Reading erased flash memory

[PeterH2072]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible? The forensic computer services I've
contacted suggest it might be but they aren't sure. Other than trying to open
the package non destructively and possibly scan the chip with an ATF
microscope ...looking for residual charges, does anyone have a suggestion?
Thanks, Peter

 

[John Larkin]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible? The forensic computer services I've
contacted suggest it might be but they aren't sure. Other than trying to open
the package non destructively and possibly scan the chip with an ATF
microscope ...looking for residual charges, does anyone have a suggestion?
Thanks, Peter

If it's file structured, maybe only the directory has been erased. So
the data may still be there in cluster-sized blocks, which you could
read and try to put back in order somehow. If it's all erased, it's
gone.

John

 

[Spehro Pefhany]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible? The forensic computer services I've
contacted suggest it might be but they aren't sure. Other than trying to open
the package non destructively and possibly scan the chip with an ATF
microscope ...looking for residual charges, does anyone have a suggestion?
Thanks, Peter

If it's file structured, maybe only the directory has been erased. So
the data may still be there in cluster-sized blocks, which you could
read and try to put back in order somehow. If it's all erased, it's
gone.

John

Typically it's in FAT format on the card. Perhaps Norton Disk Doctor
might work on it. In DOS files are erased by just clearing the first
byte of the name to a null, IIRC, so provided you can supply that
character all the rest of the data may still be if (if it has not been
overwritten).

I recall getting files back once with a program called UE or unerase
or something like that.


Best regards,
Spehro Pefhany

 

[Mac]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible? The forensic computer services I've
contacted suggest it might be but they aren't sure. Other than trying to open
the package non destructively and possibly scan the chip with an ATF
microscope ...looking for residual charges, does anyone have a suggestion?
Thanks, Peter

If the files were erased by the operating system, there is hope. If the
flash memory was erased at the hardware level, you are on your own.

Anyway, before you do anything else with the "disk," you should be able to
copy it verbatim and work with the copy instead of the "disk" itself.

You could get one of those standalone live CD's for linux, and copy the
entire CF card using the unix command "dd."

Maybe something like this:

dd if=/dev/sd0 of=<name_of_output_file>

The resulting output file will be the same size as the disk capacity, and
will just be a sequential dump of every byte on the disk, in order.

Then if you want, you can take another CF card and use dd the other way:

dd if=<name_of_output_file> of=/dev/sd0

Do this very carefully, then put the card in a locked cabinet somewhere or
send it off to a professional data recovery place, or whatever.

Obviously this is not the forum to discuss this sort of thing, but I'm
sure you can find information about this on the WWW. The key term is
probably "computer forensics" or something like that.

Good Luck!

--Mac

 

[Mark Jones]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible? The forensic computer services I've
contacted suggest it might be but they aren't sure. Other than trying to open
the package non destructively and possibly scan the chip with an ATF
microscope ...looking for residual charges, does anyone have a suggestion?
Thanks, Peter

If it's file structured, maybe only the directory has been erased. So
the data may still be there in cluster-sized blocks, which you could
read and try to put back in order somehow. If it's all erased, it's
gone.

John

Typically it's in FAT format on the card. Perhaps Norton Disk Doctor
might work on it. In DOS files are erased by just clearing the first
byte of the name to a null, IIRC, so provided you can supply that
character all the rest of the data may still be if (if it has not been
overwritten).

I recall getting files back once with a program called UE or unerase
or something like that.


Best regards,
Spehro Pefhany

Indeed, the ATA specification is markedly similar for IDE and SD
devices. At least I think it is SD devices. Is it CF? Anyways, goto
www.t13.org and look under documents, you can find ATAPI-6 datasheets
for the ATA/SD protocols. (Older specs might be easier to read
actually, less clutter.)

-M

 

[James Beck]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible? The forensic computer services I've
contacted suggest it might be but they aren't sure. Other than trying to open
the package non destructively and possibly scan the chip with an ATF
microscope ...looking for residual charges, does anyone have a suggestion?
Thanks, Peter

If it's file structured, maybe only the directory has been erased. So
the data may still be there in cluster-sized blocks, which you could
read and try to put back in order somehow. If it's all erased, it's
gone.

John

Typically it's in FAT format on the card. Perhaps Norton Disk Doctor
might work on it. In DOS files are erased by just clearing the first
byte of the name to a null, IIRC, so provided you can supply that
character all the rest of the data may still be if (if it has not been
overwritten).

I recall getting files back once with a program called UE or unerase
or something like that.


Best regards,
Spehro Pefhany

I recovered one for a neighbor that wiped out his kids birthday party
that they had in Italy with the family. He was in a panic, reminded me
of Daffy Duck when he made the egg disappear. I used a program called
oo_unerase. Worked just fine.

Jim

 

[Spajky]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible?

http://www.active-undelete.com/

 

[[email protected]]

I have a SD flash memory card [256 meg] that's been accidentally erased. The
original data on the card is extremely important and needs to be recovered.
Does anyone know if this is possible? The forensic computer services I've
contacted suggest it might be but they aren't sure. Other than trying to open
the package non destructively and possibly scan the chip with an ATF

microscope ...looking for residual charges, does anyone have a suggestion?
Thanks, Peter

If the data are photos, this product works very well.
http://www.datarescue.com/photorescue/
I've had it for a couple years and it has bailed me out a couple of
times. Deleting files or even formatting in a camera will not overwrite
the data. I bought a used (thought it was new) CF card on eBay and
found a whole bunch of pictures from the previous owner.
GG

 

[Rich Grise]

[email protected] says...

On 09 Dec 2004 02:59:13 GMT, [email protected] (PeterH2072) wrote:

I have a SD flash memory card [256 meg] that's been accidentally erased. The ....
If it's file structured, maybe only the directory has been erased. So

....
Typically it's in FAT format on the card. Perhaps Norton Disk Doctor ....
I recall getting files back once with a program called UE or unerase

....
I recovered one for a neighbor that wiped out his kids birthday party
that they had in Italy with the family. He was in a panic, reminded me
of Daffy Duck when he made the egg disappear. I used a program called
oo_unerase. Worked just fine.

This ep?

Right under "Sport Chumpions":
http://www.wiseacre-gardens.com/buttons/wb.html#Sport Chumpions

WB340 THE HENPECKED DUCK
19410830, LOONEY TUNES
CHAR: DAFFY DUCK;MRS. DAFFY DUCK;PORKY PIG
DIR: ROBERT CLAMPETT
SYNOP: DAFFY & THE MRS GO TO DIVORCE COURT AFTER HIS MAGIC TRICK
MAKES THEIR EGG DISAPPEAR AND HE TRIES TO SUBSTITUTE A DOORKNOB

I can't say as I've ever seen that one.
Who in the heck is "Mrs. Duck?"

And I thought it was Sylvester who was famous for being "Dethpicable"

Thanks!
Rich

 

[K8JLF]

I've used a similar thing called photrecovery for digital media. I have it
installed on my machine right now. If I can find the installer, I'll be happy
to send it to you.

If the data are photos, this product works very well.
http://www.datarescue.com/photorescue/
I've had it for a couple years and it has bailed me out a couple of
times. Deleting files or even formatting in a camera will not overwrite
the data. I bought a used (thought it was new) CF card on eBay and
found a whole bunch of pictures from the previous owner.
GG

I've used a similar thing called photrecovery for digital media. I have it
installed on my machine right now. If I can find the installer, I'll be happy
to send it to you.

 

[James Beck]

[email protected] says...

59:13 GMT, [email protected] (PeterH2072) wrote:

I have a SD flash memory card [256 meg] that's been accidentally erased. The ...
If it's file structured, maybe only the directory has been erased. So ...
Typically it's in FAT format on the card. Perhaps Norton Disk Doctor ...
I recall getting files back once with a program called UE or unerase

...
I recovered one for a neighbor that wiped out his kids birthday party
that they had in Italy with the family. He was in a panic, reminded me
of Daffy Duck when he made the egg disappear. I used a program called
oo_unerase. Worked just fine.

This ep?

Right under "Sport Chumpions":
http://www.wiseacre-gardens.com/buttons/wb.html#Sport Chumpions

WB340 THE HENPECKED DUCK
19410830, LOONEY TUNES
CHAR: DAFFY DUCK;MRS. DAFFY DUCK;PORKY PIG
DIR: ROBERT CLAMPETT
SYNOP: DAFFY & THE MRS GO TO DIVORCE COURT AFTER HIS MAGIC TRICK
MAKES THEIR EGG DISAPPEAR AND HE TRIES TO SUBSTITUTE A DOORKNOB

I can't say as I've ever seen that one.
Who in the heck is "Mrs. Duck?"

And I thought it was Sylvester who was famous for being "Dethpicable"

Thanks!
Rich

That's the one. He is cast as himself and the little "lady", if memory
serves.

Jim