recover of memory c...
 
Notifications
Clear all

recover of memory card  

  RSS
mikeyF
(@mikeyf)
New Member

Hey,
I am trying to recover a memory card from a car camera.
The memory card is full and no material has been deleted.
I tried by R-STUDIO and by CELLEBRITE and without success.
I asked whether it was possible to recover material that had been destroyed and how?
tnx,

Quote
Posted : 13/10/2018 8:37 am
jaclaz
(@jaclaz)
Community Legend

Hey,
I am trying to recover a memory card from a car camera.
The memory card is full and no material has been deleted.
I tried by R-STUDIO and by CELLEBRITE and without success.
I asked whether it was possible to recover material that had been destroyed and how?
tnx,

Well you will need to provide more information.
The "car camera" is actually a small DVR (Digital Video Recorder" and it may use a "proprietary" filesystem, or it may use a "common" filesystem that *for whatever reasons* became corrupt.
As well it is possible that the filesystem is "common" but the specific format in which single segments of the video are recorded is "proprietary".
And it is well possible that the memory card itself has some issues (a memory card - it depends on specific type - is - generally speaking - an electronic device comprising a controller and a memory chip).

So
1) Which (EXACT) make/model is the car camera/DVR?
2) Which (EXACT) make/model/type is the memory card?

Besides the above, reporting that "R-STUDIO" or "CELLEBRITE" were used on it "without success" is in practice "null info", you need to describe in detail what specifically you tried and what the specific result was, it is like you reported "I used a spanner to undo a bolt but it didn't work", willing to help folks will need to ask you
Did you use the proper size spanner?
Did you apply suitable force?
Are you sure that the bolt is left threaded?

Still in the example of the bolt, you might be invited to try each and every of the procedures listed here
https://www.instructables.com/id/How-to-remove-a-stuborn-nutbolt/
if you already tried unsuccessfully all of them, tell so, everyone will be saving time.

jaclaz

ReplyQuote
Posted : 13/10/2018 10:50 am
mikeyF
(@mikeyf)
New Member

So
1) Which (EXACT) make/model is the car camera/DVR?
2) Which (EXACT) make/model/type is the memory card?

jaclaz

1.The car camera is iRoad QUATTRO 4S Full HD video format h.264.
2.the memory card is 32GB SanDisk

The action I am trying to do is to restore a date that does not currently exist on the card.
For example Today is 15.10 and the information I need is 10.10 - and the initial date I see on the saved camera is 13.10

ReplyQuote
Posted : 15/10/2018 5:55 am
jaclaz
(@jaclaz)
Community Legend

1.The car camera is iRoad QUATTRO 4S Full HD video format h.264.
2.the memory card is 32GB SanDisk

The action I am trying to do is to restore a date that does not currently exist on the card.
For example Today is 15.10 and the information I need is 10.10 - and the initial date I see on the saved camera is 13.10

Being a DVR-like device it loops the recording, the new video recording is recorded over older recordings.

A 32 GB card will hold (roughly, a lot of factors are involved) about 4-5 hours at Full HD 1920x1080 (1080p)
see
https://dashboardcamerareviews.com/video-recording-time/

before overwriting older recordings.

Of course it depends on the video resolution chosen, but if you check the duration of the recordings that are viewable on the card while in the device, and all together they sum up to this (roughly) 4-5 hours total (or the whatever total corresponding to the used - lower - resolution), then anything before has been already overwritten. and thus cannot be retrieved.

AFAICT normally these devices directly overwrite old files with new data, but it is possible - in theory - that a given implementation deletes chunks of old files to have "free space" to record into, but even if this is the case, we are talking of maybe a few minutes that could be found deleted but not yet overwritten by new data.

The specific device seems like a "Israel only" device, there is not an English site for it, so I have to go through google translate, I seem to find not any detail about the formatting/filesystem on the SD card, but they do suggest the use of the Registrator viewer, a common enough (among the dashcam community) viewer from Russia
http//registratorviewer.narod.ru/
https://web.archive.org/web/20161129173806/http//www.registratorviewer.com/index_en.html
whose Author has sadly passed away, so that you probably need a "patched" version

https://dashcamtalk.com/forum/threads/google-maps-fix-for-registratorviewer-windows.27756/
https://dashcamtalk.com/forum/threads/google-maps-fix-for-registratorviewer-windows.27756/page-9#post-422137

and the card seems seemingly formatted with a filesystem that normal windows understands, so very likely FAT32, almost *any* file recovery tool will allow you to recover (if any) files deleted but not overwritten.

jaclaz

ReplyQuote
Posted : 15/10/2018 10:28 am
Bolo
 Bolo
(@bolo)
Member

We are probably able to recover data from this card using NAND protocol - process looks as here https://www.youtube.com/watch?v=4aGrvZFdkSw

ReplyQuote
Posted : 18/10/2018 7:25 pm
jaclaz
(@jaclaz)
Community Legend

We are probably able to recover data from this card using NAND protocol - process looks as here https://www.youtube.com/watch?v=4aGrvZFdkSw

Does the probably able extend to probably overwritten data? ?

jaclaz

ReplyQuote
Posted : 19/10/2018 6:49 am
Bolo
 Bolo
(@bolo)
Member

Nothing will allows to get back overwritten data but in case of

- delete / format where in physical dump you got only 0xFF
- factory reset in cellphones/tablet (not encrypted)
- corrupted controller (no recognized at all, recognized butonly 32Mb or 0 size)
- physical demage of communication pads of eMMC, SPI protocol

recovery over NAND can give best results….. there are many cases while in normal physical dump we got 64 Gb of NO data (FF) and in NAND over 50 Gb od real data

ReplyQuote
Posted : 19/10/2018 8:45 pm
jaclaz
(@jaclaz)
Community Legend

Nothing will allows to get back overwritten data but in case of

- delete / format where in physical dump you got only 0xFF
- factory reset in cellphones/tablet (not encrypted)
- corrupted controller (no recognized at all, recognized butonly 32Mb or 0 size)
- physical demage of communication pads of eMMC, SPI protocol

recovery over NAND can give best results….. there are many cases while in normal physical dump we got 64 Gb of NO data (FF) and in NAND over 50 Gb od real data

I know, but the OP didn't report any issues with accessing the card, not that all he got was 0x00's or 0xFF's, only that he could not find files before a threshold date/time, which in the case of a DVR-like device normally means "old video overwritten by newer one", particularly with a smallish sized SD card, capable of holding at the most a fraction of a single day's footage.

jaclaz

ReplyQuote
Posted : 20/10/2018 8:57 am
Bolo
 Bolo
(@bolo)
Member

NAND is used also for fully working card where as you wrote "he could not find files before a threshold date/time" - I just want to give solution that most recovery companies just close case and answer cannot be done without even trying to see what are inside memory itself. There are no guarantee that data are there but you also cannot say "there are no data or it was overwritten and this is reason why they are not available"…. Garbage Blocks in NAND "may" holds still many of old data

ReplyQuote
Posted : 20/10/2018 8:07 pm
jaclaz
(@jaclaz)
Community Legend

NAND is used also for fully working card where as you wrote "he could not find files before a threshold date/time" - I just want to give solution that most recovery companies just close case and answer cannot be done without even trying to see what are inside memory itself. There are no guarantee that data are there but you also cannot say "there are no data or it was overwritten and this is reason why they are not available"…. Garbage Blocks in NAND "may" holds still many of old data

I understand ) , and having the possibility of looking into otherwise non accessible areas of the SD card is an added value and surely an attempt to check what is in there is fine, BUT from there to say that "probably" the data can be recovered there is IMHO a looong way.

If you prefer, in the specific case of a DVR-like device (and in the specific rather "tight" recording loop, in the order of magnitude of a few hours) how much probabilities are there that the data that maybe can be recovered from these areas actually belong to the 5 days earlier timeframe the OP is interested in?

I would personally estimate that probability to be extremely low.

jaclaz

ReplyQuote
Posted : 21/10/2018 9:25 am
Bolo
 Bolo
(@bolo)
Member

The only way to check this is to make recovery over NAND….. only then he can check what he can get… in many cases even 1 minute video is worth a try.

ReplyQuote
Posted : 21/10/2018 8:30 pm
jaclaz
(@jaclaz)
Community Legend

The only way to check this is to make recovery over NAND….. only then he can check what he can get… in many cases even 1 minute video is worth a try.

… even 10 seconds for that matters, a try is always worth it ) , still the probability of finding it remains extremely low.

jaclaz

ReplyQuote
Posted : 22/10/2018 10:20 am
Share: