Overwritten files on ext4 formatted SD card

Using PhotoRec to recover lost data
Post Reply
Message
Author
hanswerner71
Posts: 2
Joined: 25 Sep 2017, 15:56

Overwritten files on ext4 formatted SD card

#1 Post by hanswerner71 » 25 Sep 2017, 16:11

There are some files on my ext4 formatted SD card which have been overwritten with files of the same filename.

There is plenty of space left on the SD card. So I thought, the new written data should have been written to previously free and unused sectors on the SD card due to flash memory wear leveling. However, PhotoRec cannot find the overwritten files - only the current files.

I couldn't find out, if the files are unrecoverable, because the overwriting has written onto the same sectors - or if there is a chance to recover the files, be it due to the design of the ext4 file-system or due to flash memory wear leveling or something else.

I tried to describe my problem as extensive as possible. If I could add something else to clarify the issue, please tell me.

Thank you very much :-)

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3691
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Overwritten files on ext4 formatted SD card

#2 Post by cgrenier » 26 Sep 2017, 06:50

Wear leveling is transparent to the OS point of view. If the same sectors have been used to store a file, the content of the previous file that was sitting at this location is lost.
There is no way to access old versions of a sector without bypassing the flash controller, very few data recovery companies can do it.

hanswerner71
Posts: 2
Joined: 25 Sep 2017, 15:56

Re: Overwritten files on ext4 formatted SD card

#3 Post by hanswerner71 » 27 Sep 2017, 21:21

cgrenier wrote:
26 Sep 2017, 06:50
There is no way to access old versions of a sector without bypassing the flash controller, very few data recovery companies can do it.
Thank you for your answer! Alright, so wear leveling is not relevant regarding this issue.
cgrenier wrote:
26 Sep 2017, 06:50
If the same sectors have been used to store a file, the content of the previous file that was sitting at this location is lost.
However, how can I find out, if the same sectors have been used to store the files?

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests