Undelete files from an exFAT SD card

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
oxon
Posts: 8
Joined: 02 Mar 2022, 07:44

Undelete files from an exFAT SD card

#1 Post by oxon »

Hi,

I am trying to undelete some photo and movie files from a 128 GB SD card which is formatted with exFAT. I can recover a part of them by using PhotoRec, but due to filename loss in PhotoRec, I would like to try TestDisk as well.

When I list the photo and movie directory on the card, namely /DCIM/100CANON for Canon cameras, the error message "No file found, filesystem may be damaged." is shown.

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
 1 P HPFS - NTFS                32768  241729535  241696768
Directory /DCIM/100CANON

No file found, filesystem may be damaged.

Use Left arrow to go back, Right to change directory, h to hide deleted files
    q to quit, : to select the current file, a to select all files
    C to copy the selected files, c to copy the current file
Is TestDisk able to list deleted files on exFAT? The document says yes, but my files, which can be recovered by PhotoRec, are not listed.
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Undelete files from an exFAT SD card

#2 Post by recuperation »

Please post your Testdisk logfile.
Top
oxon
Posts: 8
Joined: 02 Mar 2022, 07:44

Re: Undelete files from an exFAT SD card

#3 Post by oxon »

Code: Select all

Wed Mar  2 15:59:23 2022
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 21.3.0 (Darwin Kernel Version 21.3.0: Wed Jan  5 21:37:58 PST 2022; root:xnu-8019.80.24~20/RELEASE_X86_64) x86_64
Compiler: GCC 4.2
ext2fs lib: none, ntfs lib: none, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.7
Hard disk list
Disk /dev/disk2 - 123 GB / 115 GiB - 241729536 sectors (RO), sector size=512
Disk /dev/rdisk2 - 123 GB / 115 GiB - 241729536 sectors (RO), sector size=512

Partition table type (auto): Intel
Media is opened in read-only.
Disk /dev/rdisk2 - 123 GB / 115 GiB (RO)
Partition table type: Intel

Analyse Disk /dev/rdisk2 - 123 GB / 115 GiB - 241729536 sectors (RO)
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=32768 20
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
Current partition structure:
 1 P HPFS - NTFS                32768  241729535  241696768

Warning: Bad starting sector (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/rdisk2 - 123 GB / 115 GiB - 241729536 sectors (RO)
     HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 128.

Results
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB


dir_partition inode=0
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
Directory /
     130 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 DCIM
     131 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 MISC
       5 drwxr-xr-x     0      0    131072  1-Mar-2022 20:55 .fseventsd

dir_partition inode=130
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
Directory /DCIM
     132 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 100CANON
     133 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 CANONMSC

dir_partition inode=132
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
Directory /DCIM/100CANON
Directory /DCIM
     132 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 100CANON
     133 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 CANONMSC

dir_partition inode=132
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
Directory /DCIM/100CANON
Directory /DCIM
     132 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 100CANON
     133 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 CANONMSC
Directory /
     130 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 DCIM
     131 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 MISC
       5 drwxr-xr-x     0      0    131072  1-Mar-2022 20:55 .fseventsd


dir_partition inode=0
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
Directory /
     130 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 DCIM
     131 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 MISC
       5 drwxr-xr-x     0      0    131072  1-Mar-2022 20:55 .fseventsd

dir_partition inode=130
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
Directory /DCIM
     132 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 100CANON
     133 drwxr-xr-x     0      0    131072  9-Feb-2022 07:45 CANONMSC

dir_partition inode=132
   * HPFS - NTFS                32768  241729535  241696768
     exFAT, blocksize=131072, 123 GB / 115 GiB
Directory /DCIM/100CANON
SIGINT detected! TestDisk has been killed.
Top
oxon
Posts: 8
Joined: 02 Mar 2022, 07:44

Re: Undelete files from an exFAT SD card

#4 Post by oxon »

Thank you for your help. The card was initialized by Canon EOS R5. I did not see any card error or damage so far while shooting photos and copying them to a Mac. I just want to recover some photos that I accidentally deleted.
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Undelete files from an exFAT SD card

#5 Post by recuperation »

If the directory entries on your SDcard have been overwritten since you deleted the pictures Testdisk can't help you. The fact that you can only recover some parts of your deleted files underline my assumption.
Top
oxon
Posts: 8
Joined: 02 Mar 2022, 07:44

Re: Undelete files from an exFAT SD card

#6 Post by oxon »

I did not intentionally change the directory structure but macOS automatically updated the /.fseventsd directory when I connected the card to my Mac. Does it also affect on the file listing in other directories?

Code: Select all

$ ls -la /Volumes/EOS_DIGITAL
total 1024
drwxrwxrwx  1 oxon  staff  131072 Jan  1  1980 .
drwxr-xr-x  9 root  wheel     288 Mar  2 14:55 ..
drwxrwxrwx  1 oxon  staff  131072 Mar  2 14:55 .fseventsd
drwxrwxrwx  1 oxon  staff  131072 Feb  9 07:45 DCIM
drwxrwxrwx  1 oxon  staff  131072 Feb  9 07:45 MISC
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Undelete files from an exFAT SD card

#7 Post by recuperation »

The clusters used by your deleted files have been freed upon deletion.
Any succeeding write process can lead to them used by other new files.

If you deleted your files in one subdirectory and your operating system was writing to another one, then the subdirectory entries should be still there but the clusters they point to may already be used by other files.
Top
oxon
Posts: 8
Joined: 02 Mar 2022, 07:44

Re: Undelete files from an exFAT SD card

#8 Post by oxon »

Would it really happen? There were ~1000 files in that directory, /DCIM/100CANON, but all the deleted files become invisible to TestDisk even by adding a single tiny file?
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Undelete files from an exFAT SD card

#9 Post by recuperation »

oxon wrote: ↑02 Mar 2022, 17:58 Would it really happen? There were ~1000 files in that directory, /DCIM/100CANON, but all the deleted files become invisible to TestDisk even by adding a single tiny file?
I explained the mechanism to you. There is nothing to add. Terms like "1000 files" and "single tiny file" are completely meaningless. I don't explain why, I think that is too obvious.
Top
oxon
Posts: 8
Joined: 02 Mar 2022, 07:44

Re: Undelete files from an exFAT SD card

#10 Post by oxon »

Thank you for your explanation, but I do not still understand the mechanism.

On exFAT or FAT32 SD cards used in digital cameras, deleted files can be undelete by TestDisk in many cases even after taking additional photos on the same card. Because taking several photos (~100 MB) cannot overwrite whole deleted photos.

Similarly, automatic generation of /.fseventsd that uses less than 1 MB by macOS will not entirely overwrite the deleted photos that are more than 20 GB. That's why a part of the 20 GB data can be recovered by PhotoRec.

Does your mechanism happen only when adding a new directory?

The directory structure is as follows. Photo and movie files are stored in /DCIM/100CANON.

Code: Select all

/.fseventsd
/.fseventsd/fseventsd-uuid
/DCIM
/DCIM/100CANON
/DCIM/CANONMSC
/MISC
Top
Locked

Return to “File undelete”