SD card undelete

"Apd" wrote

| The FAT isn't intact when the file is deleted - the cluster chain for
| that file is zeroed. All you have is the first cluster number in the
| old directory entry.

OK. Thanks. That makes sense. Maybe that explains why
the recovery programs are so slow. Perhaps they're walking
the data looking for recognizable file formats to retrieve?

Since EaseUS was able to retrieve nearly all images, should
I then assume the camera is writing contiguous clusters on
the FAT32 card, overwriting as needed? Otherwise wouldn't
it be virtually impossible to match up disparate image clusters?

That might explain why only EaseUS succeeded. It would
imply the need to search for file "magic" bytes and inspect
the following bytes/headers to figure out the exact bytes of
each file. It might also explain why Minitool thought it had
retrieved all files when it hadn't. It may have been finding only
one cluster. Unfortunately I deleted those already. It would
have been interesting to see whether they were cluster-size
(4KB?) files and what they contained. The other two programs,
Recuva and Kickass found everything corrupt. Kickass was able
to find all file names but only found 3 retrievable. It though the
recent files had been overwritten by older files.

| Unless it offers you a manual method,

I understand. EaseUS used no manual method. Maybe it
is worth $70.

On Mon, 28 May 2018 09:41:15 -0400, "Mayayana"
wrote:

But it's good to know. On the other hand, it seems like
there are two likely conclusions: Only EaseUS works really
well, or EaseUS corrupted the data so that I'd have to
buy the product in order to get the images. The second
possibility seems farfetched. It's hard to imagine them
getting away with that. (Though I didn't check the EULA
to see whether it says,"By using this product you agree
that we will hold your data hostage and ruin your disks."
....So who knows?)

I don't really get why you and Shadow both talk about
backing up a byte-by-byte image. I suppose that never
hurts, but I was really just interested in something that
can retrieve deleted files. Either they can be accessed or
they can't.

Read your first paragraph. If a software does junk/ransom-lock
the SD, you have an image to restore.
Some people try to recover the files onto the SD card, which
of course overwrites any data present. If you have an image, just
restore it and start over.
Or that SD card might be failing. Restore the image to a good
SD card.
When you are done, delete the image. It's usually only 1-8
GB. Well, most of my SD cards are, anyway.
The application I mentioned is tiny, portable and free, and
works on XP and up .... as close to a "free lunch" as you can get.

I image ANY drive, even a HD, before I start working on it.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012

"Shadow" wrote

| Or that SD card might be failing. Restore the image to a good
| SD card.
| When you are done, delete the image. It's usually only 1-8
| GB. Well, most of my SD cards are, anyway.
| The application I mentioned is tiny, portable and free, and
| works on XP and up .... as close to a "free lunch" as you can get.

I see. Thanks. Originally I thought you were
talking about doing forensics on the image.

"Mayayana" wrote:
"Apd" wrote

| The FAT isn't intact when the file is deleted - the cluster chain for
| that file is zeroed. All you have is the first cluster number in the
| old directory entry.

OK. Thanks. That makes sense. Maybe that explains why
the recovery programs are so slow. Perhaps they're walking
the data looking for recognizable file formats to retrieve?

I doubt it. The first cluster might tell you if, for example, it's a
PDF, PNG or JPEG but there's no sure way to tell if subsequent
clusters are part of the file.

Since EaseUS was able to retrieve nearly all images, should
I then assume the camera is writing contiguous clusters on
the FAT32 card,

It might well write contiguous clusters but EaseUS wouldn't know that.
All it can do is blindly pick the next available cluster unless
there's a way to tell it to do otherwise.

overwriting as needed?

It wouldn't overwrite clusters in the way that were allocated but
the camera might first look for space big enough to avoid a fragmented
file if possible. I don't know.

Otherwise wouldn't
it be virtually impossible to match up disparate image clusters?

Yes. Whatever FAT recovery programs tell you there's no foolproof way
to recover deleted files. You get lucky or you don't.

That might explain why only EaseUS succeeded. It would
imply the need to search for file "magic" bytes and inspect
the following bytes/headers to figure out the exact bytes of
each file.

The magic bytes would be in the first cluster but it's not possible
for certain to determine the remaining bytes. It would also have to
know about a lot of file formats for little gain.

It might also explain why Minitool thought it had
retrieved all files when it hadn't. It may have been finding only
one cluster.

Then it's useless.

Unfortunately I deleted those already. It would
have been interesting to see whether they were cluster-size
(4KB?) files and what they contained. The other two programs,
Recuva and Kickass found everything corrupt. Kickass was able
to find all file names but only found 3 retrievable. It though the
recent files had been overwritten by older files.

They may be erring on the safe side and refusing to recover files with
more than one cluster. There's also the possibility of multiple
deleted directory entries for the same file or incorrectly altered
directory entries if a utility tried to recover files in-place and
only got one cluster and did not truncate the file size (hence
corruption).

| Unless it offers you a manual method,

I understand. EaseUS used no manual method. Maybe it
is worth $70.

It sounds like EaseUS is being optimistic and assuming files were
contiguous or if it found allocated clusters in the way, just skipped
past them to the next free cluster. If your files were not fragmented
then it will have done a good job. I suggest you check some (most) of
them for possible corruption.

If file undelete programs don't explain the difficulty of recovering
files from FAT systems and give you options to inspect what they are
doing to allow manual intervention then I wouldn't trust them.

Mayayana wrote:
"Shadow" wrote

| Or that SD card might be failing. Restore the image to a good
| SD card.
| When you are done, delete the image. It's usually only 1-8
| GB. Well, most of my SD cards are, anyway.
| The application I mentioned is tiny, portable and free, and
| works on XP and up .... as close to a "free lunch" as you can get.

I see. Thanks. Originally I thought you were
talking about doing forensics on the image.

You image devices, to protect yourself from your own
mistakes, just as much as anything else :-)

For example, I ran a CHKDSK once that trashed something.

Now, that's a good time to have that backup, right ?

And the image in the case of an "undelete" run, must
be sector-by-sector, because that's where your
borked files live. A Macrium "Smart Copy" image
is useless at a time like that. If you're on an
"undelete" mission, the "dd.exe" is your friend,
as it for certain, does sector-by-sector imaging.
I only discovered by testing, that the Macrium
"dumb" copy option, was completing much too quickly,
and it wasn't actually copying all the sectors.
I can trust "dd.exe" to not screw this up.

http://www.chrysocome.net/dd

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

I haven't tested this yet, but if you want to convert
the .img that effectively comes out of that "dd" run
to a VHD for a virtual machine, you can use this. It's
supposed to be able to convert a raw .img to VHD. And
you'd only use a VHD, if for some reason the long
scrub time of Easeus was driving you nuts. You can
"attach" a VHD in the modern versions of Windows, via
a Disk Management menu. For example, I would keep my
VHD on the RAMdisk, for speed reasons (I use this idea
a lot, on the new machine with the excess of RAM). The
RAMdisk/VHD idea hopefully being faster than an SD chip :-)

https://www.starwindsoftware.com/dat...ease-Notes.pdf

http://www.softpedia.com/get/System/...onverter.shtml

And for people who own newer hardware than I do,
you don't have to fork out megabucks for RAM, when
an NVMe disk is just as fast as my RAMdisk. The
one difference is, my RAMdisk never wears out, and
that's the main advantage of it today.

I can find other reports of Easeus being slow at
this process, so your report is not the only one.

Paul

Thanks for everyone's help with this. The final results
have been very satisfying. And free. Using Shadow's
link, I downloaded ImageUSB.

https://www.osforensics.com/tools/write-usb-images.html

That produced a BIN file that's accessible through 7-ZIP.
7-ZIP doesn't see deleted files, but does see non-deleted
content from the SD card. So the success of making an image
was confirmed.

Then I found this:

https://www.cgsecurity.org/wiki/TestDisk_Download

Free, OSS, PhotoRec. Just download the package,
extract and run QPhotoRec.exe. That program found
all the deleted files. It actually found every file that
was coherent. 984 in all, including a large number of
thumbnails. Unfortunately, unlike EaseUS, it didn't
retrieve original file names. Then again, those are just
numbers, anyway. It did retrieve file dates. And so far
I haven't found any corrupt images.

PhotoRec runs on just about anything and retrieves
data from just about anything. A very nice piece of
software. So none of the expensive paid options are
necessary.

The program description is he

https://www.cgsecurity.org/wiki/PhotoRec

The author explains that it works by looking for
specific file markers and then tracking the remainder
of each file. I was able to select file types I was
looking for so I just selected JPG. That saved a
lot of time compared to EaseUS.

Once again, the info online from information sites
and software review sites never mentioned what
turned out to be the best software. That happens
to me so often. It seems that usually, people don't
know about the best software. It's not written by
an insider, or the GUI is a bit funky, or the functionality
is less polished than the commercial versions, so no
one pays attention to it. As a result, it never gets into
the "word of mouth stream".

"Mayayana" wrote:

https://www.cgsecurity.org/wiki/TestDisk_Download

[...]

https://www.cgsecurity.org/wiki/PhotoRec

The author explains that it works by looking for
specific file markers and then tracking the remainder
of each file.

I think I'm impressed. I'll have to take back what I said about
knowing a lot of file formats for little gain. Looking briefly at the
code for parsing Jpegs, it does appear to take account of the markers
and blocks so it can calculate how big the file should be. However, I
can't see how it would calculate a size for say a plain text file.
The file dates could have been retrieved from EXIF metadata.

Testdisk has a file undelete option which does look at the deleted
directory entry, so you may have got the original names using that.

This all relies on the files not being (too) fragmented which yours
must not have been. I don't think Testdisk could handle a fragmented
file at all but they don't say anything about it in the docs. I'm
disappointed by that.

Anyway, it's good you got the files back.

On Mon, 28 May 2018 15:27:11 -0400, "Mayayana"
wrote:

Thanks for everyone's help with this. The final results
have been very satisfying. And free. Using Shadow's
link, I downloaded ImageUSB.

https://www.osforensics.com/tools/write-usb-images.html

That produced a BIN file that's accessible through 7-ZIP.
7-ZIP doesn't see deleted files, but does see non-deleted
content from the SD card. So the success of making an image
was confirmed.

Then I found this:

https://www.cgsecurity.org/wiki/TestDisk_Download

Free, OSS, PhotoRec. Just download the package,
extract and run QPhotoRec.exe. That program found
all the deleted files. It actually found every file that
was coherent. 984 in all, including a large number of
thumbnails. Unfortunately, unlike EaseUS, it didn't
retrieve original file names. Then again, those are just
numbers, anyway. It did retrieve file dates. And so far
I haven't found any corrupt images.

PhotoRec runs on just about anything and retrieves
data from just about anything. A very nice piece of
software. So none of the expensive paid options are
necessary.

The program description is he

https://www.cgsecurity.org/wiki/PhotoRec

The author explains that it works by looking for
specific file markers and then tracking the remainder
of each file. I was able to select file types I was
looking for so I just selected JPG. That saved a
lot of time compared to EaseUS.

Once again, the info online from information sites
and software review sites never mentioned what
turned out to be the best software. That happens
to me so often. It seems that usually, people don't
know about the best software. It's not written by
an insider, or the GUI is a bit funky, or the functionality
is less polished than the commercial versions, so no
one pays attention to it. As a result, it never gets into
the "word of mouth stream".

Thanks for posting. I put PhotoRec in my utils.
Glad to hear you got your photos back.

Back to Paul's comments, if it was a 64 or 128 GB drive, I'd
probably make an image, try to mount the image and work on that. It
would be much, much faster to scan a read-only image mounted in RAM
than the actual SD.
Note ImageUSB adds a header to the image, while PassMark's
software does not, so if I was to work with images, I'd probably
choose the latter. Or "dd".
But a small SD drive (the only ones I've had to recover stuff
from so far) probably doesn't "deserve" the effort, I just image a
backup and work on the actual, physical drive.
[]'s

PS Slightly OT I've never liked EaseUS. Not since they offered
a giveaway and when I tried to register offline*** with the serial
they gave me, it wouldn't register --- directed me to a page where I
had to fill in a LOT of personal info.

The "faux" giveaway:

https://forum.raymond.cc/threads/201...alendar.42636/

**** to register offline you go to this page and enter the
"machine code" for the offline computer. The page produces another
serial number.

http://activation.easeus.com/offline.php

Which always came up as "invalid" on the offline computer. I
tried registering well within the giveaway's timeframe.
--
Don't be evil - Google 2004
We have a new policy - Google 2012

"Shadow" wrote

| PS Slightly OT I've never liked EaseUS. Not since they offered
| a giveaway and when I tried to register offline*** with the serial
| they gave me, it wouldn't register --- directed me to a page where I
| had to fill in a LOT of personal info.
|

I got that ense with them. Their product is very expensive.
The "free" version turned out to only be a demo. (It used
to be that trialware was marked as such.) And the program
tried hard to get through my firewall, without asking me,
before it finally stopped the funny business and did its job.

So it was sleazy at every step.