Formatted CF Card - Recovery options?

Started by Oedipax, March 27, 2014, 06:00:43 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Oedipax

Hey guys, well I screwed up big time. I was trying to go to the format card menu to quickly check how much space was left on my card (bad idea, I know) and in my haste I accidentally clicked "Yes" when it asked if I wanted to format my card. I pulled the card from the camera immediately as I know there's a pretty good chance I can get that stuff back if I don't do anything else to the card first.

So, I was shooting RAW video on a 5Dmk3. The card was formatted ExFAT. After the camera reformatted it, it switched to FAT32. I've tried Transcend's data rescue app and it didn't seem to do much, I'm also running StellarPhoenixPhotoRecovery on it right now but so far the scan hasn't turned up anything. I think maybe because these apps are looking for .CR2 or .NEF files, not .RAW .R00 etc video files.

Does anyone know the best app for OS X to scan for these? Am I totally hosed here? I'm so angry with myself for formatting that card, I never normally would make such an error but I was in the middle of a very hectic and stressful shoot where, alas, there was no DIT and I was wearing far too many hats at once.

Any help would be super super appreciated, thank you!


Oedipax

Yeah, I've been looking at that and TestDisk.

Can anyone tell me whether this stuff is usually recoverable? By that I mean ML RAW files in particular. And do I need to be a super hacker to do it or am I going to be able to figure this out? Has anyone done this before successfully?

Oedipax

Well, I'm running Photorec and I'm not sure whether I selected all the correct options, but so far it's recovered... something. Some small 33kb files with .gz extension and some others with something called .apple.

Needless to say these aren't the RAW video files, but there's still 3 hours left on the scan so I guess I'll wait and see.

I would absolutely love to hear from anyone if they've solved this problem successfully.

chris_overseas

I'm not sure you'll  have any luck with PhotoRec, though it won't do any harm to try. The way it works is to run a low level scan across the card, looking for file headers that it can recognise. That's why it has found those files so far, they're incidental files that have been written on their at some time in the past. The .apple file is probably some metadata written my Mac OS, the .gz files will be small gzip compressed files of some sort. Here's the full list of file formats detected by PhotoRec, unfortunately ML Raw and MLV are not among them: http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

TestDisk might be able to help however. I've personally used it to completely recover a disk drive that accidentally had a partition deleted. Just be careful not to write any changes to the card unless you're confident of the outcome; it might be a one-way street.
EOS R5 1.1.0 | Canon 16-35mm f4.0L | Tamron SP 24-70mm f/2.8 Di VC USD G2 | Canon 70-200mm f2.8L IS II | Canon 100-400mm f4.5-5.6L II | Canon 800mm f5.6L | Canon 100mm f2.8L macro | Sigma 14mm f/1.8 DG HSM Art | Yongnuo YN600EX-RT II

mageye

Would it be an idea to take a clone of the memory card and work from that. You could maybe use a hex editor and search for dng header information. I am not sure if the DNG files have a footer, but I suppose there must be some way of knowing where the EOF is. Maybe someone with some more knowledge of the format can help?
5DMKII | 500D | KOMPUTERBAY 32GB Professional 1000x |Canon EF 50mm f/1.8 II | Samyang 35mm f/1.4 ED AS UMC | Canon EF 75-300mm f/4-5.6 III | Zoom H2 (4CH. audio recorder) | Mac OS X 10.9.2 | Photoshop CC | After Effects CC | Final Cut Pro 7

Oedipax

Cool, thanks guys. I'll dig into this more over the weekend.

I've been back through the footage from the two other cameras I was running and fortunately there's plenty enough there to get through the edit even if I can't recover this stuff, but I'm still going to try. I'll check out TestDisk next.

mageye

Just thought that I would share this with people.

I managed to do this: -

1. Take some pictures on a freshly installed Magic Lantern card (silent pictures, dng format)

2. Use format from the camera and guess what? No files (other than ML files) appear on the card.

3. So I then have to 'recover' them obviously. So I had to find a way ::).

4. Using Disk Image from Applications/Utilities (OSX 10.9.2) I clicked on New Image with the card reader (with CF in it obviously!) device selected.

5. At the stage where where it asks what you want to save it as, I select entire device under the Image Format selection (Encryption - none).

6. It took ages for it to do a complete byte for byte copy of the device :-\.

7. Once completed, open the disk image using a hex editor (I used 0xED).

8. I had already analysed a DNG file of the same size as the one I was looking for ;) and the header contained the following: -

49492A00080000002500FE0004000100

9. So I did a hex search for that hex string ...

10. ... If they are there it will find them ::) ;).

11. Now the problem is to make a selection that matches the correct size of the file ???.

12. I had worked out the size of the hex selection from the DNG file that I had previously studied ;).

13. In this case I knew the selection size had to be 4596A8. So I made a selection of 4596A8 from the first hex value above (49).

14. The only part I didn't figure out :-\ is how to make that selection without dragging for ages (?) (I know stupid! :'().

15. Anyway ... once selected, I copied and then went to 0xED menu File > New and then paste.

16. Save file and give it a name like recovered_01.dng

17. I then checked the file and it opens up in Photoshop :). Recovered :D ;D.

That's it. :)

I am aware that there will be a number of ways of doing this and I am sure there are possibly easier options. I am also aware that the whole world don't use Mac's or hackintosh. All of the things that I have done there are possible on Windows and Linux etc.

There are plenty of tools to create byte for byte backups of cards and disks. Too many to mention. I can't remember, but I think something like Magic ISO would suffice (if I remember correctly?)

Also HEX editors are usually available for free for the public domain ;).

The point here is that where there is a will - there is usually a way. I am sure that it would be fairly easy (for someone with the coding skills) to make a recovery tool for such a situation but I am no coder so I have to 'find a way'.

I hope you can recover your files. Good luck.

Necessity is the mother of invention. ;D
5DMKII | 500D | KOMPUTERBAY 32GB Professional 1000x |Canon EF 50mm f/1.8 II | Samyang 35mm f/1.4 ED AS UMC | Canon EF 75-300mm f/4-5.6 III | Zoom H2 (4CH. audio recorder) | Mac OS X 10.9.2 | Photoshop CC | After Effects CC | Final Cut Pro 7

peternik999

You can recover formatted CF card with data recovery software, check out this step by step guide: how to recover data from CF card

Here's another CF card data recovery tutorial which you may find useful.

hope this helps.

I dont know

Check for file names that you know were there and be sure to include hidden files. If not found, then running a recovery software is best. There are several that have a chance to find the data. Don't copy or install anything else on your CF Card. Disk Drill CF Card recover for Mac https://www.cleverfiles.com/memory-card-recovery-mac.html is a good native software to try on something like this.