12GB on 32GB microS...
 
Notifications
Clear all

12GB on 32GB microSD card from Samsung missing

15 Posts
4 Users
0 Likes
537 Views
(@komatsu)
Posts: 17
Active Member
Topic starter
 

re data recovery from microSD card which was being used by Samsung Galaxy S4 phone

User let card fill up to maximum capacity with .jpeg and .mp4 files. ( I suspect this is root-cause of the data loss)

Card is detected by Windows.

Stellar Phoenix can get back around 20 gb but user is convinced that there is anther 12GB of missing photos.

What step should I try next? (would really appreciate any suggestions)

 
Posted : 25/01/2015 3:31 am
(@a-nham)
Posts: 32
Eminent Member
 

I know this sounds completely rudimentary, but have you already looked at the card on a linux or unix based OS. It is possible that you have two, if not more, partitions on the disk, and only one of which is readable by Windows.

A simple "fdisk -l" from the terminal before and after plugging into the computer should be enough. Run the first one to know what you already have plugged in. Plug in and run again. Compare that against the second one, whatever is new is your newly plugged in SD card. If you see that this new device has multiple sd@# (where @ is a letter and # is a number) for your newly found device, then there is more data. This command should also be able to give you a hint into the actual size of the SD card.

 
Posted : 25/01/2015 5:28 am
(@komatsu)
Posts: 17
Active Member
Topic starter
 

Thanks A.

The best troubleshooting always goes back to basics!

I have tried it on a Mac and got the same result.

Would using something like Ubunto be better?

 
Posted : 25/01/2015 5:36 am
(@a-nham)
Posts: 32
Eminent Member
 

I doubt it will make much of a difference, unless it's one of the new ext formats that mac does not natively recognize. Would it be possible for you to post what you got back from your terminal concerning this device? I want to know if Windows/Mac recognizes all the sectors of the card as total of about 32Gb card.

If it does show as about 32gb, then you might want to file carve one more time with another program, just in case the one you just used missed something (Of course i suggest working of a image of that card, if possible). Most of the forensic suites have one, and the open source scalpel tool works very well too.

You might also want to ask your client if the files he or she is sure the card only contained JPEGs and MP4s, many things like proprietary picture formats and game contents are not currently carvable.

 
Posted : 25/01/2015 6:22 am
(@komatsu)
Posts: 17
Active Member
Topic starter
 

A, "fdisk -1" did not work. I am not sure if you mean "-1" or "-l"

However, the command "diskutil list" shows

0 fdisk_partition-scheme 33.6GB disk1
1 Windows_FAT_32 NO NAME 33.6GB disk1s1

 
Posted : 25/01/2015 6:44 am
(@a-nham)
Posts: 32
Eminent Member
 

yes, i meant to say fdisk -l, sry if I confused you on that.

Well, its good news that is shows 32gb; I initially thought it was only recognized by Windows as a 20gb drive.

In this case, I would definitely try doing a file carve on the unallocated and slack space to see if it give you anything more. I would probably go ahead and carve for other video and picture formats, just in case. Other than that, I am really not such there is much else you can do, at least not by yourself.

 
Posted : 25/01/2015 7:40 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

What step should I try next? (would really appreciate any suggestions)

What I would do (which not necessarily is what you should do) would be to try have a second and then a third opinion.
Namely, I would try (of course after having made add-like or "forensic sound" sector-by-sector image of the card) running Photorec
http//www.cgsecurity.org/wiki/PhotoRec
(to recover again what is recoverable)
AND dmde
http//dmde.com/
(to understand if the issue is connected with plain filesystem corruption - like bad FAT tables - or by some other issue - let's say a wrong value in the volume extents or the like).
Then I would double (and triple) check the integrity of the recovered images, and then try using "negative approach".
Once you are sure that the recovered images are "good", I would zero out the sectors occupied by them on the filesystem, and then try running again.

The making of the device image(s), besides allowing to witpe/delete areas without losing original data may also give you a good indication of possible hardware issues, like inaccessible sectors/areas.

jaclaz

 
Posted : 25/01/2015 2:56 pm
(@komatsu)
Posts: 17
Active Member
Topic starter
 

DMDE (lastest version) imaging freezes at 60 per cent mark…

I will try now imaging using Photorec

 
Posted : 25/01/2015 9:07 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

DMDE (lastest version) imaging freezes at 60 per cent mark…

This is not a good sign ( , as it implies that there is a hardware issue of some kind, which BTW would be roughly consistent with the 12 Gb missing, as 20/32=62.5 %

I will try now imaging using Photorec

Well, no.
Photorec does not make an image of a device, it attempts to recover files that it believes being of the type selected.

You may want to try using ddrescue or similar to create the device image (or as much as possible out of it).
Some references
http//www.msfn.org/board/topic/170288-lost-partition-and-filesystem-problem-with-adata-sh14-disk/?p=1059909

jaclaz

 
Posted : 25/01/2015 9:29 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

I would want to rule out the possibility of it being a fake memory chip. This is when a small memory chip is modified to look like a big memory chip - I have come across several such micro SD cards, but typically labelled 64GB - with 4GB or 8GB actual memory.

As others have said, data carving should give you an idea is what is on the card.

I also use a program that gives visual display of sector contents, eg compressed, text, file start or blank. ie very 'crude' but a very simple idea of what a memory device is storing.

 
Posted : 25/01/2015 10:29 pm
Page 1 / 2
Share: