manually deleted im...
 
Notifications
Clear all

manually deleted images

9 Posts
6 Users
0 Reactions
1,447 Views
(@edigama25)
Active Member
Joined: 11 years ago
Posts: 15
Topic starter  

had any one tried recovering 3 day old deleted pictures from galaxy s4 phones ,getting a physical dumb from ufed and then see all the deleted images as 0 bytes?

can any one explain why this is happening ?


   
Quote
(@kbertens)
Trusted Member
Joined: 13 years ago
Posts: 88
 

You verified the results with other filecarving tools like for example photorec?


   
ReplyQuote
(@edigama25)
Active Member
Joined: 11 years ago
Posts: 15
Topic starter  

photo rec will find all the pictures on the phone including existing ones ,
i taken out the free space of the user data partition and tried scanning it with win-hex raw search.
i found some photos but still the analyzer shoes me allot more is deleted .


   
ReplyQuote
(@edigama25)
Active Member
Joined: 11 years ago
Posts: 15
Topic starter  

its like one you deleted the image it automatically zeroize the free space.
has any one encountered some thing like this ?


   
ReplyQuote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
 

Hi,

I too have used this tool-PhotoRec. This is a digital picture and file recovery tool, which is very effective in recovering the deleted files. The tool is especially designed for recovering the file from hard drive and CD-ROM from phones and digital camera as well.

Actually, It works with identifying JPGE file when Block begins
- 0xff, 0xd8, 0xff, 0xe0
- 0xff, 0xd8, 0xff, 0xo1
- 0r 0xff, 0xd8, 0xff, 0xfe

And start recovering the files successfully.


   
ReplyQuote
Jamie
(@jamie)
Moderator
Joined: 5 years ago
Posts: 1288
 

Topic split to http//www.forensicfocus.com/Forums/viewtopic/t=12209/ as requested


   
ReplyQuote
(@joachimm)
Estimable Member
Joined: 17 years ago
Posts: 181
 

Topic split to http//www.forensicfocus.com/Forums/viewtopic/t=12209/ as requested

FYI there is some content in the thread that is related to the question from the OP, bottom line more details are needed otherwise we are just guessing on possible causes.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

I plead guilty to have asked Jamie to create the new thread.

For some reasons it was not possible to move back here the actual answer mscotgrove provided .

It is here
http//www.forensicfocus.com/Forums/viewtopic/p=6575192/#6575192

its like one you deleted the image it automatically zeroize the free space.
has any one encountered some thing like this ?

This was the original question, and I am not sure we have answered it. (The discussion has been useful though)

The following link

http//www.xda-developers.com/android/yet-another-reason-to-update-to-android-4-3-trim-support/

does state that Trim is included on S4 - this would surely explain the blank data area.

and right after it there are some considerations by joachimm
http//www.forensicfocus.com/Forums/viewtopic/p=6575193/#6575193

does state that Trim is included on S4 - this would surely explain the blank data area.

The OP does not indicate if the image was deleted on the internal storage or on a media card, neither did they indicate the file system or the android version. Or how they analyzed the free space. But yes trim is one of the options. Also see http//www.anandtech.com/show/7185/android-43-update-brings-trim-to-all-nexus-devices

Hope that now the relevant parts are easily accessible/readable.

jaclaz


   
ReplyQuote
Jamie
(@jamie)
Moderator
Joined: 5 years ago
Posts: 1288
 

Hope that now the relevant parts are easily accessible/readable.

Thanks jaclaz!


   
ReplyQuote
Share: