Discussion:
SD card undelete
Add Reply
Mayayana
2018-05-27 18:07:32 UTC
Reply
Permalink
Raw Message
Any ideas about this? I've downloaded Kickass,
which is OSS. Right now I'm on my 3rd attempt
to try a free commercial product. I'm currently
trying Recuva.

So far I've tried EaseUS and Minitool. Both were
"free". Neither spoke of limitations anywhere I
could find. Both found deleted files. But then
they announced I could only retrieve 500 MB or
1 GB, respectively, with the "free" version.
Buy Now! Buy Now! They're actually both just
trialware posing as free. (And not cheap!)

These things have become so oily that it's
impossible to figure out what's actually free
without wasting a lot of time. Surely there must
be a known, best-of, free product for recovering
deleted file?
dadiOH
2018-05-27 18:37:24 UTC
Reply
Permalink
Raw Message
Post by Mayayana
Any ideas about this? I've downloaded Kickass,
which is OSS. Right now I'm on my 3rd attempt
to try a free commercial product. I'm currently
trying Recuva.
So far I've tried EaseUS and Minitool. Both were
"free". Neither spoke of limitations anywhere I
could find. Both found deleted files. But then
they announced I could only retrieve 500 MB or
1 GB, respectively, with the "free" version.
Buy Now! Buy Now! They're actually both just
trialware posing as free. (And not cheap!)
These things have become so oily that it's
impossible to figure out what's actually free
without wasting a lot of time. Surely there must
be a known, best-of, free product for recovering
deleted file?
Well, EaseUS has one. Not free but they offer money back if it doesn't
recover. They couldn't, they did but only after massive amounts of kicking
and screaming.
Fokke Nauta
2018-05-27 19:02:27 UTC
Reply
Permalink
Raw Message
Post by dadiOH
Post by Mayayana
Any ideas about this? I've downloaded Kickass,
which is OSS. Right now I'm on my 3rd attempt
to try a free commercial product. I'm currently
trying Recuva.
So far I've tried EaseUS and Minitool. Both were
"free". Neither spoke of limitations anywhere I
could find. Both found deleted files. But then
they announced I could only retrieve 500 MB or
1 GB, respectively, with the "free" version.
Buy Now! Buy Now! They're actually both just
trialware posing as free. (And not cheap!)
These things have become so oily that it's
impossible to figure out what's actually free
without wasting a lot of time. Surely there must
be a known, best-of, free product for recovering
deleted file?
Well, EaseUS has one. Not free but they offer money back if it doesn't
recover. They couldn't, they did but only after massive amounts of kicking
and screaming.
I use the EasUS one. No problems, works allways.
And - if you want something good, you'll have to pay for it.

Fokke
Shadow
2018-05-27 19:04:34 UTC
Reply
Permalink
Raw Message
On Sun, 27 May 2018 14:07:32 -0400, "Mayayana"
Post by Mayayana
Any ideas about this? I've downloaded Kickass,
which is OSS. Right now I'm on my 3rd attempt
to try a free commercial product. I'm currently
trying Recuva.
So far I've tried EaseUS and Minitool. Both were
"free". Neither spoke of limitations anywhere I
could find. Both found deleted files. But then
they announced I could only retrieve 500 MB or
1 GB, respectively, with the "free" version.
Buy Now! Buy Now! They're actually both just
trialware posing as free. (And not cheap!)
These things have become so oily that it's
impossible to figure out what's actually free
without wasting a lot of time. Surely there must
be a known, best-of, free product for recovering
deleted file?
First make a backup of that SD card.

USB Imagetool

http://www.uwe-sieber.de/usbtreeview_e.html#download

(needs uggh .NET)

or PassMark's offering

https://www.osforensics.com/tools/write-usb-images.html

(you can always do a hex search of the image if the card goes
plonk)

Both are free.

Then (and only then) try Recuva.
Good luck.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012
Mayayana
2018-05-27 20:30:29 UTC
Reply
Permalink
Raw Message
"Mayayana" <***@invalid.nospam> wrote

......
Interesting results here. EaseUS sess all the files,
takes a ridiculous amount of time, but will recover
up to 500 MB.

Con: $70 to do more. YThat seems absurd for a
FAT32 analyzer. There must be something else free
that can do the same thing.

Recuva, Minitool and Kickass all found olny corrupt
files. Minitool claimed to save out 1 GB worth but
they were all nonsense.

So I'm still looking for a highly competent, free
undelete. I don't mind paying for important software,
but recovering deleted files shouldn't be so expensive
and I can't believe that someone hasn't created a
free version. On the bright side, I have an SD card to
experiment with. Anything that can find all those
photos for free wins the contest. :)
Shadow
2018-05-27 21:39:22 UTC
Reply
Permalink
Raw Message
On Sun, 27 May 2018 16:30:29 -0400, "Mayayana"
Post by Mayayana
......
Interesting results here. EaseUS sess all the files,
takes a ridiculous amount of time, but will recover
up to 500 MB.
Con: $70 to do more. YThat seems absurd for a
FAT32 analyzer. There must be something else free
that can do the same thing.
Recuva, Minitool and Kickass all found olny corrupt
files. Minitool claimed to save out 1 GB worth but
they were all nonsense.
So I'm still looking for a highly competent, free
undelete. I don't mind paying for important software,
but recovering deleted files shouldn't be so expensive
and I can't believe that someone hasn't created a
free version. On the bright side, I have an SD card to
experiment with. Anything that can find all those
photos for free wins the contest. :)
If you made an image of the card you can try all sorts of
software, and if they mess up just burn the image back to the SD. Both
image softwares I mentioned copy ALL the sectors, even the gibberish
ones.
If you just deleted, I can't understand why Recuva didn't
work. It's never failed me. OTOH, if you deleted and then took more
pictures, the original ones are probably overwritten and unreadable.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012
Mayayana
2018-05-28 02:50:45 UTC
Reply
Permalink
Raw Message
"Shadow" <***@dow.br> wrote

| If you just deleted, I can't understand why Recuva didn't
| work. It's never failed me. OTOH, if you deleted and then took more
| pictures, the original ones are probably overwritten and unreadable.

They were only deleted. I don't understand that
myself. The only thing I could think was that maybe
EaseUS somehow affected the layout so that other
software got confused. But I don't see any reason
it might do that.

The images were just copied, then deleted, then
the card wasn't used again.
Paul
2018-05-28 02:56:34 UTC
Reply
Permalink
Raw Message
Post by Mayayana
| If you just deleted, I can't understand why Recuva didn't
| work. It's never failed me. OTOH, if you deleted and then took more
| pictures, the original ones are probably overwritten and unreadable.
They were only deleted. I don't understand that
myself. The only thing I could think was that maybe
EaseUS somehow affected the layout so that other
software got confused. But I don't see any reason
it might do that.
The images were just copied, then deleted, then
the card wasn't used again.
This is why I like to make sector-by-sector copies
of stuff needing repair, if I can.

This might be able to convert a "dd" copy to
another more usable format. This tool is packed with something
so I'd need WINE to take it apart for a look. Really,
this is the sort of thing that should be command-line.

http://www.softpedia.com/get/System/File-Management/StarWind-Software-V2V-Image-Converter.shtml

Paul
Paul
2018-05-28 05:02:01 UTC
Reply
Permalink
Raw Message
Post by Mayayana
| If you just deleted, I can't understand why Recuva didn't
| work. It's never failed me. OTOH, if you deleted and then took more
| pictures, the original ones are probably overwritten and unreadable.
They were only deleted. I don't understand that
myself. The only thing I could think was that maybe
EaseUS somehow affected the layout so that other
software got confused. But I don't see any reason
it might do that.
The images were just copied, then deleted, then
the card wasn't used again.
https://download.cnet.com/EaseUS-Data-Recovery-Wizard-Free/3000-2248_4-75184619.html

"This software doesn't work. It will "recover" your file
(but only the file name) and corrupt it beyond repair.
You'll never get it open, even if you use other software
to recover raw deleted data to piece it back together."

So at least one reviewer there, seems to feel it has side effects.

Normally, for data recovery, the source volume would be treated
read-only.

It would require some testing with a clean setup, to see
what it had done to the file it was working on.

Paul
Mayayana
2018-05-28 13:41:15 UTC
Reply
Permalink
Raw Message
"Paul" <***@needed.invalid> wrote

|
|
https://download.cnet.com/EaseUS-Data-Recovery-Wizard-Free/3000-2248_4-75184619.html
|
| "This software doesn't work. It will "recover" your file
| (but only the file name) and corrupt it beyond repair.
| You'll never get it open, even if you use other software
| to recover raw deleted data to piece it back together."
|
| So at least one reviewer there, seems to feel it has side effects.
|

I take those things with a grain of salt. Like someone
who's never boiled water reviewing a special frying pan:
"Junk! It burns everything!"

EaseUS did find all the images and easily retrieved the
recent ones.... within the demo limitations.

But it's good to know. On the other hand, it seems like
there are two likely conclusions: Only EaseUS works really
well, or EaseUS corrupted the data so that I'd have to
buy the product in order to get the images. The second
possibility seems farfetched. It's hard to imagine them
getting away with that. (Though I didn't check the EULA
to see whether it says,"By using this product you agree
that we will hold your data hostage and ruin your disks."
....So who knows?)

I don't really get why you and Shadow both talk about
backing up a byte-by-byte image. I suppose that never
hurts, but I was really just interested in something that
can retrieve deleted files. Either they can be accessed or
they can't.

I'm still hoping to find the ultimate, super-duper, OSS
option to test that on the SD card before using it again.
I'm finding it hard to believe that such basic operations
as retrieving deleted files can only be done by one
$70 program.

| Normally, for data recovery, the source volume would be treated
| read-only.
|
| It would require some testing with a clean setup, to see
| what it had done to the file it was working on.
|

That would be beyond my expertise or curiosity.
There's not enough longterm usefulness for me
to buckle down and start learning how to analyze
storage bytes and master FAT32 formatting. But
if you do it, please let us know. :)
Shadow
2018-05-28 14:37:58 UTC
Reply
Permalink
Raw Message
On Mon, 28 May 2018 09:41:15 -0400, "Mayayana"
Post by Mayayana
But it's good to know. On the other hand, it seems like
there are two likely conclusions: Only EaseUS works really
well, or EaseUS corrupted the data so that I'd have to
buy the product in order to get the images. The second
possibility seems farfetched. It's hard to imagine them
getting away with that. (Though I didn't check the EULA
to see whether it says,"By using this product you agree
that we will hold your data hostage and ruin your disks."
....So who knows?)
I don't really get why you and Shadow both talk about
backing up a byte-by-byte image. I suppose that never
hurts, but I was really just interested in something that
can retrieve deleted files. Either they can be accessed or
they can't.
Read your first paragraph. If a software does junk/ransom-lock
the SD, you have an image to restore.
Some people try to recover the files onto the SD card, which
of course overwrites any data present. If you have an image, just
restore it and start over.
Or that SD card might be failing. Restore the image to a good
SD card.
When you are done, delete the image. It's usually only 1->8
GB. Well, most of my SD cards are, anyway.
The application I mentioned is tiny, portable and free, and
works on XP and up .... as close to a "free lunch" as you can get.
;)
I image ANY drive, even a HD, before I start working on it.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012
Mayayana
2018-05-28 14:55:19 UTC
Reply
Permalink
Raw Message
"Shadow" <***@dow.br> wrote

| Or that SD card might be failing. Restore the image to a good
| SD card.
| When you are done, delete the image. It's usually only 1->8
| GB. Well, most of my SD cards are, anyway.
| The application I mentioned is tiny, portable and free, and
| works on XP and up .... as close to a "free lunch" as you can get.

I see. Thanks. Originally I thought you were
talking about doing forensics on the image.
Paul
2018-05-28 16:43:47 UTC
Reply
Permalink
Raw Message
Post by Mayayana
| Or that SD card might be failing. Restore the image to a good
| SD card.
| When you are done, delete the image. It's usually only 1->8
| GB. Well, most of my SD cards are, anyway.
| The application I mentioned is tiny, portable and free, and
| works on XP and up .... as close to a "free lunch" as you can get.
I see. Thanks. Originally I thought you were
talking about doing forensics on the image.
You image devices, to protect yourself from your own
mistakes, just as much as anything else :-)

For example, I ran a CHKDSK once that trashed something.

Now, that's a good time to have that backup, right ?

And the image in the case of an "undelete" run, must
be sector-by-sector, because that's where your
borked files live. A Macrium "Smart Copy" image
is useless at a time like that. If you're on an
"undelete" mission, the "dd.exe" is your friend,
as it for certain, does sector-by-sector imaging.
I only discovered by testing, that the Macrium
"dumb" copy option, was completing much too quickly,
and it wasn't actually copying all the sectors.
I can trust "dd.exe" to not screw this up.

http://www.chrysocome.net/dd

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

I haven't tested this yet, but if you want to convert
the .img that effectively comes out of that "dd" run
to a VHD for a virtual machine, you can use this. It's
supposed to be able to convert a raw .img to VHD. And
you'd only use a VHD, if for some reason the long
scrub time of Easeus was driving you nuts. You can
"attach" a VHD in the modern versions of Windows, via
a Disk Management menu. For example, I would keep my
VHD on the RAMdisk, for speed reasons (I use this idea
a lot, on the new machine with the excess of RAM). The
RAMdisk/VHD idea hopefully being faster than an SD chip :-)

https://www.starwindsoftware.com/datasheets/V2V-Converter-Release-Notes.pdf

http://www.softpedia.com/get/System/File-Management/StarWind-Software-V2V-Image-Converter.shtml

And for people who own newer hardware than I do,
you don't have to fork out megabucks for RAM, when
an NVMe disk is just as fast as my RAMdisk. The
one difference is, my RAMdisk never wears out, and
that's the main advantage of it today.

I can find other reports of Easeus being slow at
this process, so your report is not the only one.

Paul
Paul
2018-05-27 21:45:01 UTC
Reply
Permalink
Raw Message
Post by Mayayana
......
Interesting results here. EaseUS sess all the files,
takes a ridiculous amount of time, but will recover
up to 500 MB.
Con: $70 to do more. YThat seems absurd for a
FAT32 analyzer. There must be something else free
that can do the same thing.
Recuva, Minitool and Kickass all found olny corrupt
files. Minitool claimed to save out 1 GB worth but
they were all nonsense.
So I'm still looking for a highly competent, free
undelete. I don't mind paying for important software,
but recovering deleted files shouldn't be so expensive
and I can't believe that someone hasn't created a
free version. On the bright side, I have an SD card to
experiment with. Anything that can find all those
photos for free wins the contest. :)
The claim here, is it works on FAT.
No mention of NTFS ?

https://en.wikipedia.org/wiki/Undeletion

I tried this one in a simple test, and it
worked. But the test case was carefully controlled
or contrived, so it couldn't help but get the right
result :-)

https://www.cgsecurity.org/wiki/PhotoRec

(Doesn't rely on file system)

Here is another.

https://www.ccleaner.com/recuva

Seems to offer a free version.
No indication it springs they ole "$39.95 please" trick.

In the picture here, the "red" entries indicate cluster
overlap.

https://en.wikipedia.org/wiki/Recuva

Yes, you can flip the single byte that controls
deletion in a FAT entry, but if the cluster numbers
in that entry happen to overlap, that means a write
done after the deletion, has reused the clusters already.
Even if the FAT entry itself is still intact.

I had some other tool, which I can't find a reference to
now, that has text for each file, with words like "good"
indicating no cluster overlap and damage due to subsequent
write operations.

And this is where programs like Photorec take
over. They might not even rely on the FAT, instead
scanning for identifying information. But if the
files are fragmented, and don't fit a single cluster,
then you can't expect the files to make any sense.
The information inside a file, probably isn't sufficient
to reassemble all the pieces. Only a file format that
made some assumptions about storage could do that. Like
writing a GUID into every 4KB segment or something.
And I'm not aware of any file formats that do that.

So if Recuva showed "Red" for everything, or a text
listing of files indicates "Bad" or "overlap" or the
like, then probably too many writes have been done
to the partition, since the event.

If I was doing that here, I'd probably "image" the SD
to a file and work on the "image" rather than the SD
itself. As any scans might work faster. And getting that
to work, would be its own little project, since the
typical imaging situation only captures "visible" files
when imaging. If using Macrium, Smart Copy would have
to be turned off, and I've been let down by tools and
their "dumb copy" option before. If a dumb copy takes two hours
normally, and some tool does it in only ten minutes,
then you know the tool doesn't actually work properly.

Paul
Shadow
2018-05-28 11:44:37 UTC
Reply
Permalink
Raw Message
Post by Paul
If I was doing that here, I'd probably "image" the SD
to a file and work on the "image" rather than the SD
itself.
Why I recommended using PassMark's portable tool to make a
backup byte by byte image before trying anything else.

https://www.osforensics.com/tools/write-usb-images.html

You can write it back to the card (or another one if the first
one is failing) without messing up the original. I've never tried
mounting the image, but it should be possible.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012
Apd
2018-05-27 21:50:28 UTC
Reply
Permalink
Raw Message
Post by Mayayana
Interesting results here. EaseUS sess all the files,
takes a ridiculous amount of time, but will recover
up to 500 MB.
Con: $70 to do more. YThat seems absurd for a
FAT32 analyzer. There must be something else free
that can do the same thing.
If the files were deleted normally the chain of pointers to clusters
in the file allocation table will have been zeroed and all you will
have is the erased directory entry which contains the first cluster
number of the file. So, providing the drive has not been subsequently
written to, you can only be sure of recovering the contents of the
first cluster of each file. If file_size <= cluster_size then you can
recover the whole file. Otherwise, if the file was fragmented (not
stored in contiguous clusters) you won't be able to recover the pieces
automatically.
Post by Mayayana
Recuva, Minitool and Kickass all found olny corrupt
files. Minitool claimed to save out 1 GB worth but
they were all nonsense.
As you can see, there's no guarantee you will get them back.
I do know that Win 2000 corrupted one of the bits (or bytes) of the
first cluster number in the deleted directory entry so that made it
more tricky. I don't know if later OS's corrected this.
Post by Mayayana
So I'm still looking for a highly competent, free
undelete. I don't mind paying for important software,
but recovering deleted files shouldn't be so expensive
and I can't believe that someone hasn't created a
free version. On the bright side, I have an SD card to
experiment with. Anything that can find all those
photos for free wins the contest. :)
In the old days I used Norton Utilities 4.5 to recover a
whole FAT 16 hard disk (probably about 20 MB) manually.
It had recently been defragmented so I succeeded but it took
ages because I checked that every recovered file was valid.
Mayayana
2018-05-28 02:56:04 UTC
Reply
Permalink
Raw Message
"Apd" <***@all.invalid> wrote

| If the files were deleted normally the chain of pointers to clusters
| in the file allocation table will have been zeroed and all you will
| have is the erased directory entry which contains the first cluster
| number of the file. So, providing the drive has not been subsequently
| written to, you can only be sure of recovering the contents of the
| first cluster of each file.

Makes sense. Yet the files are mostly 5-6 MB, much
bigger than clusters. And EaseUS successfully recovered
all of the most recently saved files -- about 1 GB worth.
Yet none of the other programs did.

| In the old days I used Norton Utilities 4.5 to recover a
| whole FAT 16 hard disk (probably about 20 MB) manually.
| It had recently been defragmented so I succeeded but it took
| ages because I checked that every recovered file was valid.
|
That usually seems to work well. But isn't that
just a matter of finding the partition boundaries,
while the file allocation table is still intact?
Apd
2018-05-28 10:46:19 UTC
Reply
Permalink
Raw Message
Post by Mayayana
| In the old days I used Norton Utilities 4.5 to recover a
| whole FAT 16 hard disk (probably about 20 MB) manually.
| It had recently been defragmented so I succeeded but it took
| ages because I checked that every recovered file was valid.
|
That usually seems to work well. But isn't that
just a matter of finding the partition boundaries,
while the file allocation table is still intact?
The FAT isn't intact when the file is deleted - the cluster chain for
that file is zeroed. All you have is the first cluster number in the
old directory entry. Unless it offers you a manual method, all an
undelete utility can do is assume the file was not fragmented and keep
adding next available clusters (from its starting cluster) until the
size (also in the old dir entry) plus slack space is reached.

If you made a backup of the FAT before deleting and the utility is
able to make use of it then you have no problem. FAT 32 does keep a
second copy of the FAT but normal deletion will zero that also.

The Norton advanced recovery would step through each erased directory
entry allowing you to add clusters automatically or select them
yourself. In either case, before saving, you could inspect the
contents of each one and try alternatives if the file didn't look
right.
Mayayana
2018-05-28 13:53:15 UTC
Reply
Permalink
Raw Message
"Apd" <***@all.invalid> wrote

| The FAT isn't intact when the file is deleted - the cluster chain for
| that file is zeroed. All you have is the first cluster number in the
| old directory entry.

OK. Thanks. That makes sense. Maybe that explains why
the recovery programs are so slow. Perhaps they're walking
the data looking for recognizable file formats to retrieve?

Since EaseUS was able to retrieve nearly all images, should
I then assume the camera is writing contiguous clusters on
the FAT32 card, overwriting as needed? Otherwise wouldn't
it be virtually impossible to match up disparate image clusters?

That might explain why only EaseUS succeeded. It would
imply the need to search for file "magic" bytes and inspect
the following bytes/headers to figure out the exact bytes of
each file. It might also explain why Minitool thought it had
retrieved all files when it hadn't. It may have been finding only
one cluster. Unfortunately I deleted those already. It would
have been interesting to see whether they were cluster-size
(4KB?) files and what they contained. The other two programs,
Recuva and Kickass found everything corrupt. Kickass was able
to find all file names but only found 3 retrievable. It though the
recent files had been overwritten by older files.

| Unless it offers you a manual method,

I understand. EaseUS used no manual method. Maybe it
is worth $70.
Apd
2018-05-28 16:18:27 UTC
Reply
Permalink
Raw Message
Post by Mayayana
| The FAT isn't intact when the file is deleted - the cluster chain for
| that file is zeroed. All you have is the first cluster number in the
| old directory entry.
OK. Thanks. That makes sense. Maybe that explains why
the recovery programs are so slow. Perhaps they're walking
the data looking for recognizable file formats to retrieve?
I doubt it. The first cluster might tell you if, for example, it's a
PDF, PNG or JPEG but there's no sure way to tell if subsequent
clusters are part of the file.
Post by Mayayana
Since EaseUS was able to retrieve nearly all images, should
I then assume the camera is writing contiguous clusters on
the FAT32 card,
It might well write contiguous clusters but EaseUS wouldn't know that.
All it can do is blindly pick the next available cluster unless
there's a way to tell it to do otherwise.
Post by Mayayana
overwriting as needed?
It wouldn't overwrite clusters in the way that were allocated but
the camera might first look for space big enough to avoid a fragmented
file if possible. I don't know.
Post by Mayayana
Otherwise wouldn't
it be virtually impossible to match up disparate image clusters?
Yes. Whatever FAT recovery programs tell you there's no foolproof way
to recover deleted files. You get lucky or you don't.
Post by Mayayana
That might explain why only EaseUS succeeded. It would
imply the need to search for file "magic" bytes and inspect
the following bytes/headers to figure out the exact bytes of
each file.
The magic bytes would be in the first cluster but it's not possible
for certain to determine the remaining bytes. It would also have to
know about a lot of file formats for little gain.
Post by Mayayana
It might also explain why Minitool thought it had
retrieved all files when it hadn't. It may have been finding only
one cluster.
Then it's useless.
Post by Mayayana
Unfortunately I deleted those already. It would
have been interesting to see whether they were cluster-size
(4KB?) files and what they contained. The other two programs,
Recuva and Kickass found everything corrupt. Kickass was able
to find all file names but only found 3 retrievable. It though the
recent files had been overwritten by older files.
They may be erring on the safe side and refusing to recover files with
more than one cluster. There's also the possibility of multiple
deleted directory entries for the same file or incorrectly altered
directory entries if a utility tried to recover files in-place and
only got one cluster and did not truncate the file size (hence
corruption).
Post by Mayayana
| Unless it offers you a manual method,
I understand. EaseUS used no manual method. Maybe it
is worth $70.
It sounds like EaseUS is being optimistic and assuming files were
contiguous or if it found allocated clusters in the way, just skipped
past them to the next free cluster. If your files were not fragmented
then it will have done a good job. I suggest you check some (most) of
them for possible corruption.

If file undelete programs don't explain the difficulty of recovering
files from FAT systems and give you options to inspect what they are
doing to allow manual intervention then I wouldn't trust them.
Mayayana
2018-05-28 19:27:11 UTC
Reply
Permalink
Raw Message
Thanks for everyone's help with this. The final results
have been very satisfying. And free. Using Shadow's
link, I downloaded ImageUSB.

https://www.osforensics.com/tools/write-usb-images.html

That produced a BIN file that's accessible through 7-ZIP.
7-ZIP doesn't see deleted files, but does see non-deleted
content from the SD card. So the success of making an image
was confirmed.

Then I found this:

https://www.cgsecurity.org/wiki/TestDisk_Download

Free, OSS, PhotoRec. Just download the package,
extract and run QPhotoRec.exe. That program found
all the deleted files. It actually found every file that
was coherent. 984 in all, including a large number of
thumbnails. Unfortunately, unlike EaseUS, it didn't
retrieve original file names. Then again, those are just
numbers, anyway. It did retrieve file dates. And so far
I haven't found any corrupt images.

PhotoRec runs on just about anything and retrieves
data from just about anything. A very nice piece of
software. So none of the expensive paid options are
necessary.

The program description is here:

https://www.cgsecurity.org/wiki/PhotoRec

The author explains that it works by looking for
specific file markers and then tracking the remainder
of each file. I was able to select file types I was
looking for so I just selected JPG. That saved a
lot of time compared to EaseUS.

Once again, the info online from information sites
and software review sites never mentioned what
turned out to be the best software. That happens
to me so often. It seems that usually, people don't
know about the best software. It's not written by
an insider, or the GUI is a bit funky, or the functionality
is less polished than the commercial versions, so no
one pays attention to it. As a result, it never gets into
the "word of mouth stream".
Apd
2018-05-29 00:10:00 UTC
Reply
Permalink
Raw Message
Post by Mayayana
https://www.cgsecurity.org/wiki/TestDisk_Download
[...]
Post by Mayayana
https://www.cgsecurity.org/wiki/PhotoRec
The author explains that it works by looking for
specific file markers and then tracking the remainder
of each file.
I think I'm impressed. I'll have to take back what I said about
knowing a lot of file formats for little gain. Looking briefly at the
code for parsing Jpegs, it does appear to take account of the markers
and blocks so it can calculate how big the file should be. However, I
can't see how it would calculate a size for say a plain text file.
The file dates could have been retrieved from EXIF metadata.

Testdisk has a file undelete option which does look at the deleted
directory entry, so you may have got the original names using that.

This all relies on the files not being (too) fragmented which yours
must not have been. I don't think Testdisk could handle a fragmented
file at all but they don't say anything about it in the docs. I'm
disappointed by that.

Anyway, it's good you got the files back.
Shadow
2018-05-29 15:26:10 UTC
Reply
Permalink
Raw Message
On Mon, 28 May 2018 15:27:11 -0400, "Mayayana"
Post by Mayayana
Thanks for everyone's help with this. The final results
have been very satisfying. And free. Using Shadow's
link, I downloaded ImageUSB.
https://www.osforensics.com/tools/write-usb-images.html
That produced a BIN file that's accessible through 7-ZIP.
7-ZIP doesn't see deleted files, but does see non-deleted
content from the SD card. So the success of making an image
was confirmed.
https://www.cgsecurity.org/wiki/TestDisk_Download
Free, OSS, PhotoRec. Just download the package,
extract and run QPhotoRec.exe. That program found
all the deleted files. It actually found every file that
was coherent. 984 in all, including a large number of
thumbnails. Unfortunately, unlike EaseUS, it didn't
retrieve original file names. Then again, those are just
numbers, anyway. It did retrieve file dates. And so far
I haven't found any corrupt images.
PhotoRec runs on just about anything and retrieves
data from just about anything. A very nice piece of
software. So none of the expensive paid options are
necessary.
https://www.cgsecurity.org/wiki/PhotoRec
The author explains that it works by looking for
specific file markers and then tracking the remainder
of each file. I was able to select file types I was
looking for so I just selected JPG. That saved a
lot of time compared to EaseUS.
Once again, the info online from information sites
and software review sites never mentioned what
turned out to be the best software. That happens
to me so often. It seems that usually, people don't
know about the best software. It's not written by
an insider, or the GUI is a bit funky, or the functionality
is less polished than the commercial versions, so no
one pays attention to it. As a result, it never gets into
the "word of mouth stream".
Thanks for posting. I put PhotoRec in my utils.
Glad to hear you got your photos back.

Back to Paul's comments, if it was a 64 or 128 GB drive, I'd
probably make an image, try to mount the image and work on that. It
would be much, much faster to scan a read-only image mounted in RAM
than the actual SD.
Note ImageUSB adds a header to the image, while PassMark's
software does not, so if I was to work with images, I'd probably
choose the latter. Or "dd".
But a small SD drive (the only ones I've had to recover stuff
from so far) probably doesn't "deserve" the effort, I just image a
backup and work on the actual, physical drive.
[]'s

PS Slightly OT I've never liked EaseUS. Not since they offered
a giveaway and when I tried to register offline*** with the serial
they gave me, it wouldn't register --- directed me to a page where I
had to fill in a LOT of personal info.

The "faux" giveaway:

https://forum.raymond.cc/threads/2017-easeus-advent-calendar.42636/

**** to register offline you go to this page and enter the
"machine code" for the offline computer. The page produces another
serial number.

http://activation.easeus.com/offline.php

Which always came up as "invalid" on the offline computer. I
tried registering well within the giveaway's timeframe.
--
Don't be evil - Google 2004
We have a new policy - Google 2012
Mayayana
2018-05-29 19:01:05 UTC
Reply
Permalink
Raw Message
"Shadow" <***@dow.br> wrote

| PS Slightly OT I've never liked EaseUS. Not since they offered
| a giveaway and when I tried to register offline*** with the serial
| they gave me, it wouldn't register --- directed me to a page where I
| had to fill in a LOT of personal info.
|

I got that ense with them. Their product is very expensive.
The "free" version turned out to only be a demo. (It used
to be that trialware was marked as such.) And the program
tried hard to get through my firewall, without asking me,
before it finally stopped the funny business and did its job.

So it was sleazy at every step.

Loading...