cgsecurity.org

Hi cgsecurity, community,

Thanks for testdisk - I helped recovering files with it and it has been fantastic.

I have a question and I'm not sure where is best to ask, I thought that someone here might know this.

Long question short: Low level format on a Canon S110 seems to write zeros everywhere in the card but it can't be done as fast as it does. What's happening?

And, anyway to restore this?

But basically, and I'm testing on a Linux machine with hexedit: after doing a "Low level format" everything seems to be zero (if it's not the "Low level format" I can see the previous files and I'm sure that they could be recovered). But the "Low level format" seems to erase everything faster than I would do with "dd if=/dev/zero of=/dev/... bs=10M": how is this being done?

And, obviously, any way to "undo" it? (dreaming of an "hdparm" to undo it )

Thank you very much!

The camera is probably using a DISCARD or TRIM command: https://en.wikipedia.org/wiki/Trim_(computing) followed by a filesystem quick-format.
Some data recovery company can extract the memory chip and bypass the flash controller to recover the previous data.

I also found:
https://superuser.com/a/568054

It talks about:
ERASE_WR_BLK_START
ERASE_WR_BLK_END

Last night I did a bit of reading and I thought that the TRIM command was for SSD and the ERASE_WR_BLK_* are for SD cards (but, either way, same visible result from Linux for me without special electronics)

I guess that nothing that from a Linux computer without special electronics can be done.

Thanks very much!