cgsecurity.org

- A family member has inadvertently factory reset their phone using the "find my device" function.
- Unfortunately, this procedure likely deleted the existing sd card partition and filesystem and overwrote it with a new filesystem wiping out years worth of jpg files.
- The family member stored 10 new photos on the sd card.

Can photorec or testdisk recovery jpg files even in the presence of a new partition and filesystem?
Can it work at a level below the filesystem and search for a signature a jpg header on the actual device?
I tried running photorec and it just recovers the 10 new photos from the new filesystem so it is looking at the new filesystem.
Is it possible to tell the app to ignore this and look deeper?

The old partition and filesystem were likely mbr/exfat although it could have been mbr/fat32.
The new partition is mbr/exfat.

I can confirm the sd card was not encrypted before or after this "find my device" feature.

https://www.cgsecurity.org/wiki/PhotoRec
https://www.cgsecurity.org/testdisk.pdf

recuperation wrote: 06 Aug 2022, 20:01 https://www.cgsecurity.org/wiki/PhotoRec
https://www.cgsecurity.org/testdisk.pdf

Thank you. I have read both of these resources and been working with both of these tools for several hours how but I am not having any luck. Both apps will show me the 10 new photos that are sitting in the new filesystem but I cannot see any data in the old filesystem or the filesystem that existed before the Android remote wipe operation.

Is it possible to recovery files from a partition and or filesystem that has been overwritten with a new one of the same of different type? Searching for this answer has not resulted in anything helpful either.

I have tried several paid trial software solutions as well and they all show the same 10 files that photorec/testdisk show. I can't see any data that would have existed before.

helpneeded wrote: 06 Aug 2022, 22:04

recuperation wrote: 06 Aug 2022, 20:01 https://www.cgsecurity.org/wiki/PhotoRec
https://www.cgsecurity.org/testdisk.pdf

Thank you. I have read both of these resources and been working with both of these tools for several hours how but I am not having any luck. Both apps will show me the 10 new photos that are sitting in the new filesystem but I cannot see any data in the old filesystem or the filesystem that existed before the Android remote wipe operation.

Is it possible to recovery files from a partition and or filesystem that has been overwritten with a new one of the same of different type? Searching for this answer has not resulted in anything helpful either.

Overwritten data is always gone.

I have tried several paid trial software solutions as well and they all show the same 10 files that photorec/testdisk show. I can't see any data that would have existed before.

Well, you should have told that in your initial posting!
It looks like you did not trigger a quick format operation on your SD card but a full format.
In the first case you should have been able to recover at least some unfragmented pictures.