Juhuslik failide kustutamine, vormindatud SD-kaart ja fotode taastamine¶

Arusaamine, et vormindasite lihtsalt vale kaamera SD-kaardi, tühjendasite välise töödraivi prügikasti või prügikasti või pühkisite kogemata terve partitsiooni asendamatutest perefotodest, on äge tehniline kriis. Kui fail kustutatakse või andmekandja kiirvormindatakse, kustutab operatsioonisüsteem harva mälurakkude sees olevad binaarandmed kohe. Selle asemel eemaldab see failisüsteemi kataloogikursori ja märgib need loogiliste plokkide aadressid "vaba ruumina", mida saab üle kirjutada. See, kas taastate 100 protsenti oma andmetest või kaotate need igaveseks, sõltub täielikult sellest, mis juhtub esimese 60 sekundi jooksul pärast kustutamist. Iga sekund on draiv ühendatud lugemis-kirjutamisrežiimis, taustal operatsioonisüsteemi indekseerimisel, failide vahetamisel, brauseri vahemäludel ja tahkisketta (SSD) prügikoristusrutiinidel (TRIM / UNMAP) võivad aluseks olevad sektorid jäädavalt nullida.

Kui juhuslik kustutamine või vormindamine hõlmab meditsiinilist telemeetriat, juriidilist tõendit aktiivse kuriteo kohta või eluohutussüsteemi riket, helistage kohalikule hädaabinumbrile (911 Ameerika Ühendriikides ja Kanadas, 112 kogu Euroopa Liidus, 999 Ühendkuningriigis) või tutvuge meie rahvusvaheliste kataloogidega hädaabinumbrid enne riistvara puudutamist. Kõigi tarbija-, fotograafia-, akadeemiliste ja ettevõtete andmete kadumise juhtumite korral peatage kohe kogu kettategevus ja järgige allolevat kohtuekspertiisi taastamise töövoogu.

Tehke seda kohe¶

1. Tõmmake eemaldatav SD-kaart, CFexpress-kaart või USB-draiv kohe välja: kui vormindasite äsja kaamera mälukaardi või kustutasite faile väliselt USB-draivilt, lülitage kaamera toitelüliti kohe välja või eemaldage väline USB-kaabel arvutist. Ärge tehke "üht testfotot", et näha, kas kaart töötab, ja ärge lubage Windowsi (chkdsk) või macOS (fsck_apfs) draivi "skannimiseks ja parandamiseks".
2. Kui kustutasite failid arvuti sisemisest süsteemidraivist (C: draiv või macOS Macintosh HD), tõmmake toide välja või lülitage jõuliselt välja: ärge sulgege rakendusi tavapäraselt, ärge laadige mõjutatud arvutisse alla andmete taastamise tarkvara ega klõpsake nuppu „Shut Down” (mis kirjutab gigabaite talveunerežiimi faile, registritarude kustutamist ja seansside kustutamist). Hoidke füüsilist toitenuppu 5-10 sekundit all, kuni masin täielikult välja lülitub, või eemaldage lauaarvuti toitejuhe, kui tegemist on mitteakusüsteemiga.
3. Libistage täissuuruses SDHC/SDXC kaartide füüsiline kirjutuskaitse lüliti asendisse LOCK: vaadake tavalise 32 mm x 24 mm (1,26 tolli x 0,94 tolli) SD-kaardi vasakut serva ja lükake väike plastikust sakk allapoole alumise serva poole (kuldsetest tihvtidest eemale, et lugeja ei saaks kogemata kirjutada). .DS_Store, System Volume Informationvõi Spotlighti registrifailid, kui ühendate selle hiljem.
4. Saage aru SSD TRIM-lõksust enne sisemise SSD uuesti sisselülitamist: kaasaegsed NVMe ja SATA pooljuhtkettad töötavad riistvara tasemel TRIM (ATA) või Deallocate (NVMe) käsud mõne sekundi kuni minuti jooksul pärast faili kustutamist või vormindamist. Kui SSD-kontroller käivitab kärbitud lehtede taustal prügi kogumise, loeb töötlemata nikerdamise tarkvara ainult nulle (0x00). Toite väljalülitamine ei lase sisemisel SSD-mikroprotsessoril taustal prügi kogumist lõpetada.
5. ** Valmistage ette eraldi puhas sekundaararvuti ja suurem sihtketas**: ärge kunagi installige taastetööriistu draivile, mille andmed kaotasid, ja ärge kunagi taastage skannimise ajal taastatud faile samale lähtekettale. Kasutage teist arvutit (või käivitage mõjutatud arvuti väliselt Ubuntu Linux Live USB-mälupulgalt) ja ühendage tühi väline kõvaketas, millel on mõjutatud draivist vähemalt kaks korda suurem mälumaht.
6. Looge sektorite kaupa töötlemata kahendkujutis (.img või .dd) enne mis tahes failitaasteparseri käivitamist: enne PhotoReci, R-Studio, DMDE või UFS Exploreri käivitamist kasutage ddrescue või HDDSuperClone, et kloonida SD-kaardi või draivi iga sektor oma varukettal üheks pildifailiks. Seejärel saate pildifaili vastu turvaliselt käivitada mitu taastealgoritmi, ilma et riskiksite algse andmekandja edasise kulumise või juhusliku kirjutamisega.

Otsuste puu: õige taastestrateegia valimine andmekandja ja failisüsteemi järgi¶

Kasutage seda kohtuekspertiisi vooskeemi, et teha kindlaks, kas teie kustutatud andmeid saab taastada loogilise failitabeli rekonstrueerimise, toorfaili allkirjade nikerdamise või spetsiaalse killuanalüüsi abil.

flowchart TD
    A["Tuvastati juhuslik faili kustutamine või draivi vorming"] --> B["Lülitage seade kohe välja või eemaldage eemaldatav kandja"]
    B --> C{"Millist tüüpi füüsilise mälu riistvara see mõjutab?"}
    C -->|"Kaamera SD / MicroSD / CFexpress / USB Flash"| D["Lülitage sisse füüsiline kirjutuskaitse lüliti või kasutage kirjutuskaitstud USB-blokeerijat"]
    C -->|"Väline või sisemine mehaaniline kõvaketas (HDD)"| E["TRIM riski puudub: suur taastamise tõenäosus, kui uusi kirjutisi ei ole"]
    C -->|"Sisemine või väline SSD / NVMe / Mac / nutitelefon"| F{"Millist failisüsteemi ja OS-i ühendust kasutati?"}
    F -->|"NTFS, APFS või ext4 sisemisel NVMe/SATA SSD-l"| G["Suur TRIM-risk: käivitage Linux Live USB kaudu libata.force=noncqtrim"]
    F -->|"exFAT või FAT32 standardse USB-massmälu kaudu"| H["Mõõdukas/madal TRIM-i risk: paljud USB-sillad ei läbi exFAT-i TRIM-i"]
    F -->|"iOS / Android sisemälu"| I["Riistvara failipõhine krüptimine (FBE): võtmed hävivad kustutamisel, kontrollige kohe pilve/kohalikke varukoopiaid"]
    D --> J["Täieliku bitivoo klooni (.img) loomine GNU ddrescue abil eraldi draivile"]
    E --> J
    G --> J
    H --> J
    J --> K{"Kas failid kustutati eraldi või oli draiv vormindatud?"}
    K -->|"Individuaalne kustutamine / kiirvormindamine (metaandmed puutumata)"| L["Käivitage loogiline metaandmete rekonstrueerimine (DMDE, R-Studio, UFS Explorer, TestDisk)"]
    K -->|"Ülekirjutatud failitabel / kaamera korpusesisene vorming"| M["Käivitage töötlemata faili allkirja nikerdamine + fragmenteeritud video taasesitus (PhotoRec, GoPro/MP4 remont)"]

Kustutamise füüsika: HDD magnetplaadid vs. SSD NAND-välklamp ja kaamera SD-kaardid¶

Taastatavate andmete hävitamise vältimiseks peate mõistma, kuidas erinevad salvestusarhitektuurid käitlevad kustutamist ja vormindamist kapoti all.

1. Mehaanilised kõvakettad (HDD) ja shingled Magnetic Recording (SMR)¶

Traditsioonilisel tavalisel magnetsalvestuse (CMR) pöörleval kõvakettal võtab faili kustutamine või kiirvormingu käivitamine vähem kui kaks sekundit, kuna lugemis-/kirjutuspead muudavad ainult põhikataloogi indeksit, näiteks $MFT (peafailitabel) NTFS-is, eraldamise bitmap ja kataloogi B-puu HFS+/APFS-is või failijaotuse tabel FAT32/exFAT-is. Tegelikud magnetvoo ümberpööramised, mis esindavad teie JPEG-sid, PDF-e ja arvutustabeleid, jäävad koobaltisulamist taldrikutele puutumata, kuni operatsioonisüsteem otsustab kirjutada nende täpsete loogiliste plokkide aadresside (LBA) asemel täiesti uue faili.

Paljud kaasaegsed suure võimsusega tarbijate välised kõvakettad (tavaliselt 2 terabaiti kuni 5 terabaiti 2,5-tollistes kaasaskantavates korpustes) kasutavad aga Singled Magnetic Recording (SMR) koos sisemise püsivara tõlkekihiga, mida nimetatakse Meedia vahemälu. Mõned kaasaegsed SMR-kõvakettad toetavad seda TRIM käsk täpselt nagu SSD. Kui kustutate TRIM-toega SMR-kõvakettal suure kausta ja jätate selle 20 minutiks jõudeolekusse ühendatuna, võib draivi sisemine püsivara oma vöötohatisribad ümber korraldada ja taustal olevad jaotamata sektorid jäädavalt nullida. Draivi vooluvõrgust lahtiühendamine hoiab ära selle sisemise majapidamistsükli.

2. Solid State Drives (SSD), NVMe ja TRIM / Deallocate Täitmise aken¶

SSD-de sees olev NAND-välkmälu ei saa olemasolevaid andmeid otse paigas üle kirjutada. Enne kui NAND-välkmälu saab uusi andmeid vastu võtta, peab terve välkmäluplokk (tavaliselt 4-16 megabaidi suurune) läbima aeglase elektrilise Programmi/Kustuta (P/E) tsükli. Kui SSD ootaks vanade plokkide kustutamiseks uue faili salvestamist, väheneks kirjutamiskiirus.

SSD-de kiirena hoidmiseks kasutage kaasaegseid operatsioonisüsteeme (Windows 7 kuni Windows 11, macOS 10.10+ ja Linuxi tuumad fstrim või discard) saatke kohe TRIM (SATA) või Dataset Management: Deallocate (NVMe) käsk SSD-kontrollerile, kui tühjendate prügikasti/prügikasti või käivitate kiirvormingu:

1. Deterministlik lugemisnull pärast TRIM-i (DZAT / DRAT): peaaegu kõik kaasaegsed tarbijale mõeldud NVMe ja SATA SSD-d jõustavad pärast TRIM-i deterministlikku nullimist. Täpne millisekund, mille SSD-kontroller vastu võtab TRIM käsk paljude sektorite jaoks, lahutab selle sisemine Flash Translation Layer (FTL) need loogilised aadressid füüsilistelt NAND-lehtedelt.
2. Kohe nulltagastus: isegi enne füüsilise elektrilaengu kustutamist ränielementidest, kui tarkvara (sh. ddrescue, PhotoRec või R-Studio) palub SSD-l lugeda need kärbitud sektorid standardsete SATA- või NVMe-käskude kaudu, SSD-kontroller peatab päringu ja tagastab puhtad kuueteistkümnendsüsteemi nullid (00 00 00 00) isegi füüsilisi NAND-kiipe kontrollimata.
3. Kui SSD taastamine on endiselt võimalik:
   • Välised USB-korpused ilma UASP/TRIM-i läbipääsuta: vanemad USB 3.0 sillakiibid, mis kasutavad UASP (USB-ga ühendatud SCSI-protokoll) asemel pärandprotokolli BOT (Bulk-Only Transport), ei saa opsüsteemi tõlkida TRIM käske USB-kaabli kaudu.
   • FAT32 ja exFAT köited teatud OS-i versioonidel: ajalooliselt saadeti mitu operatsioonisüsteemi järge ainult automaatselt reaalajas TRIM käske natiivsetes päevikuga failisüsteemides (NTFS, APFS, ext4) ja ei andnud välja koheselt reaalajas TRIM eemaldatava peal FAT32 või exFAT vaheseinad.
   • ** Jaotuslaua pühkimine (diskpart clean või partitsiooni juhuslik kustutamine) ilma vormindamiseta**: partitsioonikirje kustutamine GUID-i partitsioonitabelist (GPT) või põhikäivituskirjest (MBR) jätab mõnikord aluseks olevad sektorid kärpimata, kuni selle peale vormindatakse uus failisüsteem.

3. Kaamera korpuses vormindamine ja Sony / Canon / Nikon SD_ERASE Lõks¶

Fotograafid ja videograafid eeldavad sageli, et SD-, microSD- või CFexpress-kaardi vormindamine digikaameras on identne lauaarvuti kiirvormindamisega. Kuigi see oli tõsi kümme aastat tagasi, käituvad tänapäevased peeglita kaamerad olenevalt tootjast väga erinevalt:

1. etapp: OS-i viivitamatu piiramine ja automaatse kirjutamise blokeerimine¶

Before you try to recover files from an internal drive or attach an external drive to a computer, you must neutralize the operating system mechanisms that silently overwrite deleted space.

1. Recovering from an Internal Windows Drive (C: Drive)¶

If you deleted an important folder from your Windows Desktop, Documents, or Downloads folder and emptied the Recycle Bin:

1. Do NOT keep using Windows on that drive: Even leaving Windows sitting idle at the Desktop allows SearchIndexer.exe, Windows Defender background scans, Chrome/Edge cache updates, Volume Shadow Copy rotation, and the Windows Pagefile (pagefile.sys) to write hundreds of megabytes per minute directly over your newly freed clusters.
2. If you cannot power off immediately (for example, on a remote workstation with no physical access), disable TRIM instantly via Administrator Command Prompt:
   • Vajutage Win + X, click Terminal (Admin) or Command Prompt (Admin), and execute:

     fsutil behavior set DisableDeleteNotify 1
     

   • This stops Windows from sending any further TRIM notifications for NTFS and ReFS volumes, though it cannot undo TRIM commands sent seconds earlier.
3. Check if a Volume Shadow Copy (Previous Versions) already exists before shutting down (takes 15 seconds):
   • Right-click the parent folder that held your deleted files, click Properties -> Previous Versions.
   • Or run vssadmin list shadows in an Administrator Command Prompt. If a shadow snapshot exists from earlier today or yesterday, you can mount that shadow copy read-only (mklink /d C:\ShadowRestore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\) and copy your intact files directly to an external USB thumb drive.
4. If no Shadow Copy exists, shut down hard and boot from a Linux Live USB: Create an Ubuntu or SystemRescue USB flash drive on a different computer, boot the affected PC from that USB drive in Try Ubuntu (Live RAM mode) without mounting the internal drive rw, and image or extract the files from outside Windows.

2. Recovering from a macOS System Drive (Apple Silicon M1/M2/M3/M4 & T2 Macs)¶

Modern Apple computers running macOS on APFS (Apple File System) present two strict architectural hurdles:

1. Aggressive APFS TRIM: macOS sends TRIM commands immediately upon emptying the Trash on internal Apple SSDs.
2. Hardware FileVault / Secure Enclave Encryption: On all Macs with an Apple T2 chip or Apple Silicon (M1, M2, M3, M4), the internal SSD is hardware-encrypted at rest by default using keys tied to the Secure Enclave, even if FileVault is turned "Off" in System Settings.
   • Immediate Check 1: Local Time Machine Snapshots (tmutil): Even if your external Time Machine backup drive was unplugged at the time of deletion, macOS automatically creates hidden hourly APFS Local Snapshots on the internal SSD if Time Machine is configured. Open Terminal immediately and run:

     tmutil listlocalsnapshots /
     

     If you see snapshots listed (such as com.apple.TimeMachine.2026-10-31-091522.local), open the folder where the file lived and launch the Time Machine app from Applications to restore the file in seconds.
   • Immediate Check 2: Cloud Sync Trash Bins (iCloud Drive, OneDrive, Dropbox, Google Drive): Because macOS Desktop and Documents folders are frequently synced to iCloud Drive, deleting a file from your Mac Desktop deletes it via iCloud sync rather than just locally. Open a browser on your phone or another PC, log into icloud.com -> Drive -> Recently Deleted (bottom right corner), where deleted files are retained for 30 days completely untouched by local SSD TRIM.

3. Blocking macOS and Windows from Polluting a Plugged-in SD Card or External Drive¶

When you plug a camera SD card or external USB drive into a computer to recover files, the host operating system immediately tries to write hidden metadata files onto the root of the drive (.DS_Store, .Spotlight-V100, .fseventsd, .Trashes on macOS; System Volume Information ja $Recycle.Bin on Windows). Those tiny writes land right at the beginning of the free space bitmap, often corrupting the exact directory headers you are trying to recover.

• On Linux (Safest Forensic Method): Linux does not auto-write hidden index folders if you disable auto-mounting or mount the block device strictly read-only (ro,noload).
• On Windows (Enable Read-Only Disk Attribute via DiskPart BEFORE inserting the drive, or use Registry WriteBlocker):
  • Open regedit.exe as Administrator, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies (create the StorageDevicePolicies key if it does not exist), and create a DWORD (32-bit) value named WriteProtect set to 1. Plug in your USB card reader afterward, and Windows will treat all removable USB storage as hardware write-protected.
• On macOS (Mount via Disk Arbitrator): Download and launch the open-source utility Disk Arbitrator before plugging in your SD card reader or external drive. Set Disk Arbitrator to Block Mounts or Mount Read-Only, so macOS cannot write .DS_Store or Spotlight indexes onto the damaged partition.

Phase 2: Creating a forensic sector-by-sector clone (ddrescue)¶

Never run file recovery scans directly on a failing hard drive, a worn-out microSD card, or the sole copy of a formatted partition. Creating a raw binary image file (.img või .dd) guarantees that you have a frozen, bit-for-bit snapshot of every sector as it existed the moment you unplugged the drive.

Step-by-Step Cloning with GNU ddrescue (Linux / macOS) or HDDSuperClone¶

1. Identify the exact device identifier of your source card or drive:
   • On Linux, run lsblk -o NAME,SIZE,MODEL,RO,FSTYPE,MOUNTPOINT before and after plugging in the card reader. Suppose your 64 gigabyte (59.6 gibibyte) camera SD card appears as /dev/sdc (make sure it is not mounted; if mounted, run sudo umount /dev/sdc1).
   • On macOS, run diskutil list to find the disk number (for example, /dev/disk4), then unmount its volumes without ejecting the hardware: diskutil unmountDisk /dev/disk4.
2. Mount your large destination storage drive: Suppose your external 2 terabyte backup drive is mounted at /mnt/backup (või /Volumes/BackupDrive on macOS). Verify it has enough free space to hold the entire raw capacity of the source drive (a 64 gigabyte SD card produces a 64 gigabyte .img file, even if only 10 gigabytes of photos were on it).
3. Execute ddrescue with a mapfile (log file):

   sudo ddrescue -d -r3 /dev/sdc /mnt/backup/sdcard_raw_clone.img /mnt/backup/sdcard_rescue.map
   

   • -d uses direct disk access (bypassing the operating system kernel page cache for accurate sector reads; on macOS use /dev/rdisk4 instead of -d).
   • -r3 tells ddrescue to copy all healthy sectors across the entire drive on the first fast pass, skip over any slow or damaged flash blocks immediately so the card does not overheat or lock up, and then retry bad sectors up to 3 times at the end.
   • sdcard_rescue.map saves your exact progress every few seconds. If the USB reader disconnects or the power goes out, running the exact same command resumes seamlessly from where it stopped without re-reading already rescued sectors.
4. Make a working copy or mount the .img file read-only: Once sdcard_raw_clone.img finishes at 100.00% rescued, eject your physical SD card and store it in a safe drawer. You will perform 100 percent of your recovery work on sdcard_raw_clone.img.

Phase 3: Executing file recovery (Logical Metadata Reconstruction vs. Raw Carving)¶

Once you have a safe .img file (or a hardware write-blocked drive), there are two completely different technical methods to extract your deleted data. You should always attempt Method A (Logical File System Reconstruction) first before falling back to Method B (Raw Signature Carving).

Step-by-Step 1: Restoring a Deleted Partition or Corrupted Boot Sector with TestDisk¶

If your external drive or SD card suddenly asks "You need to format the disk in drive E: before you can use it" or shows up as RAW / Unallocated in Disk Management after being unplugged without safely ejecting, your files were not deleted at all. Instead, the Master Boot Record (MBR), GUID Partition Table (GPT), or Boot Sector (BPB) was corrupted.

1. Run TestDisk against your cloned image file:

   testdisk /mnt/backup/sdcard_raw_clone.img
   

2. Select Proceed -> confirm the partition table type (Intel/PC for MBR SD cards under 2 terabytes, or EFI GPT for modern large drives).
3. Select Analyse -> Quick Search.
4. TestDisk will scan for backup partition headers (such as the automatic backup NTFS boot sector stored at the very last sector of an NTFS volume, or the backup FAT32 boot sector at sector 6).
5. Highlight the discovered partition and press P (List Files). If you immediately see all your folders and files listed intact inside the terminal window:
   • Ärge isegi viitsige partitsioonitabelit ümber kirjutada, kui soovite ainult faile. Lihtsalt vajutage C soovitud kaustadesse ja kopeerige need 100% originaalsete failinimede ja kaustastruktuuridega otse oma tervislikule sihtkettale.

Samm-sammult 2: loogiline metaandmete skannimine DMDE, R-Studio või UFS Exploreri abil¶

Kui failid kustutati kaudu Shift + Delete, emptied from the Recycle Bin, or wiped via a standard Quick Format:

1. Avage oma .img fail DMDE (tasuta väljaanne taastab kuni 4000 faili kataloogitoimingu kohta; täislitsents on odav), R-Studio või UFS Exploreri standardtaaste.
2. Esmalt kontrollige olemasolevat virtuaalset failisüsteemi puud:
   • NTFS-draividel on igal failil põhifailide tabelis 1024-baidine (1 kilobait) kirje ($MFT). Isegi kui fail kustutatakse, on see $MFT pesa jääb märgituks passiivse lipuga (0x00 instead of 0x01), mis sisaldab täpset failinime, ülemkataloogi ID-d ning täpset algusklastrit ja pikkust, kuni uus fail seda uuesti kasutab. $MFT slot. Furthermore, files smaller than ~700 bytes (such as brief text notes, crypto keys, or small scripts) are stored resident entirely inside the $MFT record itself and rarely get overwritten quickly.
   • Look in the $Root või Deleted / Found virtual folder generated within the first 5 seconds of opening the partition. If your files appear with a red x or trash icon and show a healthy size, select them and click Recover to your separate destination drive immediately.
3. Run a Full Volume Scan if the Directory Header Was Overwritten:
   • If a Quick Format overwrote the root directory or the first few megabytes of the $MFT, run a Full Volume Scan. The software will scan the entire image for surviving subdirectory index nodes (INDX buffers on NTFS, subdirectory cluster chains on FAT32/exFAT, or older transaction checkpoints on APFS/ext4) and combine logical metadata with raw file signature detection.

Step-by-Step 3: Raw File Carving with PhotoRec (When Metadata Is Completely Destroyed)¶

When the File Allocation Table (FAT) or $MFT has been completely zeroed out by a format, logical directory pointers are gone, leaving only the raw file contents sitting in unallocated data clusters. PhotoRec (bundled alongside TestDisk, completely free, open-source, and available for Windows, macOS, and Linux) excels at carving over 480 file formats (including Canon .CR2/.CR3, Sony .ARW, Nikon .NEF, Adobe .DNG/.PSD, .JPG, .PNG, .PDF, .DOCX/.XLSX zip containers, and .SQLITE databases):

1. Launch PhotoRec against your disk image:

   photorec /mnt/backup/sdcard_raw_clone.img
   

2. Select the target partition (or Whole disk if the partition table was wiped).
3. Before starting, go to [File Opt] at the bottom of the screen:
   • Vajutage s to deselect all 480 file types if you only care about specific files (for example, check only jpg, cr2/cr3, tif for raw photos, mov/mp4ja zip/docx), which drastically speeds up recovery and prevents false-positive garbage fragments.
4. Select [Options] -> keep Keep corrupted files : No unless recovering damaged video streams.
5. Select [Search], choose file system type [Other] (for FAT/exFAT/NTFS/HFS+), and select [Free] (if you only deleted files on an active partition) or [Whole] (if the partition was formatted).
6. Choose a destination folder on your separate large backup drive and press C to begin carving.
7. Post-Recovery Sorting for PhotoRec Output: Because PhotoRec saves files as f123456.jpg across dozens of recup_dir folders, you can automatically reorganize all recovered photos into clean YYYY/MM-Month/ folders with their exact camera timestamp filenames using the free command-line tool ExifTool:

   exiftool "-Directory<DateTimeOriginal" -d "%Y/%Y-%m-%d" -r /mnt/backup/photorec_output/
   

Specialized recovery: fragmented camera MP4/MOV videos (GoPro, DJI Drones, Sony, Canon)¶

One of the most frequent frustrations after running PhotoRec or standard file recovery software on a formatted camera card is discovering that 100 percent of the recovered .JPG ja .RAW photos open perfectly, but every single recovered .MP4 või .MOV video file refuses to play (0:00 duration or black screen).

Why Standard Recovery Software Breaks Modern Camera Videos¶

1. Interleaved Stream Recording: Modern action cameras (GoPro Hero series, DJI Air/Mavic/Mini drones, Insta360) and cinema mirrorless cameras do not write a single .MP4 file sequentially from start to finish. While recording 4K or 5.3K video, the camera simultaneously writes a high-resolution .MP4 stream, a low-resolution preview .LRV stream, an audio buffer, and telemetry metadata into alternating clusters on the exFAT/FAT32 card (for example: 4 megabytes of high-res video, followed by 512 kilobytes of .LRV preview, followed by 4 megabytes of high-res video).
2. Missing moov Atom in Unfinalized Recordings: If your drone crashed into water, your camera battery died mid-recording, or the SD card disconnected before you pressed the Stop Record button, the camera never wrote the moov atom (the master index table written at the very end of an MP4/MOV file that tells media players where every video frame and audio chunk sits).

How to Rebuild Unplayable or Fragmented Camera Videos¶

1. Case A: Unfinalized Video After Battery Loss or Crash (File Exists on Card, Shows Multi-GB Size, Won't Play):
   • The clusters are intact in the file system, only the moov index header is missing.
   • Use the free, open-source tool untrunc (specifically the anthwlock/untrunc fork) or recover_mp4 (slydiman). Provide untrunc with one healthy, playable reference .MP4 recorded on that exact same camera with the exact same resolution and framerate settings, alongside your broken .MP4:

     untrunc reference_working_video.MP4 corrupted_unfinalized_video.MP4
     

   • untrunc reads the codec parameters (avcC/hvcC and audio track layouts) from the working reference video, scans the raw H.264/H.265/HEVC NAL units in your damaged file, and synthesizes a brand-new moov atom in seconds.
2. Case B: Formatted SD Card with Interleaved / Fragmented Video (GoPro, DJI, Sony, Canon):
   • Because the FAT/exFAT cluster map was wiped during formatting, a standard carver grabs the ftyp/mdat header of your 4K video and then blindly copies the .LRV preview clusters and thumbnail clusters right into the middle of your video file, corrupting every single second of footage.
   • Instead of standard carvers, scan your sdcard_raw_clone.img using a fragmentation-aware video reconstructor that recognizes camera-specific cluster allocation cadences, such as SanDisk RescuePRO Deluxe (which includes specific GoPro/drone fragmented video assembly algorithms), Klennet Carver, or Disk Drill 5+ (which includes a dedicated GoPro/DJI fragmented video signature reconstructor).

Smartphone photo deletion: iOS (iPhone) and Android hardware encryption realities¶

A common and dangerous misconception is that you can plug a modern iPhone or Android smartphone into a laptop via USB and run traditional disk carving software (like Recuva or PhotoRec) on the phone's internal storage.

Why Traditional Sector Carving Cannot Read Modern Phones¶

Every iPhone since the iPhone 3GS (and all current iOS devices) uses Data Protection (File-Based Encryption) powered by a dedicated hardware AES crypto engine between the flash storage and main system memory. Similarly, every Android device shipped since Android 7.0+ (and mandatory since Android 10) uses File-Based Encryption (FBE) backed by the hardware Keystore/Titan M/Knox chip.

On both platforms, every single individual photo and file on the internal storage is encrypted with its own unique per-file cryptographic key. When a file is permanently purged from the phone's file system, the phone does not even need to erase the multi-megabyte photo blocks; it immediately destroys the 256-bit per-file encryption key in the metadata table. Without that key, the raw NAND blocks contain cryptographically unbreakable random noise. Even top-tier government forensic labs cannot "carve" permanently deleted photos from the internal flash of a modern iPhone or Android once the per-file key is wiped.

The Actual Recovery Paths for Deleted Smartphone Photos¶

Because hardware encryption blocks raw carving, recovering deleted photos from an iPhone or Android relies on recovering copies before retention timers expire or extracting cached thumbnail databases:

1. Check the On-Device "Recently Deleted" Album Immediately (30-Day Window):
   • iOS (iPhone / iPad): Open Photos -> scroll down to Utilities -> tap Recently Deleted (requires Face ID / Touch ID / Passcode). Photos stay here for 30 days before permanent key destruction.
   • Android (Google Photos / Samsung Gallery): Open Google Photos -> Library / Collections -> Trash / Bin (retained for 60 days if backed up, 30 days if device-only). Also check Samsung Gallery -> Menu (three lines) -> Trash (retained for 30 days), and open the Files by Google or My Files app -> Trash, which maintains a separate 30-day trash folder.
2. If You Deleted Photos from "Recently Deleted" on iPhone, Call Apple Support for an Emergency iCloud Server-Side Restore:
   • Many users do not realize that even after you manually click "Delete from All Devices" / "Empty Recently Deleted" in iCloud Photos, Apple's backend servers retain a soft-deleted server recovery buffer for a brief window (typically up to 7 to 14 days after permanent deletion).
   • Contact Apple Support immediately by phone or chat, ask to speak with a Senior Advisor, and ask them to trigger an iCloud Photo Library Server-Side Recovery on your Apple Account. They can frequently flip a server switch that dumps recently purged iCloud Photos right back into your album within 15 minutes.
3. Restore from an Older Unsynced Device or Encrypted Local Backup:
   • Airplane Mode Trick on Secondary iPad / Mac: If your iPhone synced a deletion to iCloud, grab your iPad or MacBook before it connects to Wi-Fi (turn off your home Wi-Fi router unplugging the power cord first if the iPad is asleep on your desk). Power on the iPad in total radio isolation, copy the still-present photos via USB cable or AirDrop to another device before the iPad receives the iCloud deletion push command.
   • Check iCloud Backup vs. iCloud Photos: If you had iCloud Photos turned OFF (Settings -> [Your Name] -> iCloud -> Photos -> Off), your Camera Roll is included inside your nightly iCloud Device Backup. You can wipe an old spare iPhone (or temporarily back up and reset your current iPhone) and restore the nightly iCloud Backup from before the moment you deleted the photo.
   • Check Local Finder / iTunes Backups on Your PC or Mac: Check ~/Library/Application Support/MobileSync/Backup/ on macOS or %APPDATA%\Apple Computer\MobileSync\Backup\ on Windows. You can browse and extract photos from old local backups without overwriting your phone using iMazing or iBackup Viewer.
4. Check Messaging App Local Caches (WhatsApp, iMessage, Telegram, Signal):
   • Did you ever text the deleted photo or video to a spouse, friend, or family group chat? Messaging apps store independent copies of media inside their own application sandboxes (Media/WhatsApp Images/Sent on Android, or inside chat attachments in iMessage). Even if you delete a photo from your main Camera Roll and empty the Trash, the copy inside your WhatsApp Sent folder or iMessage thread history remains completely untouched.

Cloud drive and enterprise accidental deletion recovery (Google Drive, OneDrive, Dropbox)¶

When an entire shared folder disappears or is overwritten on a cloud drive (or when ransomware or a syncing glitch deletes local files and syncs the deletion to the cloud), local disk recovery is often unnecessary because enterprise and consumer cloud platforms maintain multi-tier version histories:

1. Microsoft OneDrive & SharePoint Online:
   • First-Stage Recycle Bin (onedrive.live.com): Retains deleted files for 30 days on personal accounts and 93 days on Work/School accounts.
   • Second-Stage Site Collection Recycle Bin (Work/School): Even if an employee or hacker empties the main OneDrive Recycle Bin, click the link at the bottom of the Recycle Bin page labeled "Second-stage recycle bin", where purged files remain recoverable for the remainder of the 93-day window.
   • Restore Your OneDrive (Point-in-Time Rollback): Microsoft 365 subscribers can click Settings (gear icon) -> Options -> Restore your OneDrive, which uses a visual histogram slider to roll every single file, rename, and deletion across the entire cloud drive back to any exact minute within the last 30 days.
2. Google Drive & Google Workspace:
   • Google Drive Trash (drive.google.com/drive/trash): Retains deleted files for 30 days.
   • Google Workspace Admin Post-Trash Recovery (25-Day Grace Window): Even after a user clicks "Delete Forever" and empties their Google Drive Trash, a Google Workspace Administrator (or individual user contacting Google Drive Support on personal Google One accounts) can open the Google Admin Console (admin.google.com) -> Directory -> Users -> [Select User] -> More Options -> Restore Data, and restore permanently purged Google Drive files and Gmail messages for up to 25 additional days after the Trash was emptied.
3. Dropbox:
   • Deleted Files (dropbox.com/deleted_files): Retains deleted files and folders for 30 days on Basic/Plus/Family plans, and 180 days to 1 year on Professional/Business plans.
   • Dropbox Rewind (dropbox.com/rewind): Allows rolling back an entire folder or the entire account to undo mass deletions, accidental drags-and-drops, or encryption events.

Korduma kippuvad küsimused¶

Allikad kontrollitud¶

• National Institute of Standards and Technology (NIST, United States): Special Publication 800-88 Revision 1, Guidelines for Media Sanitization (ATA TRIM, NVMe Deallocate, and NAND Flash Translation Layer behavior) and Computer Forensics Tool Testing (CFTT) Program Disk Imaging Specifications (csrc.nist.gov).
• Cybersecurity and Infrastructure Security Agency (CISA, United States): Data Backup, Forensic Preservation, and Incident Handling Guidelines (cisa.gov).
• GNU Project / Antonio Diaz Diaz (International): Official GNU ddrescue Manual: Data Recovery Tool and Block Device Mapfile Algorithms (gnu.org/software/ddrescue).
• CGSecurity / Christophe Grenier (International): TestDisk & PhotoRec Official Documentation: Partition Recovery and File Carving Signatures (cgsecurity.org).
• Apple Platform Security (United States): FileVault, Data Protection Classes, Per-File Encryption Keys, and APFS Trim Architecture on Apple Silicon and T2 Systems (support.apple.com/guide/security).
• Android Open Source Project (AOSP, International): File-Based Encryption (FBE) and Metadata Encryption Architecture (source.android.com/docs/security/features/encryption).
• SD Association (International): SD Specifications Part 1: Physical Layer Simplified Specification (Erase Commands CMD32, CMD33, CMD38 and Write-Protect Mechanical Switch) (sdcard.org).

Seotud juhendid¶

• Kõvaketta rike ja andmete taastamine
• Arvuti varukoopiad: strateegia 3-2-1 ja avariitaaste
• Ransomware and malware
• Broken or water-damaged phone
• Linuxi süsteemi alglaadimise tõrge ja GRUB-i parandamine
• Windowsi sinine ekraan (BSOD) ja alglaadimise parandamine