SD Card remotely wiped with Android "Find my device" app, is recovery possible?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
helpneeded
Posts: 2
Joined: 06 Aug 2022, 17:15

SD Card remotely wiped with Android "Find my device" app, is recovery possible?

#1 Post by helpneeded »

- A family member has inadvertently factory reset their phone using the "find my device" function.
- Unfortunately, this procedure likely deleted the existing sd card partition and filesystem and overwrote it with a new filesystem wiping out years worth of jpg files.
- The family member stored 10 new photos on the sd card.

Can photorec or testdisk recovery jpg files even in the presence of a new partition and filesystem?
Can it work at a level below the filesystem and search for a signature a jpg header on the actual device?
I tried running photorec and it just recovers the 10 new photos from the new filesystem so it is looking at the new filesystem.
Is it possible to tell the app to ignore this and look deeper?

The old partition and filesystem were likely mbr/exfat although it could have been mbr/fat32.
The new partition is mbr/exfat.

I can confirm the sd card was not encrypted before or after this "find my device" feature.


helpneeded
Posts: 2
Joined: 06 Aug 2022, 17:15

Re: SD Card remotely wiped with Android "Find my device" app, is recovery possible?

#3 Post by helpneeded »

Thank you. I have read both of these resources and been working with both of these tools for several hours how but I am not having any luck. Both apps will show me the 10 new photos that are sitting in the new filesystem but I cannot see any data in the old filesystem or the filesystem that existed before the Android remote wipe operation.

Is it possible to recovery files from a partition and or filesystem that has been overwritten with a new one of the same of different type? Searching for this answer has not resulted in anything helpful either.

I have tried several paid trial software solutions as well and they all show the same 10 files that photorec/testdisk show. I can't see any data that would have existed before.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: SD Card remotely wiped with Android "Find my device" app, is recovery possible?

#4 Post by recuperation »

helpneeded wrote: 06 Aug 2022, 22:04
Thank you. I have read both of these resources and been working with both of these tools for several hours how but I am not having any luck. Both apps will show me the 10 new photos that are sitting in the new filesystem but I cannot see any data in the old filesystem or the filesystem that existed before the Android remote wipe operation.

Is it possible to recovery files from a partition and or filesystem that has been overwritten with a new one of the same of different type? Searching for this answer has not resulted in anything helpful either.
Overwritten data is always gone.
I have tried several paid trial software solutions as well and they all show the same 10 files that photorec/testdisk show. I can't see any data that would have existed before.
Well, you should have told that in your initial posting!
It looks like you did not trigger a quick format operation on your SD card but a full format.
In the first case you should have been able to recover at least some unfragmented pictures.

Locked