manually deleted im...
 
Notifications
Clear all

manually deleted images

9 Posts
6 Users
0 Likes
701 Views
(@edigama25)
Posts: 15
Active Member
Topic starter
 

had any one tried recovering 3 day old deleted pictures from galaxy s4 phones ,getting a physical dumb from ufed and then see all the deleted images as 0 bytes?

can any one explain why this is happening ?

 
Posted : 07/09/2014 10:59 pm
(@kbertens)
Posts: 88
Trusted Member
 

You verified the results with other filecarving tools like for example photorec?

 
Posted : 07/09/2014 11:57 pm
(@edigama25)
Posts: 15
Active Member
Topic starter
 

photo rec will find all the pictures on the phone including existing ones ,
i taken out the free space of the user data partition and tried scanning it with win-hex raw search.
i found some photos but still the analyzer shoes me allot more is deleted .

 
Posted : 08/09/2014 10:03 am
(@edigama25)
Posts: 15
Active Member
Topic starter
 

its like one you deleted the image it automatically zeroize the free space.
has any one encountered some thing like this ?

 
Posted : 08/09/2014 11:17 am
(@Anonymous)
Posts: 0
Guest
 

Hi,

I too have used this tool-PhotoRec. This is a digital picture and file recovery tool, which is very effective in recovering the deleted files. The tool is especially designed for recovering the file from hard drive and CD-ROM from phones and digital camera as well.

Actually, It works with identifying JPGE file when Block begins
- 0xff, 0xd8, 0xff, 0xe0
- 0xff, 0xd8, 0xff, 0xo1
- 0r 0xff, 0xd8, 0xff, 0xfe

And start recovering the files successfully.

 
Posted : 27/09/2014 11:08 am
Jamie
(@jamie)
Posts: 1288
Moderator
 

Topic split to http//www.forensicfocus.com/Forums/viewtopic/t=12209/ as requested

 
Posted : 01/10/2014 5:09 pm
(@joachimm)
Posts: 181
Estimable Member
 

Topic split to http//www.forensicfocus.com/Forums/viewtopic/t=12209/ as requested

FYI there is some content in the thread that is related to the question from the OP, bottom line more details are needed otherwise we are just guessing on possible causes.

 
Posted : 02/10/2014 2:37 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I plead guilty to have asked Jamie to create the new thread.

For some reasons it was not possible to move back here the actual answer mscotgrove provided .

It is here
http//www.forensicfocus.com/Forums/viewtopic/p=6575192/#6575192

its like one you deleted the image it automatically zeroize the free space.
has any one encountered some thing like this ?

This was the original question, and I am not sure we have answered it. (The discussion has been useful though)

The following link

http//www.xda-developers.com/android/yet-another-reason-to-update-to-android-4-3-trim-support/

does state that Trim is included on S4 - this would surely explain the blank data area.

and right after it there are some considerations by joachimm
http//www.forensicfocus.com/Forums/viewtopic/p=6575193/#6575193

does state that Trim is included on S4 - this would surely explain the blank data area.

The OP does not indicate if the image was deleted on the internal storage or on a media card, neither did they indicate the file system or the android version. Or how they analyzed the free space. But yes trim is one of the options. Also see http//www.anandtech.com/show/7185/android-43-update-brings-trim-to-all-nexus-devices

Hope that now the relevant parts are easily accessible/readable.

jaclaz

 
Posted : 02/10/2014 3:44 pm
Jamie
(@jamie)
Posts: 1288
Moderator
 

Hope that now the relevant parts are easily accessible/readable.

Thanks jaclaz!

 
Posted : 02/10/2014 4:04 pm
Share: