Overwritten files on ext4 formatted SD card

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
hanswerner71
Posts: 3
Joined: 25 Sep 2017, 15:56

Overwritten files on ext4 formatted SD card

#1 Post by hanswerner71 »

There are some files on my ext4 formatted SD card which have been overwritten with files of the same filename.

There is plenty of space left on the SD card. So I thought, the new written data should have been written to previously free and unused sectors on the SD card due to flash memory wear leveling. However, PhotoRec cannot find the overwritten files - only the current files.

I couldn't find out, if the files are unrecoverable, because the overwriting has written onto the same sectors - or if there is a chance to recover the files, be it due to the design of the ext4 file-system or due to flash memory wear leveling or something else.

I tried to describe my problem as extensive as possible. If I could add something else to clarify the issue, please tell me.

Thank you very much :-)

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Overwritten files on ext4 formatted SD card

#2 Post by cgrenier »

Wear leveling is transparent to the OS point of view. If the same sectors have been used to store a file, the content of the previous file that was sitting at this location is lost.
There is no way to access old versions of a sector without bypassing the flash controller, very few data recovery companies can do it.

hanswerner71
Posts: 3
Joined: 25 Sep 2017, 15:56

Re: Overwritten files on ext4 formatted SD card

#3 Post by hanswerner71 »

cgrenier wrote: 26 Sep 2017, 06:50 There is no way to access old versions of a sector without bypassing the flash controller, very few data recovery companies can do it.
Thank you for your answer! Alright, so wear leveling is not relevant regarding this issue.
cgrenier wrote: 26 Sep 2017, 06:50 If the same sectors have been used to store a file, the content of the previous file that was sitting at this location is lost.
However, how can I find out, if the same sectors have been used to store the files?

hanswerner71
Posts: 3
Joined: 25 Sep 2017, 15:56

Re: Overwritten files on ext4 formatted SD card

#4 Post by hanswerner71 »

hanswerner71 wrote: 27 Sep 2017, 21:21 However, how can I find out, if the same sectors have been used to store the files?
Is this specific to the used file system? Will ext4 always use the same sectors when overwriting a file?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Overwritten files on ext4 formatted SD card

#5 Post by cgrenier »

Usually the first free sectors are used to store new files if the area is big enough to hold the file without creating file fragmentation.

Locked