Photo Recovery from SD/CF Cards

[+++MadMatt+++]

I have used two free programs to try and recover some very important photos from a clients memory cards, but they can't seem to go back far enough. He told me that he may have wiped the cards 8 times over, is it even possible to recover data, after having done that?

What are my options? I thought data always remained on the storage device no matter how many times it's deleted?!

Any help, would be welcome. Thanks!

 

[loaner]

as soon as they lost the data, they should have called someone.

I'm not sure what you mean by "they wiped it 8 times". If data is lost, the hard drive should never be booted again. The drive should be slaved and cloned.

Every time the drive is booted(assuming it's a boot drive because you didn't specify), files are over written and such.

I don't know how long you've fooled with this, but I'd tell them to send it to a lab for 800-1200 bucks for a 75% to 85% retrieval rate.

send them on down the street and get to working on other stuff....

 

[toukour]

I do like CardRecovery ; it is very powerful .

 

[DCGPX]

as soon as they lost the data, they should have called someone.

I'm not sure what you mean by "they wiped it 8 times". If data is lost, the hard drive should never be booted again. The drive should be slaved and cloned.

Every time the drive is booted(assuming it's a boot drive because you didn't specify), files are over written and such.

I don't know how long you've fooled with this, but I'd tell them to send it to a lab for 800-1200 bucks for a 75% to 85% retrieval rate.

send them on down the street and get to working on other stuff....

+ 1.... Its basically lost! They can accept it or pay alot for wishful thinking its going to come back.

I do like CardRecovery ; it is very powerful .

Doesnt matter how powerful. Using a card over and over say goodbye to deleted data. Card recovery is really for resurrecting a card that needs formatting for a corrupt file system. I cant say its exactly for data recovery purposes.

 

[Xander]

Despite what TV tries to tell the public, once a bit turns from 1 to 0 or 0 to 1, there is no second piece of information ('ghost bit') that saves what it was just before. Sure, if a drive/file has not been wiped or only partially overwritten, you might be able to scrape together some of the data based on what was left alone but....

 

[coco3_man]

...
What are my options? I thought data always remained on the storage device no matter how many times it's deleted?...

After formatting 8 times and taking pictures, anything that could be recovered is long gone (about 7 formats ago actually).

As others have said, don't spend any more time on it. Data recovery companies would tell them the same thing.

Tom

 

[+++MadMatt+++]

Thanks for all your input, you have answered my question really well. I will break the bad news to him, the storage I'm talking about is compact flash + sd cards from a digital camera, he formatted them about 8 times, so I had a feeling that it would be very difficult to recover them after that many wipes.

I will now have a look to see if they are recoverable from his computer hard drive, as he says that he downloaded them to his computer, then lost them. So hopefully they are there somewhere...

Thanks to you all once again, incredibly quick response!

 

[ZenTree]

Photorec is the best one i've come across.

If he did a quick format it might actually stand a chance, if he's used the card inbetween formats your screwed. I don't see why applying the same quick format to the same sectors would be any different from doing it once. It's not like we're trying to detect "magnetic residue" of previous writes, just reading sectors.

 

[atlanticjim]

What is formatting anyway?

Just for some clarification here.

Simply formatting a card (or any device for that matter) only deletes the index data. All the data will remain but any device using the media will be instructed that all portions of the media are available for use. It is like getting a file full of files and being told that you can use it, just throw out any files as you go along, to make room for new ones. Therefore if a card is formatted 8 or 80 times the data will still remain, it is only when a device uses the media to store new data that the old data will be overwritten.

This is why there are data wiping utilities. These utilities will write to every part of the media and therefore overwrite that data that is there preventing recovery.

There is no "ghost" data left on media. Many years ago when hard drives were first developed the head alignment was not as precise as it is now. There was theory and a little bit of research that found that sometimes when writing data to a disk, if the head was not aligned the same way as the last pass over that area, there would be remnant data left at the edge of the pass that could be recovered. This is old theory and new (last 20 years) hard drives have precision that would make that process impossible.

When you have some time it is interesting to read about data recovery.

For our purposes, any of the recovery software works the same way. It retrieves the data that is still on the media but has been "un-addressed" and tries to interpret it as a valid file type with complete data. Recently I had someone with a complete (physical) hard drive failure and loss of all their data, mostly family photos. I immediately called them and told them to give me all the cards from all the cameras. I was able to retrieve only 150 photos but I could see that there were about 200 more on the cards with incomplete data and therefore were not retrievable. Forensic level data recovery programs may have been able to partially reconstruct those photos. The most widely used is EnCase Forensic (only $9,995 USD . . yes, ten thousand dollars).

 

[AlexSno]

The moment you wrote something on it all the information is deleted.

 

[+++MadMatt+++]

I have learnt alot today about this subject, it's nice to get some clarification on the matter. It has been bugging me for some time, and it now all makes sense. Thanks for all the replies, and thanks atlanticjim, that was very interesting, all makes sense now.

 

[coco3_man]

The moment you wrote something on it all the information is deleted.

Not quite everything...whatever had not been overwritten yet would still be recoverable.

I recovered a major portion of someones honeymoon pictures (170 pictures actually) after he formatted it and took 30 more pictures.

I was able to recover pictures from the area that had not been overwritten yet.

In the case first put forth in this thread, there is an assumption that the card was formatted, pictures taken, then formatted again, pictures taken, etc. Assuming the user did not format it 8 times back to back then want the data back.

 

[uprighttech]

+1 for PhotoRec...It has worked well for us in several scenarios. We have also had good luck with Stellar Phoenix, though it is not free. However, in your case, it doesn't sound like any tool is going to be able to do much for you.