0</compiler>
      <compilation_date>2014-06-17T18:21:04</compilation_date>
      <library name='libext2fs' version='1.42.8'/>
      <library name='libewf' version='20120504'/>
      <library name='libjpeg' version='62'/>
      <library name='libntfs' version='libntfs-3g'/>
    </build_environment>
    <execution_environment>
      <os_sysname>Darwin</os_sysname>
      <os_release>13.2.0</os_release>
      <os_version>Darwin Kernel Version 13.2.0: Thu Apr 17 23:03:13 PDT 2014; root:xnu-2422.100.13~1/RELEASE_X86_64</os_version>
      <host>macbookProDS.local</host>
      <arch>x86_64</arch>
      <uid>0</uid>
      <start_time>2014-06-18T23:43:50-0600</start_time>
    </execution_environment>
  </creator>
  <source>
    <image_filename>/dev/disk1</image_filename>
    <sectorsize>512</sectorsize>
    <image_size>16089350144</image_size>
    <volume>
      <byte_runs>
        <byte_run offset='0' img_offset='0' len='16089350144'/>
      </byte_runs>
    </volume>
  </source>
  <configuration>
  </configuration>
</dfxml>
I also tried running testdisk, which gave me no readable partitions, either in the actual SD card, or in the .dd file created by photorec.
and testdisk log file:

Code: Select all


Thu Jun 19 09:05:27 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.2.0 (Darwin Kernel Version 13.2.0: Thu Apr 17 23:03:13 PDT 2014; root:xnu-2422.1
Compiler: GCC 4.0
Compilation date: 2014-06-17T18:21:04
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
User is not root!
Hard disk list
Disk /dev/disk2 - 1073 MB / 1024 MiB - 2097152 sectors (RO), sector size=512
Disk /dev/rdisk1 - 16 GB / 14 GiB - 31424512 sectors, sector size=512
Disk /dev/rdisk2 - 1073 MB / 1024 MiB - 2097152 sectors (RO), sector size=512

Partition table type default to EFI GPT
Disk /dev/rdisk1 - 16 GB / 14 GiB
Partition table type: Intel

Analyse Disk /dev/rdisk1 - 16 GB / 14 GiB - 31424512 sectors
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/rdisk1 - 16 GB / 14 GiB - 31424512 sectors

Results

interface_write()
 
No partition found or selected for recovery
Obviously trying to save these files... but I don't know what else to try. I have also tried the demo of "PhotoRescue" which found 0 files.

Re: trying to recover corrput SD camera card

Posted: 20 Jun 2014, 08:38
by cgrenier
If you have a image.dd file, it has been created using TestDisk, Advanced, Image Creation, not via PhotoRec.
Can you compress this file and report its size ?

Re: trying to recover corrput SD camera card

Posted: 20 Jun 2014, 19:05
by deschnell
raw .dd file is 16,089,350,144 bytes (16.09 GB on disk)
zipped (through OS X Finder's built-in compressor) is 17,916,942 bytes (17.9 MB on disk)
Clearly there are not 300 photos there (since jpgs don't zip well)!

Re: trying to recover corrput SD camera card

Posted: 20 Jun 2014, 19:07
by deschnell
I am somewhat certain that the memory controller has failed - all of this happened after going through a humid butterfly exhibit from a cooler outdoors... there was condensation on the lens, which means inside camera too.

Re: trying to recover corrput SD camera card

Posted: 20 Jun 2014, 20:42
by deschnell
I just tried using dd from the terminal to create a new image - same output file size, but when I zipped it it came to 30MB.