Undelete and photo recovery find no data on formatted SD Card

By | September 5, 2019

Case: SD Card is accidentally formatted in Windows (10). Some popular recovery tools are tried; Recuva from Piriform, Recoverit Photo Recovery from Wondershare and Stellar Photo Recovery. Recoverit and Stellar Photo recovery are basically nothing else than dumbed down versions of their generic data recovery tools. They fail to detect any data. In this video I will demonstrate this using Recoveit, however Recuva and Stellar had same result.

How to explain this and how to recover the photos?

Quick format

Normally a quick format on a memory card in Windows leaves the data intact, it is only the file system that is reinitialized. So in this case an easy recovery was expected, however two of the more popular goto tools for many fail to recover the data.

Format determines layout of the file system

To understand why this may be, it is important to look at the FAT32 file system layout:

BS FAT 1 FAT 2 Data Area

Roughly the file system starts with a boot sector (better: boot area as > 1 sector in size), then a file allocation table and a copy of that and finally the area containing the actual data. The boot sector describes parameters such as cluster size, size per FAT and various offsets to various structures. Of course the size of the boot area, cluster size, and FAT sizes are important to calculate where the actual data is. Assume an actual file starts at cluster 100. To ‘know’ where the file is you should know the size of the boot area, the FAT and the cluster size: File location = Size BS + (size FAT * 2) + (Cluster * cluster size).

These parameters are set at the time the drive is formatted. It is very well possible that a camera’s firmware and Windows Format use slightly different parameters when formatting the drive. And this is probably what happens in this case. If even only the size of the boot area is ONE sector different finding the rest of the data may be problematic.

Recovering the data

In general photo recovery tools fall in to two categories: File system based and carving. Carvers are theoretically file system agnostic but often try to interpret the file system to speed up scanning. As file system divide a drive up into clusters, knowing the start of the data area and the cluster size offers advantages over the need to scan all sectors: Assume a 32 KB cluster size then this limits potential file starts by a factor of 64.

File system based recovery

Recuva, Recoverit and Stellar Photo Recovery are file system based recovery tools but they both also are capable of file carving. It appears however that IF boot sector data is available they rely on this data to orient themselves on the drive. IOW, if the boot area tells the tools ‘I am 32 sectors in size’ they base all their calculations on that value.

Let us assume Windows created a 32 sector sized boot area while the camera set this value to 33 (for block alignment purposes) then all calculations will be 1 off! This mean not only will the tools have trouble interpreting file system structures, but even when carving they miss all file starts! And this probably explains why both Recuva and the Stellar software fail to detect the photos.

Recovery by carving

As mentioned due to a typical case of ‘one off’ all file starts are missed when assuming the file system parameters to be correct. As a matter of fact JpegDigger also fails to detect any photos initially (see video below). We can however tell JpegDigger to ignore the boot sector and specify our own parameters.

Theoretically we could manually set start sector to 0 and block size to 1 (= 512 bytes) to detect all files. However, as this will force JpegDigger to treat each sector as a potential file start it will make scanning slow. Ideally we want it to check at cluster size boundaries: After all the file system stores files at those boundaries.

We use the ‘Help me determine values’ option in the override window to detect correct settings. As the video shows photos it then detects photos.

 

 

Leave a Reply

Your email address will not be published.