cgsecurity.org

So my SD card (128GB) which was in my android phone just decided to not be recognisable suddenly.

All photos, videos and other files are not accessible, I put in to the PC (windows) and it asked to format, I declined tried comand and it sayd it was RAW.
Now trying testdisk to fix or recover the files.
I have read and watched tutorials but nothing works.
p unknown
I found the disk etc. it told me to select EFI GPT partition map , then it finds two partitions 1 p unknown and 2 p unknown.
2 p unknown is bigger and is E: while the other is smaller in D: (this also appears on the my computer folder).


I tried to recover through advanced and was hoping to then use boot or other command but the only options are {type} {image creation} {quit}

Disk \\.\PhysicalDrive1 - 127 GB / 119 GiB - CHS 15545 255 63
Partition Start End Size in sectors
> 1 P Unknown 2048 34815 32768 [android_meta]
2 P Unknown 34816 249737182 249702367 [android_expand] [ Type ] >[Image Creation] [ Quit ] Create an image



what does this mean ?
and can I do anything with these options to recover my files/the card?


I also tried through analyse (shows the 2 partitions} i choose quick search (was the only option)

it then just shows MS data and some numbers referring to size and there is stop at the bottom, analysis cylinder is 15545/15544:100%
took a while I had to wait maybe 20 minutes or more (why is it taking so long? - sometimes it doesn't seem to even continue) but then
it said

Structure: Ok. Use Up/Down Arrow keys to select partition. Use Left/Right Arrow keys to CHANGE partition characteristics: P=Primary D=Deleted Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue exFAT, blocksize=131072, 127 GB / 119 GiB

I pushed P and then tried to copy all the files (a, shift+c) , but the files had very strange names with chines letters and nothing looked like photos, videos or other familiar files. they also have weird dates when they were modified on them like the years 1996 or 2032 (the SD card is probably less than 2 years old and as far as I know not from the future).
I stopped the process as the files/folders were 0 bytes also, and it didn't seem like this was going to recover anything useful. also half of the files failed to copy

any suggestions of what to do and why some options are not appearing? why the wired file names and dates?

Also, if I push enter it gives me :

Disk \\.\PhysicalDrive1 - 127 GB / 119 GiB - CHS 15545 255 63 Partition Start End Size in sectors
1 P MS Data 32768 249737215 249704448 [ Quit ] >[ Return ] [Deeper Search] [ Write ] Return to partition selection


should I do a deeper search? write? I am not sure what write means, could it destroy the data if its not the correct partition?

Would be great to get some assistance, been at this for hours now trying different options...
The pics and videos are of my 4 y.o. daughters last 1.5 years and would be really sad to lose all that... (as well as some university files.. :/

Thank you for any assistance!!,
Nina

Try PhotoRec on each partition. If the files weren't encrypted and the card isn't too damaged, PhotoRec should be able to recover most of your files.

Thank you for replying,

The card looks brand new, it's basically never been out of the phone until now.
I tried photorec but it only got 4 files (I tried all partitions but only one seemed to have anything)
The files don't seem to be anything useful.


2 GPG files, Im not sure what exactly that means, does it mean its encrypted?
I tried looking this up online, but I really didn't understand what exactly it is or how to open GPG
one of the GPG files was 20GB which seems very large file, do you know what that means?

the other 2 files are swf, I still haven't figured out how to access these files, but it's definitely not any of my photos and I doubt it's any of my videos


sorry, I am really not at all a tech person this is very new and confusing for me, trying my best to understand it, and I am a single mother with a 4 y.o., so limited time :/

I am thinking to try DDrescue I am still trying to figure out how it's done as I don't have linux, I am waiting for a new flash drive to arrive in the post to try this out.

Do you think that might be more likely to work? am I wasting my time? or doing the wrong thing?

Thank you,
much appreciate any advice.


this is the report from photrec:

<?xml version="1.0" encoding="UTF-8"?>

-<dfxml xmloutputversion="1.0">


-<metadata xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Categ ... ensics_XML">

<dc:type>Carve Report</dc:type>

</metadata>


-<creator>

<package>PhotoRec</package>

<version>7.2-WIP</version>


-<build_environment>

<compiler>GCC 9.3, Cygwin32 3001.4</compiler>

<library version="1.45.3" name="libext2fs"/>

<library version="20140608" name="libewf"/>

<library version="libjpeg-turbo-1.5.3" name="libjpeg"/>

<library version="10:0:0" name="libntfs"/>

<library version="1.2.11" name="zlib"/>

</build_environment>


-<execution_environment>

<os_sysname>Windows</os_sysname>

<os_release>Windows 8 (9200)</os_release>

<os_version>Windows 8 (9200)</os_version>

<host>1363</host>

<arch>i686</arch>

<uid>197608</uid>

<start_time>2021-06-25T09:58:39+0100</start_time>

</execution_environment>

</creator>


-<source>

<image_filename>\\.\PhysicalDrive1</image_filename>

<sectorsize>512</sectorsize>

<device_model>VID:03 SC128</device_model>

<image_size>127865454592</image_size>


-<volume>


-<byte_runs>

<byte_run len="127847611904" img_offset="17825792" offset="0"/>

</byte_runs>

</volume>

</source>

<configuration> </configuration>


-<fileobject>

<filename>f106049305.gpg</filename>

<filesize>60201</filesize>


-<byte_runs>

<byte_run len="60416" img_offset="54315069952" offset="0"/>

</byte_runs>

</fileobject>


-<fileobject>

<filename>f123531115.swf</filename>

<filesize>1580426272</filesize>


-<byte_runs>

<byte_run len="1580427264" img_offset="63265756672" offset="0"/>

</byte_runs>

</fileobject>


-<fileobject>

<filename>f134012483.swf</filename>

<filesize>2747455790</filesize>


-<byte_runs>

<byte_run len="2747456512" img_offset="68632217088" offset="0"/>

</byte_runs>

</fileobject>


-<fileobject>

<filename>f206294687.gpg</filename>

<filesize>22224732160</filesize>


-<byte_runs>

<byte_run len="22224732160" img_offset="105640705536" offset="0"/>

</byte_runs>

</fileobject>

</dfxml>

nin1 wrote: 29 Jun 2021, 20:41 The card looks brand new, it's basically never been out of the phone until now.

It's maybe the cheapest thing your manufacturer could get.

I tried photorec but it only got 4 files (I tried all partitions but only one seemed to have anything)
The files don't seem to be anything useful.


2 GPG files, Im not sure what exactly that means, does it mean its encrypted?
I tried looking this up online, but I really didn't understand what exactly it is or how to open GPG
one of the GPG files was 20GB which seems very large file, do you know what that means?

Could be, but I use a smart phone only as music player.
Honestly, as you did not specify the maker and model of your phone or your SD card nobody will ever know and even if there is somebody around who shared the same experience he is unable to tell you.

the other 2 files are swf, I still haven't figured out how to access these files, but it's definitely not any of my photos and I doubt it's any of my videos

sorry, I am really not at all a tech person this is very new and confusing for me, trying my best to understand it, and I am a single mother with a 4 y.o., so limited time :/

I am thinking to try DDrescue I am still trying to figure out how it's done as I don't have linux, I am waiting for a new flash drive to arrive in the post to try this out.

Do you think that might be more likely to work? am I wasting my time? or doing the wrong thing?

What exactly? I can't give you a success forecast. You might consult a professional recovery company or try out any commercial recovery software.

The card is a san disk 128GB I bought it myself when I got the phone which is a motorola e6 android January 2020.

I am not sure why it matters what make it is to trying to recover the data.

commercial online software have not seemed to find anything else either...

nin1 wrote: 03 Jul 2021, 16:00 The card is a san disk 128GB I bought it myself when I got the phone which is a motorola e6 android January 2020.

I am not sure why it matters what make it is to trying to recover the data.

commercial online software have not seemed to find anything else either...

If you run a google search using the keywords "motorola e6 android encryption" you should receive sufficient information explaining your failure to recover. That should resolve the question "I am not sure why it matters what make it is".

Sandisk produces a range of SD cards raging from slow to fast transfer speed, especially write speed.
As you did not bother naming the model, the readers will never know what you bought:
I expect the cheapest slowest ones to be garbage dump containing flash trash. On the other hand I expect more quality in the high end range.

You should really keep all information secret to maximise the chances of not getting an answer.

I looked up motorola e6 android encryption and found nothing useful that I can understand might be connected.
I am not sure how these explains anything, the search results are explaining how to root the phone, how is this connected to recuperating the data on the SD card?
Is the card encrypted?
can I un-encrypt it?
if I try it, will ddrescue help?

the sd card is
SanDisk Ultra 128 GB microSDXC Memory Card + SD Adapter with A1 App Performance Up to 100 MB/s, Class 10, U1
I have no idea if this is a really bad card or not.

I am not keeping this information a secrete I just had no idea it mattered what type of sd card I had for trying to recuperate the data.
I haven't seen any information on the manual or this forum of people having the wrong sd card type of even mentioning it before...

Im sorry I don't know about these things, I never had a smart phone before 2020.

nin1 wrote: 05 Jul 2021, 21:33 I looked up motorola e6 android encryption and found nothing useful that I can understand might be connected.
I am not sure how these explains anything, the search results are explaining how to root the phone, how is this connected to recuperating the data on the SD card?
Is the card encrypted?
can I un-encrypt it?
if I try it, will ddrescue help?

the sd card is
SanDisk Ultra 128 GB microSDXC Memory Card + SD Adapter with A1 App Performance Up to 100 MB/s, Class 10, U1
I have no idea if this is a really bad card or not.

I am not keeping this information a secrete I just had no idea it mattered what type of sd card I had for trying to recuperate the data.
I haven't seen any information on the manual or this forum of people having the wrong sd card type of even mentioning it before...

Im sorry I don't know about these things, I never had a smart phone before 2020.

Gathered from a google search "motorola e6 android encryption" using google cache:

[...
How do I encrypt my moto e6?

Starting with Android 6.0, mandatory full disk data encryption was introduced.

What does this mean?

It means there is no need to encrypt your device running Android 6.0 and higher. It is automatically done for you.
...]

If your SD card is encrypted as well there is nothing to be found.
That is the purpose of encryption.
Honestly I can't explain that further.

All recovery tools work either on unencrypted storage or contain a decryption function requiring your key as input.
If you want to continue recovering, please ask Motorola how to decrypt.

Thank you for explaining this,
I will try and contact Motorola or see if a there are any local shops who know about this.
By the way is there a way of using testdisk etc. if one has an encryption key? or does one need some specialised software?

nin1 wrote: 15 Jul 2021, 07:57 Thank you for explaining this,
I will try and contact Motorola or see if a there are any local shops who know about this.
By the way is there a way of using testdisk etc. if one has an encryption key? or does one need some specialised software?

Testdisk only works on unencrypted data. If you have an key, decrypt your data and run testdisk on your unencrypted data afterwards.