1

I have a broken SD card, of which I've taken an image. The image is fairly complete, >99% according to ddrescue, and conventional data recovery tools seem to be able to find most files. However, I'd like to extract as much of the file system metadata (file names, directory structure) too.

testdisk did not manage to recover the relevant partition information. My assumption is that the SD card got formatted, only overwriting the partition table stuff while keeping the data intact.

So, how do I extract as much of the path names from this corrupt file system? I know that the partition I am interested was FAT32 formatted, and its rough size and location (thanks to entropy analysis).

Improve this question
8
  • 1
    @harrymc Is this a "try this, good luck" or are you genuinely recommending it to solve my specific problem?
    – piegames
    Commented Feb 14, 2023 at 22:25
  • 1
    Strange question, but its screenshots seem like it conserves folder structure. And good luck, if you wish.
    – harrymc
    Commented Feb 14, 2023 at 22:30
  • 1
    well, which is it: 'broken' whatever that means or reformatted? what can be recovered and if file system can de used for recovery depends on what's actually wrong. Edit question to make it more clear what we're dealing with.
    – Joep van Steen
    Commented Feb 15, 2023 at 20:03
  • 1
    if reformatted, testdisk should have no trouble finding volume meta data as that was freshly written when reformatted. so gist of my question is more about what you base your analysis on. if reformatted you lose file allocation tables and root. entirely different recovery than recovery from volume with some bad blocks while file system is largely intact.
    – Joep van Steen
    Commented Feb 16, 2023 at 13:34
  • 1
    "Broken" is an unspecific term which does not disclose if the dammage is on a physical or logical level. I agree with Joe van Steen.
    – r2d3
    Commented Feb 16, 2023 at 15:43

2 Answers 2

Reset to default
1

The image is fairly complete, >99% according to ddrescue

Then analyse the image using a proper file system recovery tool, I use DMDE for cases like these.

My assumption is that the SD card got formatted, only overwriting the partition table stuff while keeping the data intact.

Reformatting wipes file allocation tables + root folder. Again use a proper file recovery tool. DMDE for example will be able to show if file allocation tables are largely empty and if they are, the file system was indeed reformatted probably.

enter image description here

In case file system reformatted, assume:

  • file/folder names in root are lost. Files from root need to be recovered using RAW recovery
  • non contiguous files will be corrupt after recovery

Non contiguous or fragmented files may be recoverable but it depends on file type and if a specific tool was developed for it. For example tools exist that try reconstruct fragmented JPEG or MP4 files for example.

overwriting the partition table

Does not influence recovery of files including original names, folder structure at all. IOW, 100% recovery possible.

Improve this answer
1
  • Thank you this did work, although I did not manage to recover any data that was not already in my backups.
    – piegames
    Commented Feb 16, 2023 at 20:50
1

My assumption is that the SD card got formatted, only overwriting the partition table stuff while keeping the data intact.

Formatting is an operation that affects primarily a partition. The partition table comes into play when the file system format operation establishs a file system different from the preceding one. In this case the file system information in the partition table needs to be updated. Otherwise there is no need to touch the partition table at all.

As the root directory is empty after a format operation on a FAT32 file system it has to be either overwritten (meaning deletion of metadata information for files and folders in the root directory) or an empty one written to a different location. In the later case a deletion is not necessary but the affected clusters of the old root directory will be released thus marked as free. FAT32 is not fixed in terms of root directory location as far as I remember.

Improve this answer
3
  • "FAT32 is not fixed in terms of root directory location as far as I remember." - correct, but default appears cluster 2.
    – Joep van Steen
    Commented Feb 16, 2023 at 16:21
  • Thank you! That means when formating a FAT32 file system at least cluster 2 and the following ones belonging to the root directory need to be overwritten.
    – r2d3
    Commented Feb 16, 2023 at 16:55
  • Yes. + FAT zeroed + FSInfo sector needs updating. + as you say partition table needs editing if file system changes (exFAT to NTFS etc.).
    – Joep van Steen
    Commented Feb 16, 2023 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .