SD Card formated in Android phone, recovery does not work

[Frankeinhamburg]

Hi everyone,
My Girlfriend accidentally formated her SD Card that was used in her Samsung Galaxy S7.
As it conatined a load of pics and videos with her recently passed away dad, there is a huge pressure to recover the "deleted" files.
However, PhotoRec didn`t bring any results. AFter the scan it shows 0 files to be found.
The formating only took a few seconds and the card was taken out of the phone immediately after, so it seems quite impossible for the origonal data to be overwritten or elsewhise destroyed.

Disk /dev/sdb - 64 GB / 59 GiB (RO) - SDXC Partition Partition Start End Size in sectors
No partition 0 0 1 7783 139 36 125042688 [Whole disk]
> 1 * HPFS - NTFS 0 32 33 7783 139 36 125040640

I also tried to find my way with testdisk and got a warning:

Partition Start End Size in sectors
1 * HPFS - NTFS 0 32 33 7783 139 36 125040640
Warning: Bad starting head (CHS and LBA don't match)

Is that maybe a clue to the solution, or
what else can I try, in order to gain acces to the files?

Cheers and thanks for any help!!!

Matthias

[recuperation]

If your card was encrypted the format operation might have erased necessary information to decrypt the card.
Please check with Samsung or a professional recovery lab.

[Frankeinhamburg]

Fortunately the card wasn't encrypted.
It could be read with a windows computer before formating without any problems

[recuperation]

Is there any particular reason that you speak English and ignore the German forum?

[Frankeinhamburg]

It's offtopic but, I do always prefer english in forums as the language has more reach.
Is that unwanted here?
I can also post in the german forum.

[recuperation]

Hi everyone,
My Girlfriend accidentally formated her SD Card that was used in her Samsung Galaxy S7.
As it conatined a load of pics and videos with her recently passed away dad, there is a huge pressure to recover the "deleted" files.
However, PhotoRec didn`t bring any results. AFter the scan it shows 0 files to be found.

That is strange assuming your unencrypted SD-card assumption.

The formating only took a few seconds and the card was taken out of the phone immediately after, so it seems quite impossible for the origonal data to be overwritten or elsewhise destroyed.

Disk /dev/sdb - 64 GB / 59 GiB (RO) - SDXC Partition Partition Start End Size in sectors
No partition 0 0 1 7783 139 36 125042688 [Whole disk]
> 1 * HPFS - NTFS 0 32 33 7783 139 36 125040640


What else can I try, in order to gain acces to the files?

You could properly document what you did and which settings you used when using Photorec.
You could provide a complete log file. Before running Testdisk you might disconnect all other unnecessary drives.

[Frankeinhamburg]

Alright, thanks, recuperation, I'm glad to find some help here.

So, this is what I did with photorec:

start the qphotorec.exe
Select the SD card
Select the only available partition: HPFS - NTFS exFAT 64GB /59 GiB
Select Filesystems "FAT/NTFS"
Select Search "WHOLE"
Select a folder for saved files
Hit "search"

The result is "0 files found"

Then I ran testdisk and this is the logfile:



Mon Jan 4 18:39:51 2021
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, June 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=64021856256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=64021856256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=503943528448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=7515144192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64020807680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=5368446976
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - SK hynix BC501 HFM512GDJTNG-8310A, S/N:ACE4_2E00_9541_B867., FW:80002C00
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63, sector size=512 - SDXC, FW:0001
Drive T: - 5368 MB / 5119 MiB - CHS 10485248 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 64 GB / 59 GiB - SDXC
Partition table type: Intel

Analyse Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63
Geometry from i386 MBR: head=256 sector=63
BAD_RS LBA=2048 16450622
Current partition structure:
1 * HPFS - NTFS 0 32 33 7783 139 36 125040640

Warning: Bad starting head (CHS and LBA don't match)

search_part()
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63
HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB
file_pread(5,8,buffer,125042688(7783/139/37)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042688(7783/139/37)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042689(7783/139/38)) lseek err Invalid argument
file_pread(5,14,buffer,125042690(7783/139/39)) lseek err Invalid argument
file_pread(5,3,buffer,125042704(7783/139/53)) lseek err Invalid argument
file_pread(5,3,buffer,125042751(7783/140/37)) lseek err Invalid argument
file_pread(5,8,buffer,125042767(7783/140/53)) lseek err Invalid argument
file_pread(5,11,buffer,125042814(7783/141/37)) lseek err Invalid argument
file_pread(5,2,buffer,125044736(7783/172/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 7783 139 36 125040640

search_part()
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63
HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB
file_pread(5,2,buffer,125042687(7783/139/36)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042688(7783/139/37)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042689(7783/139/38)) lseek err Invalid argument
file_pread(5,6,buffer,125042690(7783/139/39)) lseek err Invalid argument
file_pread(5,1,buffer,125042690(7783/139/39)) lseek err Invalid argument
file_pread(5,13,buffer,125042691(7783/139/40)) lseek err Invalid argument
file_pread(5,3,buffer,125042704(7783/139/53)) lseek err Invalid argument
file_pread(5,3,buffer,125042751(7783/140/37)) lseek err Invalid argument
file_pread(5,8,buffer,125042767(7783/140/53)) lseek err Invalid argument
file_pread(5,11,buffer,125042814(7783/141/37)) lseek err Invalid argument
file_pread(5,2,buffer,125044736(7783/172/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB
SIGHUP detected! TestDisk has been killed.


Any help possible?

[recuperation]

As certain valid read attempts only return errors and Photorec find nothing I can only recommend to consult a professional recovery service.

[Frankeinhamburg]

THanks for looking into that!
It's a bummer though, as we don't have the money to have the data recovered professionally. At least it's good to know I can stop trying. That saves a lot of time.