cgsecurity.org

Hi everyone,
My Girlfriend accidentally formated her SD Card that was used in her Samsung Galaxy S7.
As it conatined a load of pics and videos with her recently passed away dad, there is a huge pressure to recover the "deleted" files.
However, PhotoRec didn`t bring any results. AFter the scan it shows 0 files to be found.
The formating only took a few seconds and the card was taken out of the phone immediately after, so it seems quite impossible for the origonal data to be overwritten or elsewhise destroyed.

Disk /dev/sdb - 64 GB / 59 GiB (RO) - SDXC Partition Partition Start End Size in sectors
No partition 0 0 1 7783 139 36 125042688 [Whole disk]
> 1 * HPFS - NTFS 0 32 33 7783 139 36 125040640

I also tried to find my way with testdisk and got a warning:

Partition Start End Size in sectors
1 * HPFS - NTFS 0 32 33 7783 139 36 125040640
Warning: Bad starting head (CHS and LBA don't match)

Is that maybe a clue to the solution, or
what else can I try, in order to gain acces to the files?

Cheers and thanks for any help!!!

Matthias

If your card was encrypted the format operation might have erased necessary information to decrypt the card.
Please check with Samsung or a professional recovery lab.

Fortunately the card wasn't encrypted.
It could be read with a windows computer before formating without any problems

Is there any particular reason that you speak English and ignore the German forum?

It's offtopic but, I do always prefer english in forums as the language has more reach.
Is that unwanted here?
I can also post in the german forum.

Frankeinhamburg wrote: 04 Jan 2021, 16:36 Hi everyone,
My Girlfriend accidentally formated her SD Card that was used in her Samsung Galaxy S7.
As it conatined a load of pics and videos with her recently passed away dad, there is a huge pressure to recover the "deleted" files.
However, PhotoRec didn`t bring any results. AFter the scan it shows 0 files to be found.

That is strange assuming your unencrypted SD-card assumption.

The formating only took a few seconds and the card was taken out of the phone immediately after, so it seems quite impossible for the origonal data to be overwritten or elsewhise destroyed.

Disk /dev/sdb - 64 GB / 59 GiB (RO) - SDXC Partition Partition Start End Size in sectors
No partition 0 0 1 7783 139 36 125042688 [Whole disk]
> 1 * HPFS - NTFS 0 32 33 7783 139 36 125040640


What else can I try, in order to gain acces to the files?

You could properly document what you did and which settings you used when using Photorec.
You could provide a complete log file. Before running Testdisk you might disconnect all other unnecessary drives.

Alright, thanks, recuperation, I'm glad to find some help here.

So, this is what I did with photorec:

start the qphotorec.exe
Select the SD card
Select the only available partition: HPFS - NTFS exFAT 64GB /59 GiB
Select Filesystems "FAT/NTFS"
Select Search "WHOLE"
Select a folder for saved files
Hit "search"

The result is "0 files found"

Then I ran testdisk and this is the logfile:



Mon Jan 4 18:39:51 2021
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, June 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=64021856256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=64021856256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=503943528448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=7515144192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64020807680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=5368446976
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - SK hynix BC501 HFM512GDJTNG-8310A, S/N:ACE4_2E00_9541_B867., FW:80002C00
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63, sector size=512 - SDXC, FW:0001
Drive T: - 5368 MB / 5119 MiB - CHS 10485248 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 64 GB / 59 GiB - SDXC
Partition table type: Intel

Analyse Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63
Geometry from i386 MBR: head=256 sector=63
BAD_RS LBA=2048 16450622
Current partition structure:
1 * HPFS - NTFS 0 32 33 7783 139 36 125040640

Warning: Bad starting head (CHS and LBA don't match)

search_part()
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63
HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB
file_pread(5,8,buffer,125042688(7783/139/37)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042688(7783/139/37)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042689(7783/139/38)) lseek err Invalid argument
file_pread(5,14,buffer,125042690(7783/139/39)) lseek err Invalid argument
file_pread(5,3,buffer,125042704(7783/139/53)) lseek err Invalid argument
file_pread(5,3,buffer,125042751(7783/140/37)) lseek err Invalid argument
file_pread(5,8,buffer,125042767(7783/140/53)) lseek err Invalid argument
file_pread(5,11,buffer,125042814(7783/141/37)) lseek err Invalid argument
file_pread(5,2,buffer,125044736(7783/172/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 7783 139 36 125040640

search_part()
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63
HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB
file_pread(5,2,buffer,125042687(7783/139/36)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042688(7783/139/37)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.

file_pread(5,1,buffer,125042689(7783/139/38)) lseek err Invalid argument
file_pread(5,6,buffer,125042690(7783/139/39)) lseek err Invalid argument
file_pread(5,1,buffer,125042690(7783/139/39)) lseek err Invalid argument
file_pread(5,13,buffer,125042691(7783/139/40)) lseek err Invalid argument
file_pread(5,3,buffer,125042704(7783/139/53)) lseek err Invalid argument
file_pread(5,3,buffer,125042751(7783/140/37)) lseek err Invalid argument
file_pread(5,8,buffer,125042767(7783/140/53)) lseek err Invalid argument
file_pread(5,11,buffer,125042814(7783/141/37)) lseek err Invalid argument
file_pread(5,2,buffer,125044736(7783/172/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 7783 139 36 125040640
exFAT, blocksize=131072, 64 GB / 59 GiB
SIGHUP detected! TestDisk has been killed.


Any help possible?

As certain valid read attempts only return errors and Photorec find nothing I can only recommend to consult a professional recovery service.

THanks for looking into that!
It's a bummer though, as we don't have the money to have the data recovered professionally. At least it's good to know I can stop trying. That saves a lot of time.