1

I have confused SD cards and formatted the one with my data on it and taken 2 pictures with my camera until I noticed. I have never recovered an SD card before, so I am completely new to this topic. I have received a hint to use FTK toolkit but wasn't clear on how to read the images.

There are many other tools around.

Does someone have experience and could provide some recommendations what might probably work best? I have a windows 10 computer (preferred) and could also use a mac computer if there should be better software that requires mac.

I would really appreciate any useful hints that will help me to recover my data.

Best regards, M.

2
  • This is not really security-related, you might have better chances at the Superuser site. ... In any case, if you know someone knowing his way around Linux or other Unixoid systems, I'd recommend that a hundred times more than Win10.
    – deviantfan
    Jun 23, 2018 at 15:59
  • @deviantfan Forensic data recovery is arguably a part of information security.
    – forest
    Jun 23, 2018 at 20:22

4 Answers 4

1

If suggested answers result in corrupt and incomplete images try something like JPEG Recovery LAB. Incomplete and corrupt images are likely the result of file fragmentation. JPEG Recovery LAB reconstructs non contiguous files as well.

Can be found here: https://www.disktuna.com/jpeg-recovery-lab-digital-photo-recovery/

Good luck!

0

Sh*t happens ! I think the use of a forensic tool is a bit of an overkill.

You might want to try a file recovering tool like Recuva from CCleaner.

If that doesn't do the trick or you really want to go into some forensics, though, my favourite tool is DFF. Pretty straightforward to use and by default included in Kali :-) It seems it can be installed on Windows, but I would definitely recommend a Debian install.

0

Photorec will work best, and as good as anything at this specific scenario. It's normally a command line program, but it also has a GUI called QPhotoRec. It is downloadable with TestDisk. It's free and open source.

It will carve photo files with no problem and dump them into a destination directory. JPEG and other image files are relatively easy to identify by raw data so carvers can basically get everything that's there. It all depends on corruption or overwrite damage. Since you have only taken 2 photos since the problem, that will be minimal and you probably will only have lost 2-3 photos.

0

I was head of IT for a large photolab and we used a German program called " CONVAR's PC Inspector Smart Recovery" It's free at http://www.pcinspector.de/default.htm?language=1. It helped us recover virtually everything from any removable card. Now you should realize that formatting a card only erases the index and not the actual data. If you have then taken photos on the card, they may have overwritten data on the card and the original images will be gone. This program starts at the beginning of the card memory and recovers everything till the end of the card. If the card is fairly large, it will take a while to recover.

Not the answer you're looking for? Browse other questions tagged or ask your own question.