±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36115
New Yesterday: 0 Visitors: 152

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Recover files from USB RAW partition

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

fissa
Member
 

Re: Recover files from USB RAW partition

Post Posted: Aug 24, 19 19:48

Mount the image with (example) arsenal image mounter. Then run photorec over it?

How did you make the image? Can you check the logs to see if there are errors?  
 
  

banderas20
Member
 

Re: Recover files from USB RAW partition

Post Posted: Aug 24, 19 22:07

- fissa
Mount the image with (example) arsenal image mounter. Then run photorec over it?

How did you make the image? Can you check the logs to see if there are errors?


Hi.

I created the image with WinImage 9.0. No errors nor warnings.

No matter which software I use. I doesnt't detect anything.

With Arsenal Image Mounter I get:

Code:
Id:000000
DiskDevice: PhysicalDrive1
Signature:00000000
Partition Layout: None
Disk Size: 59,47 GB
Fixed/removable: Fixed Disk
Volumes: <blank_field>
Mount Points: <blank_field>
Thanks!  
 
  

jaclaz
Senior Member
 

Re: Recover files from USB RAW partition

Post Posted: Aug 25, 19 08:29

- banderas20

I created the image with WinImage 9.0. No errors nor warnings.

Hmmm.

Winimage is like the least suitable tool to make an image of a defective media.

I would not be surprised if your image was all 00's, that could be EITHER an issue with the imaging tool or with the actual device.

You should use a dd of sorts or however a suitable tool.

Under windows you can use:

www.datarescue.com/pho...3/drdd.htm

But you can also use directly DMDE to make the image.

Try making another image, and try using the suggested tools.


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

mscotgrove
Senior Member
 

Re: Recover files from USB RAW partition

Post Posted: Aug 25, 19 11:54

Have you looked at the chip with a hex sector viewer. Do you see data, or is it all zeros?

If there are files, data carving tools should see something
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

banderas20
Member
 

Re: Recover files from USB RAW partition

Post Posted: Aug 25, 19 16:51

- jaclaz

You should use a dd of sorts or however a suitable tool.

Under windows you can use:

www.datarescue.com/pho...3/drdd.htm

But you can also use directly DMDE to make the image.

Try making another image, and try using the suggested tools.


jaclaz


Hi! Thanks. I'll give it a try.

- mscotgrove

Have you looked at the chip with a hex sector viewer. Do you see data, or is it all zeros?

If there are files, data carving tools should see something


I do see data. Indeed, I conduct file carving with EASEUS.

However, it's strange that with EASEUS Data Recovery, it carves the files and finds 4 MP4 files larger than 2GB. And when I try to restore them, their size is only some Kilobytes...

Thanks!  
 
  

Passmark
Senior Member
 

Re: Recover files from USB RAW partition

Post Posted: Aug 26, 19 01:13

Is the data confidential?

Can you upload an image of the SD card for us to take a look at?

Also how did the card get into this state?
e.g. Accidental formatting? Suspected hardware failure? Virus / ransomware?  
 
  

mscotgrove
Senior Member
 

Re: Recover files from USB RAW partition

Post Posted: Aug 26, 19 07:13

Where did the SD card come from - was it a camera / video camera?
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 

Page 2 of 3
Page Previous  1, 2, 3  Next