Mumtugol fiilngo e aksidaa, kartal SD mbayliigu, e ƴellitgol foto¶

Faamde wonde a ƴettii tan ko kartal SD kamera mo moƴƴaani, a ustii Recycle Bin walla Trash e diski gollorɗo yaajɗo, walla a momtii e aksidaa feccere fotooje galle ɗe lomtinaaka, ko caɗeele karallaagal tiiɗɗe. So fiilngo mumtaama walla lowre mooftirgel yaawnaama, ordinateer oo ina famɗi ɗo momtata dokke binndaaɗe raw nder ceŋorɗe ciftorgol ɗoon e ɗoon. E nder ɗuum, ina itta toɓɓere regginorde njuɓɓudi fiilngo, ina maantina ɗeen adreesuuji bolokaaji logic ko "nokku mbelɗo" baawɗo winndeede. So tawii a heɓtii 100 e nder teemedere dokke maa walla a majjii ɗum haa abada, fawii tan ko e ko kewata e nder leƴƴanɗe 60 gadane caggal nde a momtaa. Kala leƴƴannde wootere, diisnondirɗo oo ina heddii ina mooftaa e mbaadi janngude-winndude, e indeksuuji gollorɗi caggal, e fiiluuji swap, e kaɓirɗe feerorde, e golle mooftugol mbuuɗu Solid State Drive (SSD) (TRIM / UNMAP) ina waawi zero out haa abada sekteeruuji lesɗi ɗii.

So tawii momtugol walla mbayliigu nguu ina waɗi telemetrik safaara, seedeeji sariya e nder bonannde huuɓtodinnde, walla ŋakkeende njuɓɓudi kisal nguurndam, noddu limoore emergency nokku maa (911 to leyɗeele dentuɗe Amerik e Kanadaa, 112 e nder Dental Orop fof, 999 e nder leydi Angalteer) walla ƴeewto regginorde amen hakkunde leyɗeele limooje caɗtuɗe hade mum meemde hardware. Ngam denndaangal kewuuji majjugol dokke kuutortooɗe, fotooje, janngirɗe, e gollorɗe, dartin denndaangal golle disko ɗoon e ɗoon, njokka e golle ƴellitgol forensik les ɗee.

Waɗde ɗum jooni¶

1. Ittu kartal SD, kartal CFexpress, walla diski USB mo ittataa ɗoon e ɗoon: So aɗa fotnoo formatde kartal memto kamera tan walla aɗa momta fiiluuji e diski USB yaajɗo, ɓuuɓnu jolngo kamera ɗoon e ɗoon walla ittu kaɓirgal USB yaajngal ngal e ordinateer. Hoto ƴettu "foto jarriborɗo gooto" ngam ƴeewde so tawii kartal ngal ina golloo, kadi woto accu Windows (chkdsk) walla macOS (fsck_apfs) ngam "skannde e feewnude" disko oo.
2. So a momtii piille e nder disko ordinateer maa (C: disko walla macOS Macintosh HD), yank doole walla doole doole tiiɗɗe: Woto uddu appliiji no woorunoo, woto ƴettu lowre ƴellitgol dokke e nder ordinateer mo toɗɗaa oo, kadi woto ɓuɗɗu "Shut Down se" (ko winndata hiber registration, gigaby bolokaaji maa momtaaɗi ɗii). Hoɗdu e butoŋ doole ɓanndu fotde leƴƴanɗe 5 haa 10 haa masiŋ oo ustoo haa laaɓa cer, walla ittu jolngo doole desktop so tawii ko ordinateer mo alaa batiri.
3. Slide jokkorgal binndol-reende ɓanndu e karte SDHC/SDXC timmuɗe haa e nokku LOCK: Ƴeewto jokkorgal nano ngal karte SD 32 milimeeteer e 24 milimeeteer (1,26 inch e 0,94 inch) e pusde jokkorgal tab nold cana dow feewde e bot) winndude e aksidaa .DS_Store, System Volume Information, walla piille indeks Spotlight so a jokkondirii ɗum caggal.
4. Faam jolngo SSD TRIM hade maa huutoraade SSD ndernderiijo: NVMe e SATA Solid State Drives jamaanu ina kuutoroo tolno hardware TRIM (ATA) walla Deallocate (NVMe) yamiroore e nder leƴƴanɗe haa hojomaaji momtugol walla mbayliigu fiilde. So tawii jokkorgal SSD ngal ina doga e mooftude mbuuɗu caggal e kelle taƴɗe, lowre raw carving maa janngu tan ko zero (0x00). Waɗde doole ina kaɗa mikroo-porosesor SSD nder mum timminde mooftugol mbuuɗu caggal.
5. Peewnu ordinateer ɗiɗaɓo ceertuɗo, laaɓɗo e disko destination ɓurɗo mawnude: Hoto meeɗ waɗde kuutorɗe restoraaji e disko mo domen mum majji, kadi hoto meeɗ artirde piille restoraaji e disko source gooto e nder skannde. Huutoro ordinateer ɗiɗaɓo (walla boot ordinateer toɗɗaaɗo oo e diski USB yaajɗo Ubuntu Linux Live) e jokkondirde e diski yaajɗo mo alaa ko woni e mum, mo ko famɗi fof laabi ɗiɗi mbaawka mooftude diski toɗɗaaɗo oo.
6. Sosde natal binndol raw sekteer-sekteer (.img walla .dd) hade maa dogginde kala ƴeewndotooɗo fiilngo: Hade maa dogginde PhotoRec, R-Studio, DMDE, walla UFS Explorer, huutoro ddrescue walla HDDSuperClone ngam tafde kala sekteer kartal SD walla disko e nder fiilde natal gootal e disko maa jokkorgal. Ndeen maa mbaaw dogginde algoritmeeji keewɗi reentaade e kisal e dow fiilngo natal tawa a meeɗaa riisde ɓeydagol ɓooygol walla binndi aksidaaji e dow media asliijo.

Lekki kuule : suɓaade feere moƴƴitingol moƴƴere e mediaaji mooftirɗi e njuɓɓudi fiilngo¶

Huutoro ndeeɗoo taƴre ƴeewndo ñaawoore ngam anndude so tawii dokke maa momtaaɗe ɗee ina mbaawi heɓtineede e laawol feewnitagol fiilngo-tablo logic, ƴeewndo siyno fiilngo raw, walla ƴeewndo keeriiɗo chip-off:

flowchart TD
    A["Mumtugol Fiilde walla Format Drive yiytaa ko e aksidaa"] --> B["Ɗoon e ɗoon Power Off Device walla Eject Media mo ittataa"]
    B --> C{"Hol sifaa kaɓirɗe desorɗe ɓalliije ɗe ɗum toɗɗii?"}
    C -->|"Kamera SD / MikroSD / Sifekspres / Flash USB"| D["Naatde e Switch Binndol-Reende ɓanndu walla Huutoro Blocker USB janngoowo tan"]
    C -->|"Disko mekanik yaajɗo walla nder (HDD)"| E["Alaa TRIM Risk: Toowɗo Recovery So tawii Zero New Writes waɗii"]
    C -->|"SSD nder walla yaasi / NVMe / Mac / Telefoŋ cinndel"| F{"Hol Jokkorde Siistem Fiilde e OS huutoraa?"}
    F -->|"NTFS, APFS, walla ext4 e dow SSD NVMe/SATA nder"| G["Risk TRIM mawɗo: Fuɗɗoode e Linux Live USB e libata.force=noncqtrim"]
    F -->|"exFAT walla FAT32 dow lowre USB kuuɓtodinnde"| H["Risk TRIM moƳƳo/Lewɗo: Pontooji USB keewɗi njaltataa TRIM e exFAT"]
    F -->|"iOS / Android ko lowre ndernderiire"| I["Sifirde tuugornde e fiilngo (FBE): Kuutorɗe halkaaɗe e momtugol, ƴeewto Backups Cloud/Local ɗoon e ɗoon"]
    D --> J["Sos Taƴre Bitstream timmunde (.img) Huutoraade ddrescue GNU e dow Disko Ceertuɗo"]
    E --> J
    G --> J
    H --> J
    J --> K{"Mbele Fiildeeji ɗii ko gooto gooto walla Drive oo ko mbaydi?"}
    K -->|"Mumtugol gootol / Fotde jaawnde (Metadata ina selli)"| L["Doggol peewnugol doosɗe (DMDE, R-Studio, ƴeewndotooɗo UFS, Disk jarriborɗo)"]
    K -->|"Tablo Fiilde Binnditagol / Kameraa E nder Ɓanndu"| M["Doggol Fiilde Raw Siyno Taƴre + Mahoowo Wideyoo Feccere (PhotoRec, GoPro/MP4 Feewnitde)"]

Fisik momtugol : Ɓoggi magnetik HDD e SSD flash NAND e kaayitaaji SD Kamera¶

Ngam waasde bonnude dokke keɓtinaaɗe, aɗa foti faamde no arsitektuuruuji mooftirɗi ceertuɗi mbaɗirta momtugol e mbayliigu les hood.

1. Diskooji mekanik (HDD) e ƴettugol magnetik (SMR)¶

E nder disko magnetik (CMR) gaadoraaɗo, momtude fiilde walla dogginde "Quick Format" ina ƴetta ko famɗi fof leƴƴanɗe ɗiɗi sabu koye janngugol/winndugol ɗee ina mbayla tan indeks regginorde mawnde, ko wayi no... $MFT (Tablo Fiilde mawnde) e dow NTFS, Bitmap ceergal e Catal B-Tree e dow HFS+/APFS, walla Tablo ceergal Fiilde e dow FAT32/exFAT. Rewrude e mbaydiiji magnetik goongaaji lomtotooɗi JPEG-ji maa, PDF-ji maa, e limtooji maa ina keddii tawa memotaako e dow laylayti kobalt-alloy haa nde njuɓɓudi gollordu ndii suɓii winndude fiilde hesere e dow ɗeen Adreesuuji Blok Logikal (LBA) laaɓtuɗi.

Kono tan, diskiiji yaajɗi keewɗi baawɗi huutoreede hannde (ko ɓuri heewde ko 2 terabayt haa 5 terabayt e nder jokkorgal portaabe 2,5 inch) ina kuutoroo Shingled Magnetic Recording (SMR) e sara layer firo firmware ndernderiijo biyeteeɗo Media Cache. Won e diskiiji SMR jamaanu ina mballita tigi rigi e... TRIM yamiroore no SSD nii. So a momtii foldere mawnde e disko SMR baawɗo TRIM, a acci ɗum ina jokki e golle fotde hojomaaji 20, firmware nder disko oo ina waawi yuɓɓinde banngeeji mum shingled e zero out haa abada sekteeruuji ɗi ndokkaaka e nder laabi. Uddude diisnondirɗo oo ɗoon e ɗoon ina haɗa ndeeɗoo cirƴam nder galle.

2. Diskooji (SSD), NVMe, e... TRIM / Deallocate Winndannde Ƴellitaare¶

Memoire flash NAND nder SSD waawaa winndude dokke goodɗe ɗee to bannge nokku. Ko adii nde cellal flash NAND jaɓata dokke kese, bolol flash gootol (ko ɓuri heewde ko 4 megabayt haa 16 megabayt) ina foti adii waɗde cirƴam Program/Erase (P/E) kuuraa leelɗam. So SSD fadi haa a hisni fiilngo keso ngam momtude bolokaaji ɓooyɗi, njaaweeki binndol ina ustoo.

Ngam SSD ina yaawi, kuutorɗe jamaanu (Windows 7 haa Windows 11, macOS 10.10+, e kernel Linux e... fstrim walla discard) neldu ɗoon e ɗoon TRIM (SATA) walla Dataset Management: Deallocate (NVMe) yamiroore to jokkorgal SSD e sahaa nde njiyloto-ɗaa Recycle Bin/Trash walla mbaɗ-ɗaa Format Jaawɗo:

1. Janngu Zero caggal TRIM (DZAT / DRAT): Fotde kala SSD NVMe e SATA kuutortooɗo jamaanu ina doola Zero caggal TRIM. Milisekon tigi rigi mo jokkorgal SSD heɓata... TRIM yamiroore ngam sekteeruuji keewɗi, Layer Firo Flash (FTL) mum ndernderiijo ina ƴetta ɗeen adreesuuji logikaaji e kelle NAND ɓalliije.
2. Immediate Zero Return: Hay ko adii nde jolngo kuuraa fisik momtataa e cellal silikon, so tawii kala lowre (ina heen... ddrescue, PhotoRec, walla R-Studio) ina naamnoo SSD yo janngu ɗeen sekteeruuji taƴeeɗi e yamiroore SATA walla NVMe kuutorteeɗe, jokkorgal SSD ngal ina taƴa ɗaɓɓaande ndee, ina artira zerooji heksadesimal laaɓtuɗi (00 00 00 00) tawa hay ƴeewtaaki ƴulɓe NAND ɓalliije.
3. Nde SSD Recovery ina waawi haa jooni:
   • Kuuɗe USB yaajɗe ɗe ngalaa UASP/TRIM: Ɓoggi USB 3.0 ɓooyɗi kuutortooɗi porotokol BOT (Transport Bulk-Only) ɓooyɗo oo wonaa UASP (Porotokol SCSI jokkondirɗo e USB) mbaawaa firtude njuɓɓudi gollordu TRIM yamiroore e nder kaɓirgal USB.
   • FAT32 e exFAT Volumes e won e mbaydiiji OS: E nder daartol, mahdiiji gollorɗi keewɗi neldata tan ko otomatik e sahaa goonga TRIM jamirooje e dow njuɓɓudiiji fiilngo jaayndeeji (NTFS, APFS, ext4) e yaltinaani ɗoon e ɗoon waktuuji goonga TRIM on ittaa FAT32 walla exFAT peccitagol.
   • Wipe Tabalde Feccere (diskpart clean walla momtugol feccere tawa ko e aksidaa) tawa alaa Formatting: Mumtude naatgol feccere e Tablo Feccere GUID (GPT) walla Master Boot Record (MBR) ina addana sahaa e sahaa fof sekteeruuji les ɗii ɓuuɓde haa nde njuɓɓudi fiilngo kesiri fotndaa e dow mum.

3. Kameraaji nder ɓanndu e Sony / Canon / Nikon SD_ERASE Ngañgu¶

Fotooɓe e wideyooji ina keewi sikkude wonde ƴettude kartal SD, microSD, walla CFexpress nder kamera dijital ina nanndi e "Quick Format" e ordinateer desktop. So tawii noon ko ɗum goonga duuɓi sappo jooni, kameraaji ɗi ngalaa gite jamaanu ina ceerti no feewi fawaade e peewnoowo :

Faandaare 1 : Jogaade OS ɗoon e ɗoon e haɗde binndi otomaatik¶

Ko adii nde eto-ɗaa heɓtude piille e nder disko ndernderiijo walla jokkondirde e disko yaajɗo e ordinateer, aɗa foti neutraliser mekanismeeji gollorɗi ɗii, ɗi mbinndata e dow deeƴre nokkuuji momtaaɗi ɗii.

1. Resndude e disko Windows nder (C: Disko)¶

So tawii a momtii doggol teeŋtungol e doggol maa Windows Desktop, Documents, walla Downloads, a woppii Bin Recycle:

1. WOTO jokku huutoraade Windows e oon disko: Hay accude Windows ina jooɗii e Desktop ina addana SearchIndexer.exe, ƴeewndorɗe caggal Windows Defender, kesɗitingol kaɓirgol Chrome/Edge, waylo-waylo Koppirde Ɓooygol, e Fiilde Kelle Windows (pagefile.sys) ngam winndude teemedde megabayt e nder hojomaaji to bannge jokkorgal maa kesal rimɗinaangal.
2. So a waawaa momtude ɗoon e ɗoon (yeru, e nokku gollorɗo mo alaa ko woni e mum), momtu TRIM ɗoon e ɗoon e laawol yamiroore njuɓɓudi:
   • Toɓɓu Win + X, ɓuɗɗu e Terminal (Admin) walla Doggol yamiroore (Admin), e huutoraade:

     fsutil behavior set DisableDeleteNotify 1
     

   • Ɗuum haɗata Windows neldude kala ko ɓuri TRIM humpitooji ngam volumes NTFS e ReFS, hay so tawii noon ɗum waawaa ustude TRIM yamiroore neldaande leƴƴanɗe ko adii.
3. Ƴeewto so tawii ko Koppi Ɓooygol Volume (Previous Versions) ina woodi tawo hade mum uddude (ina ƴetta leƴƴanɗe 15):
   • Ɓoɗɗu e junngo ñaamo foldere mawnde jogiinde piille maa mumtaaɗe ɗee, ɓuɗɗu e Properties -> Versions précédentes.
   • Walla doga vssadmin list shadows e nder Ɗaɓɓaande Yamiroore Njuɓɓudi. So tawii foto ɗowdi ina woodi gila hannde walla hanki, aɗa waawi mooftude oon koppi ɗowdi janngeteeɗo tan (mklink /d C:\ShadowRestore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\) e ƴettude piille maa ɗe ngalaa ko bonnata, to bannge diski USB yaajɗo.
4. So Shadow Copy alaa, uddu hard e boot e Linux Live USB: Sos disko USB Ubuntu walla SystemRescue e ordinateer ceertuɗo, boot PC mo toɗɗaa oo e oon disko USB e nder Enndu Ubuntu (mode RAM Live) tawa aɗa moofta disko ndernderiijo rwct bannge Windows, e natal walla yaltude e fiilde ɓeydaande e Windows.

2. Resndude e disko macOS (Mac Apple Silikon M1/M2/M3/M4 & T2)¶

Ordinateeruuji Apple jamaanu kuutortooɗi macOS e APFS (Sistem Fiilde Apple) ina njogii caɗeele ɗiɗi tiiɗɗe e mahngo :

1. TRIM APFS cemmbinɗo: macOS ina nelda TRIM yamiroore ɗoon e ɗoon so a ustii Trash e SSDs Apple nder.
2. FileVault / Sifirde Enklaas Kisal: E denndaangal Macuuji jogiiɗi ƴoogirde Apple T2 walla Silikon Apple (M1, M2, M3, M4), SSD nder mum ina sifiree e nder fooftere e kuutoragol kuutorɗe jokkondirɗe e Enklaas Kisal, hay so tawii FiildeVa ko turn "Offa".
   • Ƴeewndo ɗoon e ɗoon 1: Nate masiŋ waktuuji nokkuuji (tmutil): Hay so tawii diisnondirɗo maa Time Machine yaajɗo oo woppitaama e sahaa momtugol ngol, macOS ina sosa otomatik APFS Local Snapshots cuuɗiiɗi waktuuji kala e SSD nder so tawii Time Machine ina softinaa. Uddit Terminal ɗoon e ɗoon, dogdu:

     tmutil listlocalsnapshots /
     

     So a yiyii nate limtaaɗe (hono... com.apple.TimeMachine.2026-10-31-091522.local), udditaa foldere ɗo fiilde ndee hoɗi ɗoo e uddit app Time Machine ummoraade e Applications ngam artirde fiilde ndee e nder leƴƴanɗe.
   • Ƴeewndo ɗoon e ɗoon 2: Binnditagol mbaylaandi sinkronisaasiyoŋ ruulde (Diski iCloud, OneDrive, Dropbox, Google Drive): Sabu foldere macOS Desktop e Documents ina keewi sinkronisaade e Diski iCloud, momtude fiilngo e Biro Mac maa momtata ɗum ko e sinkronisaasiyoŋ iCloud wonaa tan e nokku. Uddit feerorde e telefoŋ maa walla ordinateer goɗɗo, naata heen icloud.com -> Drive -> Mumtuɗo ko ɓooyaani (les to bannge ñaamo), ɗo piille mumtuɗe ɗee njooɗii fotde balɗe 30 ɗe SSD nokkuure ndee memotaako ɗum haa laaɓi TRIM.

3. Haɗde macOS e Windows pollude kartal SD walla diski yaajɗo¶

So a jolnii kartal SD kamera walla diski USB yaajɗo e nder ordinateer ngam heɓtude piille, ɗoon e ɗoon ordinateer gollorɗo oo ina etoo winndude piille metadata cuuɗiiɗe e dow root diski oo (.DS_Store, .Spotlight-V100, .fseventsd, .Trashes e dow macOS; System Volume Information e $Recycle.Bin e dow Windows). Ɗeen binndanɗe tokoose ina njippoo e fuɗɗoode bitmap nokku mo alaa ko woni e mum, ina keewi bonnude koye regginorde laaɓtuɗe ɗe njiɗ-ɗaa heɓtude.

• E nder Linux (Laawol Forensic ɓurngol kisal): Linux winndataa otomatik foldereeji indeks cuuɗiiɗi so a softinii auto-mounting walla a mooftii kaɓirgal block ngal ko janngetee tan (ro,noload).
• E nder Windows (Softinde sifaa disko janngaaɗo tan e DiskPart KO ADDI naatnude disko oo, walla huutoraade WriteBlocker binnditagol):
  • Uddit regedit.exe hono Ardiiɗo, yah to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies (tagde ko... StorageDevicePolicies key so tawii alaa), e sosde a DWORD (32-bit) nafoore inniraande WriteProtect set to 1. Sokkit janngirde karte maa USB caggal ɗuum, Windows maa waɗtu denndaangal defte USB ittaaɗe ɗee no hardware ndeenirta binndol.
• E nder macOS (Mount via Disk Arbitrator): Sosde e udditde kuutorgal udditiingal Arbitrator Disk hade maa jokkondirde e janngirde karte maa SD walla diski yaajɗo. Seto Disk Arbitrator e Blook Mounts walla Mount Janngude-Tan, ngam macOS waawa winndude .DS_Store walla indeksuuji Spotlight e dow feccere bonnde ndee.

Daawe 2 : Sosde taƴre sekteer-sekteer (ddrescue)¶

Hoto meeɗ dogginde skanndeeji ƴellitgol fiilde to bannge disko gonɗo e ŋakkere, kartal microSD ɓooyngal, walla koppi gooto e feccere mbaylaandi. Sosde fiilngo natal binndol raw (.img walla .dd) guarantees that you have a frozen, bit-for-bit snapshot of every sector as it existed the moment you unplugged the drive.

Step-by-Step Cloning with GNU ddrescue (Linux / macOS) or HDDSuperClone¶

1. Identify the exact device identifier of your source card or drive:
   • On Linux, run lsblk -o NAME,SIZE,MODEL,RO,FSTYPE,MOUNTPOINT before and after plugging in the card reader. Suppose your 64 gigabyte (59.6 gibibyte) camera SD card appears as /dev/sdc (make sure it is not mounted; if mounted, run sudo umount /dev/sdc1).
   • On macOS, run diskutil list to find the disk number (for example, /dev/disk4), then unmount its volumes without ejecting the hardware: diskutil unmountDisk /dev/disk4.
2. Mount your large destination storage drive: Suppose your external 2 terabyte backup drive is mounted at /mnt/backup (or /Volumes/BackupDrive on macOS). Verify it has enough free space to hold the entire raw capacity of the source drive (a 64 gigabyte SD card produces a 64 gigabyte .img file, even if only 10 gigabytes of photos were on it).
3. Execute ddrescue with a mapfile (log file):

   sudo ddrescue -d -r3 /dev/sdc /mnt/backup/sdcard_raw_clone.img /mnt/backup/sdcard_rescue.map
   

   • -d uses direct disk access (bypassing the operating system kernel page cache for accurate sector reads; on macOS use /dev/rdisk4 instead of -d).
   • -r3 tells ddrescue to copy all healthy sectors across the entire drive on the first fast pass, skip over any slow or damaged flash blocks immediately so the card does not overheat or lock up, and then retry bad sectors up to 3 times at the end.
   • sdcard_rescue.map saves your exact progress every few seconds. If the USB reader disconnects or the power goes out, running the exact same command resumes seamlessly from where it stopped without re-reading already rescued sectors.
4. Make a working copy or mount the .img file read-only: Once sdcard_raw_clone.img finishes at 100.00% rescued, eject your physical SD card and store it in a safe drawer. You will perform 100 percent of your recovery work on sdcard_raw_clone.img.

Phase 3: Executing file recovery (Logical Metadata Reconstruction vs. Raw Carving)¶

Once you have a safe .img file (or a hardware write-blocked drive), there are two completely different technical methods to extract your deleted data. You should always attempt Method A (Logical File System Reconstruction) first before falling back to Method B (Raw Signature Carving).

Step-by-Step 1: Restoring a Deleted Partition or Corrupted Boot Sector with TestDisk¶

If your external drive or SD card suddenly asks "You need to format the disk in drive E: before you can use it" or shows up as RAW / Unallocated in Disk Management after being unplugged without safely ejecting, your files were not deleted at all. Instead, the Master Boot Record (MBR), GUID Partition Table (GPT), or Boot Sector (BPB) was corrupted.

1. Run TestDisk against your cloned image file:

   testdisk /mnt/backup/sdcard_raw_clone.img
   

2. Select Proceed -> confirm the partition table type (Intel/PC for MBR SD cards under 2 terabytes, or EFI GPT for modern large drives).
3. Select Analyse -> Quick Search.
4. TestDisk will scan for backup partition headers (such as the automatic backup NTFS boot sector stored at the very last sector of an NTFS volume, or the backup FAT32 boot sector at sector 6).
5. Highlight the discovered partition and press P (List Files). If you immediately see all your folders and files listed intact inside the terminal window:
   • Do not even bother rewriting the partition table if you only want the files. Simply press C on the folders you want and copy them directly out to your healthy destination drive with 100 percent original filenames and folder structures.

Step-by-Step 2: Logical Metadata Scan Using DMDE, R-Studio, or UFS Explorer¶

When files were deleted via Shift + Delete, emptied from the Recycle Bin, or wiped via a standard Quick Format:

1. Open your .img file inside DMDE (free edition recovers up to 4,000 files per directory action; full license is inexpensive), R-Studio, or UFS Explorer Standard Recovery.
2. Check the Existing Virtual File System Tree First:
   • On NTFS drives, each file has a 1,024-byte (1 kilobyte) record in the Master File Table ($MFT). Even when a file is deleted, its $MFT slot remains marked with an inactive flag (0x00 instead of 0x01) containing the exact filename, parent directory ID, and exact starting cluster and length runs, until a new file reuses that $MFT slot. Furthermore, files smaller than ~700 bytes (such as brief text notes, crypto keys, or small scripts) are stored resident entirely inside the $MFT record itself and rarely get overwritten quickly.
   • Look in the $Root walla Deleted / Found virtual folder generated within the first 5 seconds of opening the partition. If your files appear with a red x or trash icon and show a healthy size, select them and click Recover to your separate destination drive immediately.
3. Run a Full Volume Scan if the Directory Header Was Overwritten:
   • If a Quick Format overwrote the root directory or the first few megabytes of the $MFT, run a Full Volume Scan. The software will scan the entire image for surviving subdirectory index nodes (INDX buffers on NTFS, subdirectory cluster chains on FAT32/exFAT, or older transaction checkpoints on APFS/ext4) and combine logical metadata with raw file signature detection.

Step-by-Step 3: Raw File Carving with PhotoRec (When Metadata Is Completely Destroyed)¶

When the File Allocation Table (FAT) or $MFT has been completely zeroed out by a format, logical directory pointers are gone, leaving only the raw file contents sitting in unallocated data clusters. PhotoRec (bundled alongside TestDisk, completely free, open-source, and available for Windows, macOS, and Linux) excels at carving over 480 file formats (including Canon .CR2/.CR3, Sony .ARW, Nikon .NEF, Adobe .DNG/.PSD, .JPG, .PNG, .PDF, .DOCX/.XLSX zip containers, and .SQLITE databases):

1. Launch PhotoRec against your disk image:

   photorec /mnt/backup/sdcard_raw_clone.img
   

2. Select the target partition (or Whole disk if the partition table was wiped).
3. Before starting, go to [File Opt] at the bottom of the screen:
   • Toɓɓu s to deselect all 480 file types if you only care about specific files (for example, check only jpg, cr2/cr3, tif for raw photos, mov/mp4, be zip/docx), which drastically speeds up recovery and prevents false-positive garbage fragments.
4. Select [Options] -> keep Keep corrupted files : No unless recovering damaged video streams.
5. Select [Search], choose file system type [Other] (for FAT/exFAT/NTFS/HFS+), and select [Free] (if you only deleted files on an active partition) or [Whole] (if the partition was formatted).
6. Choose a destination folder on your separate large backup drive and press C to begin carving.
7. Post-Recovery Sorting for PhotoRec Output: Because PhotoRec saves files as f123456.jpg across dozens of recup_dir folders, you can automatically reorganize all recovered photos into clean YYYY/MM-Month/ folders with their exact camera timestamp filenames using the free command-line tool ExifTool:

   exiftool "-Directory<DateTimeOriginal" -d "%Y/%Y-%m-%d" -r /mnt/backup/photorec_output/
   

Specialized recovery: fragmented camera MP4/MOV videos (GoPro, DJI Drones, Sony, Canon)¶

One of the most frequent frustrations after running PhotoRec or standard file recovery software on a formatted camera card is discovering that 100 percent of the recovered .JPG e .RAW photos open perfectly, but every single recovered .MP4 walla .MOV video file refuses to play (0:00 duration or black screen).

Why Standard Recovery Software Breaks Modern Camera Videos¶

1. Interleaved Stream Recording: Modern action cameras (GoPro Hero series, DJI Air/Mavic/Mini drones, Insta360) and cinema mirrorless cameras do not write a single .MP4 file sequentially from start to finish. While recording 4K or 5.3K video, the camera simultaneously writes a high-resolution .MP4 stream, a low-resolution preview .LRV stream, an audio buffer, and telemetry metadata into alternating clusters on the exFAT/FAT32 card (for example: 4 megabytes of high-res video, followed by 512 kilobytes of .LRV preview, followed by 4 megabytes of high-res video).
2. Missing moov Atom in Unfinalized Recordings: If your drone crashed into water, your camera battery died mid-recording, or the SD card disconnected before you pressed the Stop Record button, the camera never wrote the moov atom (the master index table written at the very end of an MP4/MOV file that tells media players where every video frame and audio chunk sits).

How to Rebuild Unplayable or Fragmented Camera Videos¶

1. Case A: Unfinalized Video After Battery Loss or Crash (File Exists on Card, Shows Multi-GB Size, Won't Play):
   • The clusters are intact in the file system, only the moov index header is missing.
   • Use the free, open-source tool untrunc (specifically the anthwlock/untrunc fork) or recover_mp4 (slydiman). Provide untrunc with one healthy, playable reference .MP4 recorded on that exact same camera with the exact same resolution and framerate settings, alongside your broken .MP4:

     untrunc reference_working_video.MP4 corrupted_unfinalized_video.MP4
     

   • untrunc reads the codec parameters (avcC/hvcC and audio track layouts) from the working reference video, scans the raw H.264/H.265/HEVC NAL units in your damaged file, and synthesizes a brand-new moov atom in seconds.
2. Case B: Formatted SD Card with Interleaved / Fragmented Video (GoPro, DJI, Sony, Canon):
   • Sabu kartal njuɓɓudi FAT/exFAT momtaama e sahaa mbayliigu, carver standard ina nannga... ftyp/mdat header of your 4K video and then blindly copies the .LRV preview clusters and thumbnail clusters right into the middle of your video file, corrupting every single second of footage.
   • Instead of standard carvers, scan your sdcard_raw_clone.img using a fragmentation-aware video reconstructor that recognizes camera-specific cluster allocation cadences, such as SanDisk RescuePRO Deluxe (which includes specific GoPro/drone fragmented video assembly algorithms), Klennet Carver, or Disk Drill 5+ (which includes a dedicated GoPro/DJI fragmented video signature reconstructor).

Smartphone photo deletion: iOS (iPhone) and Android hardware encryption realities¶

A common and dangerous misconception is that you can plug a modern iPhone or Android smartphone into a laptop via USB and run traditional disk carving software (like Recuva or PhotoRec) on the phone's internal storage.

Why Traditional Sector Carving Cannot Read Modern Phones¶

Every iPhone since the iPhone 3GS (and all current iOS devices) uses Data Protection (File-Based Encryption) powered by a dedicated hardware AES crypto engine between the flash storage and main system memory. Similarly, every Android device shipped since Android 7.0+ (and mandatory since Android 10) uses File-Based Encryption (FBE) backed by the hardware Keystore/Titan M/Knox chip.

On both platforms, every single individual photo and file on the internal storage is encrypted with its own unique per-file cryptographic key. When a file is permanently purged from the phone's file system, the phone does not even need to erase the multi-megabyte photo blocks; it immediately destroys the 256-bit per-file encryption key in the metadata table. Without that key, the raw NAND blocks contain cryptographically unbreakable random noise. Even top-tier government forensic labs cannot "carve" permanently deleted photos from the internal flash of a modern iPhone or Android once the per-file key is wiped.

The Actual Recovery Paths for Deleted Smartphone Photos¶

Because hardware encryption blocks raw carving, recovering deleted photos from an iPhone or Android relies on recovering copies before retention timers expire or extracting cached thumbnail databases:

1. Ƴeewto Albom "Momtuɗo ko ɓooyaani" mo On-Device ɗoon e ɗoon (Window balɗe 30):
   • iOS (iPhone / iPad): Uddit Fotooji -> ƴeeŋtu les haa Nafooje -> tappu Ko ɓooyaani ko momtaa (ina ɗaɓɓi ID yeeso / ID toɓɓere / Kod kuutorgal). Fotooje ina njokki ɗoo balɗe 30 hade mum en halkude key duumotooɗo.
   • Android (Fotooji Google / Galle Samsung): Uddit Fotooji Google -> Defterdu / Mooftirɗi -> Binndi / Bin (ina jogaa balɗe 60 so tawii ko reentaade, balɗe 30 so tawii ko kaɓirgal tan). Ƴeewto kadi Galle Samsung -> Menu (diidi tati) -> Batte (jogaaɗe balɗe 30), udditaa Fiilde Google walla app Fiilde am -> Balɗe, jogorɗo jogaade foldere balɗe 30 ceertunde.
2. So a momtii fotooji e "Mumtuɗi ko ɓooyaani" e iPhone, noddu ballal Apple ngam artirde iCloud e bannge serwer e nder sahaaji:
   • Huutortooɓe heewɓe nganndaa wonde hay caggal nde ɓuuɓ-ɗaa e junngo maa "Mumtu e denndaangal kaɓirɗe" / "Meere momtugol ko ɓooyaani" e nder Fotooji iCloud, serweeji backend Apple ina njogii buffer reentaade serwer momtuɗo soft-deleted ngam windo juutngo (ko ɓuri heewde haa balɗe 7 haa 14 deentletion).
   • Jokkondir e Ballal Apple ɗoon e ɗoon e telefoŋ walla yeewtere, naamndo-ɗaa haaldude e Wasiya mawɗo, naamndo-ɗaa ɓe yo ɓe uddit Recovery-Side Server Defterdu Fotooji iCloud e Konte maa Apple. Ɓe mbaawi heewde flip switch serwer dump ko ɓooyaani purged iCloud Photos njuumri e nder albom maa e nder hojomaaji 15.
3. Wartirde e kaɓirgol ɓooyngol ngol sinkronisaaka walla Backup nokkuure sifiraaɗo:
   • Trick Mode Aeroplane e iPad / Mac ɗiɗaɓo: So iPhone maa sinkroniima momtugol e iCloud, nanngu iPad maa walla MacBook maa ko adii nde jokkondirta e Wi-Fi (muumtu router Wi-Fi galle maa ngam ittude kaɓirgal doole ko adii so tawii iPad ina ɗaanii e dow taabal maa). Doole e iPad e nder isolation rajo timmuɗo, ƴettu fotooje gonɗe haa jooni ɗee e kaɓirgal USB walla AirDrop e kaɓirgal goɗɗal hade iPad heɓde yamiroore push momtugol iCloud.
   • Ƴeewto Backup iCloud vs. Fotooji iCloud: So tawii aɗa joginoo Fotooji iCloud OFF (Settings -> [Your Name] -> iCloud -> Photos -> Off), Roll Kamera maa ina tawee e nder Backup Kaɓirgal iCloud maa jamma. Aɗa waawi momtude iPhone ɓooyɗo (walla backup e sahaa gooto e restoraade iPhone maa jooni oo) e artirde Backup iCloud jamma oo gila ko adii nde momtu-ɗaa foto ngoo.
   • Ƴeewto Backups Finder nokkuure / iTunes e ordinateer maa walla Mac: Ƴeewto ~/Library/Application Support/MobileSync/Backup/ e dow macOS walla %APPDATA%\Apple Computer\MobileSync\Backup\ e dow Windows. Aɗa waawi ƴeewtaade e yaltinde fotooje e nder jokkorgal ɓooyngal tawa a winndaani e telefoŋaaji maa tawa aɗa huutoroo iMazing walla iBackup Viewer.
4. Ƴeewto kuutorɗe nokkuuje (WhatsApp, iMesaas, Telegaraam, Signal):
   • Did you ever text the deleted photo or video to a spouse, friend, or family group chat? Messaging apps store independent copies of media inside their own application sandboxes (Media/WhatsApp Images/Sent on Android, or inside chat attachments in iMessage). Even if you delete a photo from your main Camera Roll and empty the Trash, the copy inside your WhatsApp Sent foldere walla daartol jokkorgal iMessage ina heddii haa laaɓi cer.

Disko ruulde e ƴellitgol momtugol aksidaa gollordu (Disko Google, OneDrive, Dropbox)¶

So foldere renndinde fof majjii walla winndaama e dow disko ruulde (walla so ransomware walla glitch sinkronisaasiyoŋ momtii piille nokkuuje e sinkronisaasiyoŋ momtugol ngol e ruulde), ƴellitgol disko nokkuure ina heewi wonde ko aldaa e nafoore sabu laylayti ruulde enterprise e kuutortooɗo ina njogii daartol mbaydiiji keewɗi :

1. Mikrosoft OneDrive e SharePoint e Enternet:
   • Bin Recycle Daawal Gadanal (onedrive.live.com): Ina jogoo fiiluuji mumtaaɗi fotde balɗe 30 e konte neɗɗo e balɗe 93 e konte Golle/Duɗal.
   • Binnde lowre ɗiɗmere (Golle/Duɗal): Hay so golloowo walla hacker ina ustoo lowre OneDrive mawnde ndee, ɓuɗɗu e jokkorde les hello lowre ndee winndaande "Binnde lowre ɗiɗmere ina waawi huutoreede", ɗo purged the remainco remain the remainco Winnde balɗe 93.
   • Restore Your OneDrive (Point-in-Time Rollback): Microsoft 365 subscribers can click Settings (gear icon) -> Options -> Restore your OneDrive, which uses a visual histogram slider to roll every single file, rename, and deletion across the entire cloud drive back to any exact minute within the last 30 days.
2. Google Drive & Google Workspace:
   • Google Diisnondirɗo (drive.google.com/drive/trash): Ina jogoo piille mumtaaɗe fotde balɗe 30.
   • Rewtinnde lowre Google (Window moƴƴere balɗe 25): Hay caggal nde kuutortooɗo oo ɓuuɓtii "Mumtu haa abada" e ustude lowre mum Google Drive, lowre Google (walla kuutortooɗo gooto jokkondirɗo e Ballal Google Drive e konte Google One keertiiɗe) ina waawi o (so Go Conadmin.google.com)** -> Reggindo -> Huutortooɓe -> [Suɓo kuutortooɗo] -> Cuɓe goɗɗe -> Wartirde Dowlaaji, e wartirde piille Google Drive e mesasuuji Gmail laaɓtuɗi haa abada haa balɗe 25 ɓeydaaɗe caggal nde Trash oo ustaa.
3. Kaɓirgol:
   • Fiildeeji mumtaaɗi (dropbox.com/deleted_files): Ina jogoo piille e foldereeji mumtaaɗi fotde balɗe 30 e peeje Basic/Plus/Family, e balɗe 180 haa hitaande 1 e peeje Professionnel/Business.
   • Rewtin'de Dropbox (dropbox.com/rewind): Ina addana ruttaade caggal foldere ndee fof walla konte ɗee kala ngam ittude momtugol keewngol, jolngo-e-jolngo, walla kewuuji sifirgol.

Naamne keewɗe naamneede¶

Fuɗɗoode ƴeewtaama¶

• Duɗal ngenndiwal toppitiingal tolnooji e karallaagal (NIST, leyɗeele dentuɗe Amerik): Jaaynde keeriinde 800-88 ƴeewndo 1, Laabi ngam laaɓtinde jaayɗe (ATA TRIM, NVMe Deallocate, e jikkuuji layer firo NAND Flash) e jarribooji keertiiɗi kuutorɗe ordinateer (ICmaTT)csrc.nist.gov).
• Goomu kisal siber e kisal gollorɗe (CISA, Amerik): Reentaade doosɗe, reentaade ñaawoore, e laabi jokkondire (cisa.gov).
• Eɓɓoore GNU / Antonio Diaz Diaz (Hakkunde Leyɗeele): Laawɗunde Deftere drescue GNU: Kuutorgal ƴettugol dokke e Algoritmeeji fiilde kaɓirɗe (gnu.org/software/ddrescue).
• Kisal CG / Christophe Grenier (Hakkunde Leyɗeele): TestDisk & PhotoRec Binndanɗe laawɗuɗe: Ƴellitaare feccere e siynooji ƴettugol fiilngo (cgsecurity.org).
• Kisal Platform Apple (Dowlaaji Dentuɗi Amerik): FileVault, Kalaasuuji ndeenka domen, kuutorɗe sifirde kala fiilngo, e arsitektuur APFS Trim e dow Siistem Apple Silicon e T2 (support.apple.com/guide/security).
• Eɓɓoore Android udditiinde (AOSP, hakkunde leyɗeele): Sifirde tuugornde e fiilde (FBE) e Arsitektuur sifirde Metadata (source.android.com/docs/security/features/encryption).
• Fedde SD (Hakkunde Leyɗeele): Ceerno SD Feccere 1: Sifaa Layer Fisik (Yamiroore Mumtugol CMD32, CMD33, CMD38 e Switch Mekanik Winndude-Reende) (sdcard.org).

Ardiiɓe jokkondirɓe¶

• Hard drive ina ŋakki e ƴellitgol dokke
• Backups ordinateeruuji : peeje 3-2-1 e ƴellitgol musiiba
• Ranndooji e mborosaaji bonɗi
• Telefoŋ ɓuuɓɗo walla bonɗo e ndiyam
• Boot system Linux ina ŋakki e moƴƴitingol GRUB
• Ekran Windows (BSOD) e peewnugol bootooji