- A family member has inadvertently factory reset their phone using the "find my device" function.
- Unfortunately, this procedure likely deleted the existing sd card partition and filesystem and overwrote it with a new filesystem wiping out years worth of jpg files.
- The family member stored 10 new photos on the sd card.
Can photorec or testdisk recovery jpg files even in the presence of a new partition and filesystem?
Can it work at a level below the filesystem and search for a signature a jpg header on the actual device?
I tried running photorec and it just recovers the 10 new photos from the new filesystem so it is looking at the new filesystem.
Is it possible to tell the app to ignore this and look deeper?
The old partition and filesystem were likely mbr/exfat although it could have been mbr/fat32.
The new partition is mbr/exfat.
I can confirm the sd card was not encrypted before or after this "find my device" feature.
SD Card remotely wiped with Android "Find my device" app, is recovery possible?
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
- Posts: 2
- Joined: 06 Aug 2022, 17:15
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
-
- Posts: 2
- Joined: 06 Aug 2022, 17:15
Re: SD Card remotely wiped with Android "Find my device" app, is recovery possible?
Thank you. I have read both of these resources and been working with both of these tools for several hours how but I am not having any luck. Both apps will show me the 10 new photos that are sitting in the new filesystem but I cannot see any data in the old filesystem or the filesystem that existed before the Android remote wipe operation.recuperation wrote: ↑06 Aug 2022, 20:01 https://www.cgsecurity.org/wiki/PhotoRec
https://www.cgsecurity.org/testdisk.pdf
Is it possible to recovery files from a partition and or filesystem that has been overwritten with a new one of the same of different type? Searching for this answer has not resulted in anything helpful either.
I have tried several paid trial software solutions as well and they all show the same 10 files that photorec/testdisk show. I can't see any data that would have existed before.
-
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: SD Card remotely wiped with Android "Find my device" app, is recovery possible?
Overwritten data is always gone.helpneeded wrote: ↑06 Aug 2022, 22:04Thank you. I have read both of these resources and been working with both of these tools for several hours how but I am not having any luck. Both apps will show me the 10 new photos that are sitting in the new filesystem but I cannot see any data in the old filesystem or the filesystem that existed before the Android remote wipe operation.recuperation wrote: ↑06 Aug 2022, 20:01 https://www.cgsecurity.org/wiki/PhotoRec
https://www.cgsecurity.org/testdisk.pdf
Is it possible to recovery files from a partition and or filesystem that has been overwritten with a new one of the same of different type? Searching for this answer has not resulted in anything helpful either.
Well, you should have told that in your initial posting!I have tried several paid trial software solutions as well and they all show the same 10 files that photorec/testdisk show. I can't see any data that would have existed before.
It looks like you did not trigger a quick format operation on your SD card but a full format.
In the first case you should have been able to recover at least some unfragmented pictures.