cgsecurity.org

Hi there,

I hope you can help me. I've been using photorec for some time now and with great success, it's an incredible tool!

In short, the questions that is bringing me here is that I'm not being able to recover files of an sd card from a certain period of time. Photorec recovers images that go all the way back to a few years ago but there's a roughly 2 month period (in which I'm sure I used this card) from last year from which Photorec recovers nothing. It recovers images from the period after and before, but nothing from those two months.

Can you please help me in understanding why and if there's any type of solution for this?

Very best,
Hollow

Hollow77Shots wrote: 17 May 2020, 19:19 Can you please help me in understanding why and if there's any type of solution for this?

The following is very theoretical because there is nothing known about your SD card, the file system used p.e..

"why"

1. The sectors relating to your "dark period" are not accessible anymore (Don't know how Photorec reacts to an unreadable sector yet, never had the situation)
2. The sectors relating to your "dark period" have changed its content causing the file stamp to be gone. => Photorec must fail here.
3. You deleted files (not the ones you are searching for) and wrote new files to this SD card causing defragmentation.
I tried at least to describe how defragmentation affects recovery here:
viewtopic.php?p=30904#p30904

Solution:
1. Try out other third party tools. There may be remains of metadata that will be evaluated by those.
2. Consult a professional recovery service.
3. If your images do not show signs of error you can try to solve the puzzle of your own, requires a hex editor and programming abilities.

n = The capacity of your SD card
m = The sum of the length of all successfully saved pictures.
n-m = Size of the rest of space which content is currently unknown.
c = Size of cluster

x=(n-m)/c The number of cluster involved which have not been puzzled together properly.
x reflects the difficulty of your task.

As the recovered files are labeled with reference to the position they were found you can build a map with known (recovered files) and unknown (rest of space) territory.

You can search for metadata like remaining directories pointing into the dark space and puzzle clusters together.

What I try to describe here is something I managed to do only once with one file only: It was an excel file containing the invitation list for my collegue's mariage.

As you seem to be really keen on getting the rest of files but do not opt for or fail with solution 1 or 2 you could start learning how your file system works.