Looking into data loss from SD Cards

By | June 23, 2017

In this post I want to look at and discuss some cases that came to me because I offer a JPEG Repair Service.

Beyond repair

The first thing I do when I get a bunch of JPEG files for repair is opening them in a HEX viewer (see). What I do see at a regular basis is that files are completely beyond repair because they contain no meaningful data at all.

 

This corrupt JPEG is beyond repair

This JPEG file contains no meaningful data and is beyond repair

 

A very typical story is: “I was taking photos and to free up some space I attached the camera to my PC and transferred some of the files to my hard disk”. Many use a cut & paste procedure which means the files are immediately deleted from the source drive (the memory SD Card).

Truly gone

As cut & paste is essentially, copy file > delete source in one operation, I figured we should be able to undelete files from the source. However, in a number of cases it appears as if all traces of the files that were transferred were gone. (even when the user assured me that the memory card had not be used after the files were lost),

By gone I mean that files were no longer detectable by scanning directory entries (file system based recovery). Their headers (RAW recovery) could not be detected either during a scan. Which I can not really explain at this point.

Possible explanations I can think of right now are:

  • Camera firmware cleaning up file system (to explain absence of traces in file system)?
  • Camera firmware zeroing deleted data for wear leveling?
  • SD Card doing wear leveling / garbage collection (could explain absence of actual file content) ?
  • File contents were never actually written to card, fake SD Card (could explain absence of actual file content)?
Fake SD Card

Beware of fake cards!

 

Bottom line is, with copied JPEGs containing only bogus data, and no trace of the original JPGs that were deleted, we have no way of recovering these files.

Please note that a professional data recovery lab may still be able to recover data!

Preventing data loss from memory cards

Internal memory card reader

Use a memory card reader rather than connecting the camera to a PC

  • Never allow battery to drain to the point that it automatically shuts down. 
  • Do not turn the camera off before it completes whatever it is doing. It can leave the file system on the memory card in an inconsistent state and cause loss of data.
  • Do not remove neither battery or the memory card when the camera is on or connected to the PC.
  • To transfer files from card to PC, use a Card Reader rather than connecting the camera to the PC. Card readers are inexpensive or your laptop may already have one built in.
  • Don’t use the camera built in editing features (rotate etc.).
  • In case you discover a data loss, do not take any new shots using the affected memory card. This would irreversibly destroy whatever data may still be recoverable by image recovery software.
  • Beware of fake memory cards. It can be hard to tell by just looking at the card. Use a utility that can detect fake memory cards, some can be found at Raymond.cc.
Test if you have a fake card

Test if you have a fake card

If you have experienced similar cases or have any idea what is causing deleted JPEGs to vanish completely I’d love to hear from you! Please use the comment section below.

 

Leave a Reply

Your email address will not be published. Required fields are marked *