59 SD cards, one deleted week, done by Sunday morning
A Calgary company had deleted a week of recordings from its field cards. Newer recordings on the same cards had to stay untouched, and the recovered files had to go back into the client's own system. Most of the cards arrived on a Saturday.
What made it difficult
- Fifty-nine cards, and the client needed the data quickly.
- The cards used EXT4, a Linux file system, not the FAT or exFAT most cameras use.
- Only one date range was wanted, sitting beside newer recordings that had to be left alone.
- Four cards had bad sectors and failed ordinary imaging.
What we did
- Made a 1:1 image of every card and recovered the deleted files from the images.
- Wrote a script for the job that sorted recovered files by date, renamed them to the client's template, and logged every file's original name, new name and MD5 checksum.
- Imaged the four failing cards with hardware, using a reverse-read technique to get past the bad sectors.
- Delivered the recovered data from the first 31 cards on a portable SSD on Saturday afternoon.
By Saturday night, 55 of the 59 cards were imaged and recovered. The four failing cards were imaged and recovered on Sunday morning. One card turned out to have failed after recording, so its data had never been deleted at all.
Lab notes: EXT4 · 59 × 16 GB SD · hardware imaging with reverse read · per-file MD5 log
Similar problem?
Tell us what happened
Send the details or call (587) 387-2346. We'll tell you what to do with the device until you get here.
Drop-off: Southcentre Executive Tower, #610 - 11012 Macleod Trail SE, Calgary. Monday to Thursday 8:00 AM to 6:00 PM, Friday 8:00 AM to 5:30 PM.