cgsecurity.org

There are some files on my ext4 formatted SD card which have been overwritten with files of the same filename.

There is plenty of space left on the SD card. So I thought, the new written data should have been written to previously free and unused sectors on the SD card due to flash memory wear leveling. However, PhotoRec cannot find the overwritten files - only the current files.

I couldn't find out, if the files are unrecoverable, because the overwriting has written onto the same sectors - or if there is a chance to recover the files, be it due to the design of the ext4 file-system or due to flash memory wear leveling or something else.

I tried to describe my problem as extensive as possible. If I could add something else to clarify the issue, please tell me.

Thank you very much

Wear leveling is transparent to the OS point of view. If the same sectors have been used to store a file, the content of the previous file that was sitting at this location is lost.
There is no way to access old versions of a sector without bypassing the flash controller, very few data recovery companies can do it.

cgrenier wrote: ↑26 Sep 2017, 06:50 There is no way to access old versions of a sector without bypassing the flash controller, very few data recovery companies can do it.

Thank you for your answer! Alright, so wear leveling is not relevant regarding this issue.

cgrenier wrote: ↑26 Sep 2017, 06:50 If the same sectors have been used to store a file, the content of the previous file that was sitting at this location is lost.

However, how can I find out, if the same sectors have been used to store the files?

hanswerner71 wrote: ↑27 Sep 2017, 21:21 However, how can I find out, if the same sectors have been used to store the files?

Is this specific to the used file system? Will ext4 always use the same sectors when overwriting a file?

Usually the first free sectors are used to store new files if the area is big enough to hold the file without creating file fragmentation.