Common perception is that recovery of photos and video from a in camera formatted memory card is a matter of running a file recovery or photo recovery tool. Many makers of this type of software also give the impression it is this simple (Easeus, Stellar, RecoverIt, all the usual suspects). However many Sony camera owners discover they can not recover their files using file recovery software.
What does a format operation do?
In itself a (quick) format operation does not do a whole lot and it barely ‘touches’ a drive. In essence it ‘resets’ the root folder and file allocation tables. Practically it means files and subfolders are disconnected from the root and it is no longer possible to look up which clusters specifically were allocated to any given file. Recovery of contiguous files however is still possible due the the fact actual file data remains untouched. We can detect files in subfolders via directory entries or by scanning for file specific signatures.
However not on many Sony brand cameras as many Sony users find out.
Does Sony in camera format wipe?
In online forums some suggest Sony camera’s may wipe the memory card rather than just reset the file system which would explain why the card contains mainly zeros when examined with a disk editor. Others object saying wiping takes time and the format operation literally only took a few seconds, too short to actually wipe the card.
If one would scan such a memory card with JpegDigger, the entropy map would remain black, meaning no data at all is detected. By no data I mean literally no data.
Entropy map. Black = lowest entropy = no data
Both the people who state the card was wiped and the ones claiming that this can not happen within seconds are correct in a sense: The card is erased using a TRIM like command, the ERASE command. TRIM is an ATA command which can be issues to SSD drives. The OS, or the calling utility can ‘inform’ the SSD about LBA sectors that can be erased. The SD Card specs offer a similar command.
The ERASE (SD ERASE) command
We already mentioned the file allocation tables being reset by the format procedure, but the ERASE and TRIM commands affect a layer below that. Both SSD as well as SD Card present themselves as LBA addressable drives. In essence they’re a range of sectors starting from sector 0 in which data can be stored and read from. The format command organizes this typically into clusters. If the OS (or the camera’s built-in firmware) writes a file it edits the file system to keep track of clusters in which file data is stored. If a file is read, the OS or firmware looks up clusters allocated to a file, translates this to sector addresses and uses those to read the card.
Then it’s up to the card’s firmware to deliver that data. In turn the card maintains a translation table that connects LBA addresses to actual flash pages. Due to properties of NAND flash memory newly written data to a specific LBA address ends up being written to a different flash page. And once the data is stored the translation table is updated accordingly.
But what I’m getting to is this: If I’d wipe the translation table the entire card would appear empty even though data is still physically present on the flash drive. And this is in essence what the ERASE command does. And it is this ERASE command that is employed by many Sony camera’s when the option to format the card is executed. In effect when sectors from a SD Card formatted by such a Sony camera are read, zeros are returned without LBA sectors even being read! Firmware looks up the LBA sector in translation table, sees it’s empty and simply returns zeros to the host (the OS or the camera).
Note that this is the simplified version! Point is that the SD Card firmware regards all pages as not in use.
Can data be recovered from Sony camera format?
The good news is that the answer is yes. The bad news is that you can’t do this at home, yourself.