cgsecurity.org

I accidentally formatted the XDSD card that had some photos in there.

Camera: Sony A7Riii
Card: 128 GB Sony UHS-II SDXC
Image: raw format sony ARW
OS used for recover: MacOSX High Sierra

Process:
Formatted the card from the camera menu.

What I have done so far:
1 - I read the PDF manual of PhotoRec/TestDisk
2 - Downloaded and tried both TestDisk 7.1 and PhotoRec
3 - read and followed the instructions from the past threads on this forum: viewtopic.php?f=7&t=7607 viewtopic.php?f=7&t=4419&hilit=ARW

4 - ran the fidentify on sample raw file and it was recognized as sr2

5 - ran PhotoRec and TestDisk on the SD card.

6 - ran photoRec with file opt tif selected (got no image found)


What I'm seeing:

1 - with create image option of TestDisk: I get a an image of 128.33 GB
2 - running photoRec on the image.dd as well as directly on the SD card gives me a .gz file about 128.23 GB without any arw file recovery.

Is there an issue with file signature of photorec not recognize the newer raw images out of the Sony A7Riii? Please help!

Thanks!

Can you compress the image.dd file ? If the resulting size is very small (less than the data you were expecting to recover), it means all data has been lost: a TRIM/DISCARD operation has been triggered during the forma operation, no data can be recovered by software mean. Some data recovery company can extract the memory by bypassing the FTL but it costs $$$.

cgrenier wrote: ↑04 Dec 2018, 10:40 Can you compress the image.dd file ? If the resulting size is very small (less than the data you were expecting to recover), it means all data has been lost: a TRIM/DISCARD operation has been triggered during the forma operation, no data can be recovered by software mean. Some data recovery company can extract the memory by bypassing the FTL but it costs $$$.

Thanks for the reply. The zip file was only 128MB and I should have 10-20 gigs of images

So I looked into physical memory extraction option and I'm sharing my findings here in case others land on this thread in the future:

Looks like this is what's involved and makes sense why it's rather expensive:
https://www.gillware.com/forensics/blog ... nd-memory/

The company above provides a quote range of $250-$2800 for 128GB recover.
This link mentioned in the article above and there is a video that shows the process they go through, https://www.gillware.com/data-recovery- ... -recovery/


Here's list of other companies that I found that provide similar services:

https://trcdatarecovery.com/ssd-drive-r ... flash-read ( I have not reached out to them)

https://www.datarecovery.net/flash-memo ... overy.aspx (I requested a quote from them)


this company out of poland is selling software and adapters to recover data from NAND

https://rusolut.com

I messaged them to see if they recover data themselves or I need to use some of their partners.


This is one of their partners (also in Poland) http://www.odzyskiwanie-danych.com.pl

Their prices (from what I was able to translate from google translate) for memory recovery starts from $250 or so. I also message them.


There is another partner from the Rsolut that I also reached out to. They're in HK, I'm hoping some of these foreign companies can do it for a lower price than US.

https://www.dataexpert.com.hk/in-lab-data-recovery


I'll update this post if there is a positive outcome in the process so hopefully will help others

You can contact http://recoverfab.com/ this German company has a good reputation.