Náhodné vymazanie súboru, naformátovaná SD karta a obnovenie fotografií¶

Uvedomiť si, že ste práve naformátovali nesprávnu SD kartu fotoaparátu, vysypali kôš alebo kôš na externom pracovnom disku alebo omylom vymazali celý oddiel nenahraditeľných rodinných fotografií, je akútna technická kríza. Keď sa súbor vymaže alebo sa rýchlo naformátuje pamäťové médium, operačný systém len zriedka okamžite vymaže nespracované binárne dáta v pamäťových bunkách. Namiesto toho odstráni ukazovateľ adresára súborového systému a označí tieto adresy logických blokov ako "voľné miesto", ktoré je možné prepísať. Či obnovíte 100 percent svojich údajov alebo ich stratíte navždy, závisí výlučne od toho, čo sa stane počas prvých 60 sekúnd po vymazaní. Každú sekundu zostáva disk pripojený v režime čítania a zápisu, indexovanie operačného systému na pozadí, odkladacie súbory, vyrovnávacia pamäť prehliadača a rutiny zberu odpadu na disku Solid State Drive (SSD) (TRIM / UNMAP) môže trvalo vynulovať príslušné sektory.

Ak náhodné vymazanie alebo formátovanie zahŕňa lekársku telemetriu, právne dôkazy o aktívnom zločine alebo zlyhanie systému ochrany života, zavolajte na miestne tiesňové číslo (911 v Spojených štátoch a Kanade, 112 v celej Európskej únii, 999 v Spojenom kráľovstve) alebo si pozrite náš adresár medzinárodných tiesňové čísla before touching the hardware. For all consumer, photographic, academic, and enterprise data loss incidents, halt all disk activity immediately and follow the forensic recovery workflow below.

Urobte to teraz¶

1. Pull out the removable SD card, CFexpress card, or USB drive immediately: If you just formatted a camera memory card or deleted files on an external USB drive, turn off the camera power switch immediately or unplug the external USB cable from the computer. Do not take "one test photo" to see if the card works, and do not allow Windows (chkdsk) or macOS (fsck_apfs) to "scan and repair" the drive.
2. If you deleted files from your computer's internal system drive (C: drive or macOS Macintosh HD), yank the power or force an hard power-off: Do not close apps normally, do not download data recovery software onto the affected computer, and do not click "Shut Down" (which writes gigabytes of hibernation files, registry hives, and session logs over your deleted blocks). Hold the physical power button for 5 to 10 seconds until the machine powers off completely, or unplug the desktop power cord if it is a non-battery system.
3. Slide the physical write-protect switch on full-size SDHC/SDXC cards to the LOCK position: Look at the left edge of a standard 32 millimeter by 24 millimeter (1.26 inch by 0.94 inch) SD card and push the tiny plastic tab down toward the bottom edge (away from the gold contact pins) so no reader can accidentally write .DS_Store, System Volume Information, or Spotlight index files when you plug it in later.
4. Understand the SSD TRIM trap before powering an internal SSD back on: Modern NVMe and SATA Solid State Drives execute hardware-level TRIM (ATA) or Deallocate (NVMe) commands within seconds to minutes of file deletion or formatting. Once the SSD controller runs background garbage collection on trimmed pages, raw carving software will read only zeros (0x00). Keeping power off stops the internal SSD microprocessor from finishing background garbage collection.
5. Prepare a separate, clean secondary computer and a larger destination drive: Never install recovery tools onto the drive that lost data, and never restore recovered files back onto the same source drive during the scan. Use a second computer (or boot the affected PC from an external Ubuntu Linux Live USB flash drive) and attach a blank external hard drive with at least twice the storage capacity of the affected drive.
6. Create a sector-by-sector raw binary image (.img alebo .dd) before running any file recovery parser: Before running PhotoRec, R-Studio, DMDE, or UFS Explorer, use ddrescue or HDDSuperClone to clone every sector of the SD card or drive into a single image file on your backup drive. You can then run multiple recovery algorithms safely against the image file without ever risking further wear or accidental writes on the original media.

Decision tree: choosing the right recovery strategy by storage media and file system¶

Use this forensic triage flowchart to determine whether your deleted data can be recovered via logical file-table reconstruction, raw file signature carving, or specialized chip-off analysis:

flowchart TD
    A["Accidental File Deletion or Drive Format Detected"] --> B["Immediately Power Off Device or Eject Removable Media"]
    B --> C{"What type of physical storage hardware is affected?"}
    C -->|"Camera SD / MicroSD / CFexpress / USB Flash"| D["Engage Physical Write-Protect Switch or Use Read-Only USB Blocker"]
    C -->|"External or Internal Mechanical Hard Drive (HDD)"| E["No TRIM Risk: High Recovery Probability if Zero New Writes Occurred"]
    C -->|"Internal or External SSD / NVMe / Mac / Smartphone"| F{"What File System and OS Connection Was Used?"}
    F -->|"NTFS, APFS, or ext4 on Internal NVMe/SATA SSD"| G["High TRIM Risk: Boot via Linux Live USB with libata.force=noncqtrim"]
    F -->|"exFAT or FAT32 over Standard USB Mass Storage"| H["Moderate/Low TRIM Risk: Many USB Bridges Do Not Pass TRIM on exFAT"]
    F -->|"iOS / Android Internal Storage"| I["Hardware File-Based Encryption (FBE): Keys Destroyed on Deletion, Check Cloud/Local Backups Immediately"]
    D --> J["Create Full Bitstream Clone (.img) Using GNU ddrescue onto Separate Drive"]
    E --> J
    G --> J
    H --> J
    J --> K{"Were Files Deleted Individually or Was the Drive Formatted?"}
    K -->|"Individual Deletion / Quick Format (Metadata Intact)"| L["Run Logical Metadata Reconstruction (DMDE, R-Studio, UFS Explorer, TestDisk)"]
    K -->|"Overwritten File Table / Camera In-Body Format"| M["Run Raw File Signature Carving + Fragmented Video Rebuilder (PhotoRec, GoPro/MP4 Repair)"]

The physics of deletion: HDD magnetic platters vs. SSD NAND flash and Camera SD cards¶

To avoid destroying recoverable data, you must understand how different storage architectures handle deletion and formatting under the hood.

1. Mechanical Hard Disk Drives (HDD) and Shingled Magnetic Recording (SMR)¶

On a traditional conventional magnetic recording (CMR) spinning hard drive, deleting a file or running a "Quick Format" takes less than two seconds because the read/write heads only modify the master directory index, such as the $MFT (Master File Table) on NTFS, the Allocation Bitmap and Catalog B-Tree on HFS+/APFS, or the File Allocation Table on FAT32/exFAT. The actual magnetic flux reversals representing your JPEGs, PDFs, and spreadsheets remain untouched on the cobalt-alloy platters until the operating system chooses to write a brand-new file over those exact Logical Block Addresses (LBAs).

However, many modern high-capacity consumer external hard drives (typically 2 terabytes to 5 terabytes in 2.5-inch portable enclosures) use Shingled Magnetic Recording (SMR) alongside an internal firmware translation layer called a Media Cache. Some modern SMR hard drives actually support the TRIM command just like an SSD. If you delete a large folder on a TRIM-enabled SMR hard drive and leave it plugged in idle for 20 minutes, the drive's internal firmware may reorganize its shingled bands and permanently zero out the unallocated sectors in the background. Unplugging the drive immediately prevents this internal housekeeping cycle.

2. Solid State Drives (SSD), NVMe, and the TRIM / Deallocate Execution Window¶

NAND flash memory inside SSDs cannot overwrite existing data directly in place. Before a NAND flash cell can accept new data, an entire flash block (typically 4 megabytes to 16 megabytes in size) must first undergo a slow electrical Program/Erase (P/E) cycle. If the SSD waited until you saved a new file to erase old blocks, write speeds would plummet.

To keep SSDs fast, modern operating systems (Windows 7 through Windows 11, macOS 10.10+, and Linux kernels with fstrim alebo discard) send an immediate TRIM (SATA) or Dataset Management: Deallocate (NVMe) command to the SSD controller the moment you empty the Recycle Bin/Trash or execute a Quick Format:

1. Deterministic Read Zero after TRIM (DZAT / DRAT): Almost all modern consumer NVMe and SATA SSDs enforce Deterministic Zeroing after TRIM. The exact millisecond the SSD controller receives the TRIM command for a range of sectors, its internal Flash Translation Layer (FTL) unmaps those logical addresses from the physical NAND pages.
2. Immediate Zero Return: Even before the physical electrical charge is erased from the silicon cells, if any software (including ddrescue, PhotoRec, or R-Studio) asks the SSD to read those trimmed sectors via standard SATA or NVMe commands, the SSD controller intercepts the request and returns pure hexadecimal zeros (00 00 00 00) without even checking the physical NAND chips.
3. When SSD Recovery IS Still Possible:
   • External USB Enclosures without UASP/TRIM pass-through: Older USB 3.0 bridge chips using the legacy BOT (Bulk-Only Transport) protocol rather than UASP (USB Attached SCSI Protocol) cannot translate operating system TRIM commands across the USB cable.
   • FAT32 and exFAT Volumes on Certain OS Versions: Historically, several operating system builds only sent automatic real-time TRIM commands on native journaled file systems (NTFS, APFS, ext4) and did not issue immediate real-time TRIM on removable FAT32 alebo exFAT partitions.
   • Partition Table Wipe (diskpart clean or accidental partition deletion) without Formatting: Deleting a partition entry from the GUID Partition Table (GPT) or Master Boot Record (MBR) sometimes leaves the underlying sectors un-trimmed until a new file system is formatted on top of it.

3. Camera In-Body Formatting and the Sony / Canon / Nikon SD_ERASE Trap¶

Fotografi a kameramani často predpokladajú, že formátovanie karty SD, microSD alebo CFexpress v digitálnom fotoaparáte je totožné s „rýchlym formátovaním“ na stolnom počítači. Aj keď to platilo pred desiatimi rokmi, moderné bezzrkadlové fotoaparáty sa správajú veľmi odlišne v závislosti od výrobcu:

Phase 1: Immediate OS containment and blocking automatic writes¶

Before you try to recover files from an internal drive or attach an external drive to a computer, you must neutralize the operating system mechanisms that silently overwrite deleted space.

1. Recovering from an Internal Windows Drive (C: Drive)¶

If you deleted an important folder from your Windows Desktop, Documents, or Downloads folder and emptied the Recycle Bin:

1. Do NOT keep using Windows on that drive: Even leaving Windows sitting idle at the Desktop allows SearchIndexer.exe, kontroly na pozadí programu Windows Defender, aktualizácie vyrovnávacej pamäte prehliadača Chrome/Edge, rotácia tieňovej kópie zväzku a súbor stránky Windows (pagefile.sys) na zapisovanie stoviek megabajtov za minútu priamo cez vaše novo uvoľnené klastre.
2. Ak sa nemôžete okamžite vypnúť (napríklad na vzdialenej pracovnej stanici bez fyzického prístupu), vypnite ju TRIM okamžite cez príkazový riadok správcu:
   • Stlačte tlačidlo Win + X, kliknite na Terminál (správca) alebo Príkazový riadok (správca) a vykonajte:

     fsutil behavior set DisableDeleteNotify 1
     

   • This stops Windows from sending any further TRIM notifications for NTFS and ReFS volumes, though it cannot undo TRIM commands sent seconds earlier.
3. Check if a Volume Shadow Copy (Previous Versions) already exists before shutting down (takes 15 seconds):
   • Right-click the parent folder that held your deleted files, click Properties -> Previous Versions.
   • Or run vssadmin list shadows in an Administrator Command Prompt. If a shadow snapshot exists from earlier today or yesterday, you can mount that shadow copy read-only (mklink /d C:\ShadowRestore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\) and copy your intact files directly to an external USB thumb drive.
4. If no Shadow Copy exists, shut down hard and boot from a Linux Live USB: Create an Ubuntu or SystemRescue USB flash drive on a different computer, boot the affected PC from that USB drive in Try Ubuntu (Live RAM mode) without mounting the internal drive rw, and image or extract the files from outside Windows.

2. Recovering from a macOS System Drive (Apple Silicon M1/M2/M3/M4 & T2 Macs)¶

Modern Apple computers running macOS on APFS (Apple File System) present two strict architectural hurdles:

1. Aggressive APFS TRIM: macOS sends TRIM commands immediately upon emptying the Trash on internal Apple SSDs.
2. Hardware FileVault / Secure Enclave Encryption: On all Macs with an Apple T2 chip or Apple Silicon (M1, M2, M3, M4), the internal SSD is hardware-encrypted at rest by default using keys tied to the Secure Enclave, even if FileVault is turned "Off" in System Settings.
   • Immediate Check 1: Local Time Machine Snapshots (tmutil): Even if your external Time Machine backup drive was unplugged at the time of deletion, macOS automatically creates hidden hourly APFS Local Snapshots on the internal SSD if Time Machine is configured. Open Terminal immediately and run:

     tmutil listlocalsnapshots /
     

     If you see snapshots listed (such as com.apple.TimeMachine.2026-10-31-091522.local), open the folder where the file lived and launch the Time Machine app from Applications to restore the file in seconds.
   • Immediate Check 2: Cloud Sync Trash Bins (iCloud Drive, OneDrive, Dropbox, Google Drive): Because macOS Desktop and Documents folders are frequently synced to iCloud Drive, deleting a file from your Mac Desktop deletes it via iCloud sync rather than just locally. Open a browser on your phone or another PC, log into icloud.com -> Drive -> Recently Deleted (bottom right corner), where deleted files are retained for 30 days completely untouched by local SSD TRIM.

3. Blocking macOS and Windows from Polluting a Plugged-in SD Card or External Drive¶

When you plug a camera SD card or external USB drive into a computer to recover files, the host operating system immediately tries to write hidden metadata files onto the root of the drive (.DS_Store, .Spotlight-V100, .fseventsd, .Trashes on macOS; System Volume Information a $Recycle.Bin on Windows). Those tiny writes land right at the beginning of the free space bitmap, often corrupting the exact directory headers you are trying to recover.

• On Linux (Safest Forensic Method): Linux does not auto-write hidden index folders if you disable auto-mounting or mount the block device strictly read-only (ro,noload).
• On Windows (Enable Read-Only Disk Attribute via DiskPart BEFORE inserting the drive, or use Registry WriteBlocker):
  • Open regedit.exe as Administrator, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies (create the StorageDevicePolicies key if it does not exist), and create a DWORD (32-bit) value named WriteProtect set to 1. Plug in your USB card reader afterward, and Windows will treat all removable USB storage as hardware write-protected.
• On macOS (Mount via Disk Arbitrator): Download and launch the open-source utility Disk Arbitrator before plugging in your SD card reader or external drive. Nastavte Disk Arbitrator na Block Mounts alebo Mount Read-Only, aby macOS nemohol zapisovať .DS_Store alebo Spotlight indexuje poškodenú oblasť.

Fáza 2: Vytvorenie forenzného klonu sektor po sektore (ddrescue)¶

Nikdy nespúšťajte skenovanie obnovy súborov priamo na chybnom pevnom disku, opotrebovanej karte microSD alebo jedinej kópii naformátovaného oddielu. Vytvorenie nespracovaného súboru binárneho obrázka (.img alebo .dd) zaručuje, že budete mať zamrznutý, bit po bite snímku každého sektora tak, ako existoval v momente, keď ste odpojili disk.

Klonovanie krok za krokom pomocou GNU ddrescue (Linux / macOS) alebo HDDSuperClone¶

1. Identifikujte presný identifikátor zariadenia zdrojovej karty alebo disku:
   • V systéme Linux spustite lsblk -o NAME,SIZE,MODEL,RO,FSTYPE,MOUNTPOINT pred a po pripojení čítačky kariet. Predpokladajme, že vaša 64 gigabajtová (59,6 gibibajtová) karta SD fotoaparátu vyzerá ako /dev/sdc (uistite sa, že nie je namontovaný; ak je namontovaný, spustite ho sudo umount /dev/sdc1).
   • V systéme macOS spustite diskutil list nájsť číslo disku (napr. /dev/disk4), potom odpojte jeho zväzky bez vysunutia hardvéru: diskutil unmountDisk /dev/disk4.
2. Pripojte svoju veľkú cieľovú úložnú jednotku: Predpokladajme, že vaša externá 2 terabajtová zálohovacia jednotka je pripevnená /mnt/backup (alebo /Volumes/BackupDrive v systéme macOS). Overte si, či má dostatok voľného miesta na uloženie celej surovej kapacity zdrojového disku (64 gigabajtová SD karta produkuje 64 gigabajtov .img súbor, aj keď na ňom bolo len 10 gigabajtov fotografií).
3. Vykonať ddrescue s mapovým súborom (súborom denníka):

   sudo ddrescue -d -r3 /dev/sdc /mnt/backup/sdcard_raw_clone.img /mnt/backup/sdcard_rescue.map
   

   • -d používa priamy prístup na disk (obchádzanie vyrovnávacej pamäte jadra stránok operačného systému na presné čítanie sektorov; pri použití systému macOS /dev/rdisk4 namiesto toho -d).
   • -r3 hovorí ddrescue to copy all healthy sectors across the entire drive on the first fast pass, skip over any slow or damaged flash blocks immediately so the card does not overheat or lock up, and then retry bad sectors up to 3 times at the end.
   • sdcard_rescue.map ukladá váš presný postup každých pár sekúnd. If the USB reader disconnects or the power goes out, running the exact same command resumes seamlessly from where it stopped without re-reading already rescued sectors.
4. ** Vytvorte pracovnú kópiu alebo pripojte .img súbor len na čítanie**: Raz sdcard_raw_clone.img končí o 100.00% rescued, vyberte svoju fyzickú SD kartu a uložte ju do bezpečnej zásuvky. Vykonáte 100 percent svojej obnovovacej práce sdcard_raw_clone.img.

Fáza 3: Spustenie obnovy súborov (rekonštrukcia logických metadát vs. Raw Carving)¶

Keď už budete mať trezor .img súbor (alebo hardvérový disk zablokovaný proti zápisu), existujú dve úplne odlišné technické metódy na extrakciu odstránených údajov. Vždy by ste mali najskôr vyskúšať Metódu A (Rekonštrukcia logického systému súborov) a až potom sa vrátiť k Metóde B (Raw Signature Carving).

Krok za krokom 1: Obnovenie odstráneného oddielu alebo poškodeného zavádzacieho sektora s TestDisk¶

If your external drive or SD card suddenly asks "You need to format the disk in drive E: before you can use it" or shows up as RAW / Unallocated in Disk Management after being unplugged without safely ejecting, your files were not deleted at all. Namiesto toho hlavný zavádzací záznam (MBR), tabuľka oddielov GUID (GPT) alebo zavádzací sektor (BPB) bol poškodený.

1. Spustite TestDisk proti svojmu klonovanému súboru obrázka:

   testdisk /mnt/backup/sdcard_raw_clone.img
   

2. Vyberte Pokračovať -> potvrďte typ tabuľky oddielov (Intel/PC pre MBR SD karty pod 2 terabajty, príp EFI GPT pre moderné veľké disky).
3. Select Analyse -> Quick Search.
4. TestDisk will scan for backup partition headers (such as the automatic backup NTFS boot sector stored at the very last sector of an NTFS volume, or the backup FAT32 boot sector at sector 6).
5. Highlight the discovered partition and press P (List Files). If you immediately see all your folders and files listed intact inside the terminal window:
   • Do not even bother rewriting the partition table if you only want the files. Simply press C on the folders you want and copy them directly out to your healthy destination drive with 100 percent original filenames and folder structures.

Step-by-Step 2: Logical Metadata Scan Using DMDE, R-Studio, or UFS Explorer¶

When files were deleted via Shift + Delete, emptied from the Recycle Bin, or wiped via a standard Quick Format:

1. Open your .img file inside DMDE (free edition recovers up to 4,000 files per directory action; full license is inexpensive), R-Studio, or UFS Explorer Standard Recovery.
2. Check the Existing Virtual File System Tree First:
   • On NTFS drives, each file has a 1,024-byte (1 kilobyte) record in the Master File Table ($MFT). Even when a file is deleted, its $MFT slot remains marked with an inactive flag (0x00 namiesto toho 0x01) containing the exact filename, parent directory ID, and exact starting cluster and length runs, until a new file reuses that $MFT slot. Furthermore, files smaller than ~700 bytes (such as brief text notes, crypto keys, or small scripts) are stored resident entirely inside the $MFT record itself and rarely get overwritten quickly.
   • Look in the $Root or Deleted / Found virtual folder generated within the first 5 seconds of opening the partition. If your files appear with a red x or trash icon and show a healthy size, select them and click Recover to your separate destination drive immediately.
3. Run a Full Volume Scan if the Directory Header Was Overwritten:
   • If a Quick Format overwrote the root directory or the first few megabytes of the $MFT, run a Full Volume Scan. The software will scan the entire image for surviving subdirectory index nodes (INDX buffers on NTFS, subdirectory cluster chains on FAT32/exFAT, or older transaction checkpoints on APFS/ext4) and combine logical metadata with raw file signature detection.

Step-by-Step 3: Raw File Carving with PhotoRec (When Metadata Is Completely Destroyed)¶

When the File Allocation Table (FAT) or $MFT has been completely zeroed out by a format, logical directory pointers are gone, leaving only the raw file contents sitting in unallocated data clusters. PhotoRec (bundled alongside TestDisk, completely free, open-source, and available for Windows, macOS, and Linux) excels at carving over 480 file formats (including Canon .CR2/.CR3, Sony .ARW, Nikon .NEF, Adobe .DNG/.PSD, .JPG, .PNG, .PDF, .DOCX/.XLSX zip containers, and .SQLITE databases):

1. Launch PhotoRec against your disk image:

   photorec /mnt/backup/sdcard_raw_clone.img
   

2. Select the target partition (or Whole disk if the partition table was wiped).
3. Before starting, go to [File Opt] at the bottom of the screen:
   • Stlačte tlačidlo s to deselect all 480 file types if you only care about specific files (for example, check only jpg, cr2/cr3, tif for raw photos, mov/mp4, a zip/docx), which drastically speeds up recovery and prevents false-positive garbage fragments.
4. Select [Options] -> keep Keep corrupted files : No unless recovering damaged video streams.
5. Select [Search], choose file system type [Other] (for FAT/exFAT/NTFS/HFS+), and select [Free] (if you only deleted files on an active partition) or [Whole] (if the partition was formatted).
6. Choose a destination folder on your separate large backup drive and press C to begin carving.
7. Post-Recovery Sorting for PhotoRec Output: Because PhotoRec saves files as f123456.jpg across dozens of recup_dir folders, you can automatically reorganize all recovered photos into clean YYYY/MM-Month/ folders with their exact camera timestamp filenames using the free command-line tool ExifTool:

   exiftool "-Directory<DateTimeOriginal" -d "%Y/%Y-%m-%d" -r /mnt/backup/photorec_output/
   

Specialized recovery: fragmented camera MP4/MOV videos (GoPro, DJI Drones, Sony, Canon)¶

One of the most frequent frustrations after running PhotoRec or standard file recovery software on a formatted camera card is discovering that 100 percent of the recovered .JPG a .RAW photos open perfectly, but every single recovered .MP4 alebo .MOV video file refuses to play (0:00 duration or black screen).

Why Standard Recovery Software Breaks Modern Camera Videos¶

1. Interleaved Stream Recording: Modern action cameras (GoPro Hero series, DJI Air/Mavic/Mini drones, Insta360) and cinema mirrorless cameras do not write a single .MP4 file sequentially from start to finish. While recording 4K or 5.3K video, the camera simultaneously writes a high-resolution .MP4 stream, a low-resolution preview .LRV stream, an audio buffer, and telemetry metadata into alternating clusters on the exFAT/FAT32 card (for example: 4 megabytes of high-res video, followed by 512 kilobytes of .LRV preview, followed by 4 megabytes of high-res video).
2. Missing moov Atom in Unfinalized Recordings: If your drone crashed into water, your camera battery died mid-recording, or the SD card disconnected before you pressed the Stop Record button, the camera never wrote the moov atom (the master index table written at the very end of an MP4/MOV file that tells media players where every video frame and audio chunk sits).

How to Rebuild Unplayable or Fragmented Camera Videos¶

1. Case A: Unfinalized Video After Battery Loss or Crash (File Exists on Card, Shows Multi-GB Size, Won't Play):
   • The clusters are intact in the file system, only the moov index header is missing.
   • Use the free, open-source tool untrunc (specifically the anthwlock/untrunc fork) or recover_mp4 (slydiman). Provide untrunc with one healthy, playable reference .MP4 recorded on that exact same camera with the exact same resolution and framerate settings, alongside your broken .MP4:

     untrunc reference_working_video.MP4 corrupted_unfinalized_video.MP4
     

   • untrunc reads the codec parameters (avcC/hvcC and audio track layouts) from the working reference video, scans the raw H.264/H.265/HEVC NAL units in your damaged file, and synthesizes a brand-new moov atom in seconds.
2. Case B: Formatted SD Card with Interleaved / Fragmented Video (GoPro, DJI, Sony, Canon):
   • Because the FAT/exFAT cluster map was wiped during formatting, a standard carver grabs the ftyp/mdat hlavičku vášho 4K videa a potom slepo skopíruje .LRV preview clusters and thumbnail clusters right into the middle of your video file, corrupting every single second of footage.
   • Namiesto štandardných rezbárov naskenujte svoje sdcard_raw_clone.img pomocou rekonštruktora videa s ohľadom na fragmentáciu, ktorý rozpoznáva kadenciu prideľovania klastrov špecifickú pre kameru, ako napríklad SanDisk RescuePRO Deluxe (ktorý zahŕňa špecifické algoritmy na zostavenie fragmentovaného videa GoPro/drone), Klennet Carver alebo Disk Drill 5+ (ktorý obsahuje vyhradený fragmentovaný video podpis GoPro/DJI).

Odstránenie fotografií zo smartfónu: realita hardvérového šifrovania pre iOS (iPhone) a Android¶

A common and dangerous misconception is that you can plug a modern iPhone or Android smartphone into a laptop via USB and run traditional disk carving software (like Recuva or PhotoRec) on the phone's internal storage.

Why Traditional Sector Carving Cannot Read Modern Phones¶

Every iPhone since the iPhone 3GS (and all current iOS devices) uses Data Protection (File-Based Encryption) powered by a dedicated hardware AES crypto engine between the flash storage and main system memory. Similarly, every Android device shipped since Android 7.0+ (and mandatory since Android 10) uses File-Based Encryption (FBE) backed by the hardware Keystore/Titan M/Knox chip.

On both platforms, every single individual photo and file on the internal storage is encrypted with its own unique per-file cryptographic key. When a file is permanently purged from the phone's file system, the phone does not even need to erase the multi-megabyte photo blocks; it immediately destroys the 256-bit per-file encryption key in the metadata table. Without that key, the raw NAND blocks contain cryptographically unbreakable random noise. Even top-tier government forensic labs cannot "carve" permanently deleted photos from the internal flash of a modern iPhone or Android once the per-file key is wiped.

The Actual Recovery Paths for Deleted Smartphone Photos¶

Because hardware encryption blocks raw carving, recovering deleted photos from an iPhone or Android relies on recovering copies before retention timers expire or extracting cached thumbnail databases:

1. Check the On-Device "Recently Deleted" Album Immediately (30-Day Window):
   • iOS (iPhone / iPad): Open Photos -> scroll down to Utilities -> tap Recently Deleted (requires Face ID / Touch ID / Passcode). Photos stay here for 30 days before permanent key destruction.
   • Android (Google Photos / Samsung Gallery): Open Google Photos -> Library / Collections -> Trash / Bin (retained for 60 days if backed up, 30 days if device-only). Also check Samsung Gallery -> Menu (three lines) -> Trash (retained for 30 days), and open the Files by Google or My Files app -> Trash, which maintains a separate 30-day trash folder.
2. If You Deleted Photos from "Recently Deleted" on iPhone, Call Apple Support for an Emergency iCloud Server-Side Restore:
   • Many users do not realize that even after you manually click "Delete from All Devices" / "Empty Recently Deleted" in iCloud Photos, Apple's backend servers retain a soft-deleted server recovery buffer for a brief window (typically up to 7 to 14 days after permanent deletion).
   • Contact Apple Support immediately by phone or chat, ask to speak with a Senior Advisor, and ask them to trigger an iCloud Photo Library Server-Side Recovery on your Apple Account. They can frequently flip a server switch that dumps recently purged iCloud Photos right back into your album within 15 minutes.
3. Restore from an Older Unsynced Device or Encrypted Local Backup:
   • Airplane Mode Trick on Secondary iPad / Mac: If your iPhone synced a deletion to iCloud, grab your iPad or MacBook before it connects to Wi-Fi (turn off your home Wi-Fi router unplugging the power cord first if the iPad is asleep on your desk). Power on the iPad in total radio isolation, copy the still-present photos via USB cable or AirDrop to another device before the iPad receives the iCloud deletion push command.
   • Check iCloud Backup vs. iCloud Photos: If you had iCloud Photos turned OFF (Settings -> [Your Name] -> iCloud -> Photos -> Off), your Camera Roll is included inside your nightly iCloud Device Backup. You can wipe an old spare iPhone (or temporarily back up and reset your current iPhone) and restore the nightly iCloud Backup from before the moment you deleted the photo.
   • Check Local Finder / iTunes Backups on Your PC or Mac: Check ~/Library/Application Support/MobileSync/Backup/ on macOS or %APPDATA%\Apple Computer\MobileSync\Backup\ on Windows. You can browse and extract photos from old local backups without overwriting your phone using iMazing or iBackup Viewer.
4. Check Messaging App Local Caches (WhatsApp, iMessage, Telegram, Signal):
   • Did you ever text the deleted photo or video to a spouse, friend, or family group chat? Messaging apps store independent copies of media inside their own application sandboxes (Media/WhatsApp Images/Sent on Android, or inside chat attachments in iMessage). Even if you delete a photo from your main Camera Roll and empty the Trash, the copy inside your WhatsApp Sent folder or iMessage thread history remains completely untouched.

Cloud drive and enterprise accidental deletion recovery (Google Drive, OneDrive, Dropbox)¶

When an entire shared folder disappears or is overwritten on a cloud drive (or when ransomware or a syncing glitch deletes local files and syncs the deletion to the cloud), local disk recovery is often unnecessary because enterprise and consumer cloud platforms maintain multi-tier version histories:

1. Microsoft OneDrive & SharePoint Online:
   • First-Stage Recycle Bin (onedrive.live.com): Retains deleted files for 30 days on personal accounts and 93 days on Work/School accounts.
   • Second-Stage Site Collection Recycle Bin (Work/School): Even if an employee or hacker empties the main OneDrive Recycle Bin, click the link at the bottom of the Recycle Bin page labeled "Second-stage recycle bin", where purged files remain recoverable for the remainder of the 93-day window.
   • Restore Your OneDrive (Point-in-Time Rollback): Microsoft 365 subscribers can click Settings (gear icon) -> Options -> Restore your OneDrive, which uses a visual histogram slider to roll every single file, rename, and deletion across the entire cloud drive back to any exact minute within the last 30 days.
2. Google Drive & Google Workspace:
   • Google Drive Trash (drive.google.com/drive/trash): Uchováva odstránené súbory 30 dní.
   • Obnova správcu služby Google Workspace po odstránení koša (25-dňové obdobie odkladu): Aj keď používateľ klikne na „Navždy odstrániť“ a vyprázdni svoj kôš na Disku Google, správca služby Google Workspace (alebo jednotlivý používateľ kontaktujúci Podporu Disku Google v osobných účtoch Google One) môže otvoriť Správcovskú konzolu Google (admin.google.com) -> Adresár -> Používatelia -> [Vybrať používateľa] -> Ďalšie možnosti -> Obnoviť údaje a obnoviť natrvalo vyčistené súbory na Disku Google a správy Gmail až na 25 ďalších dní po vyprázdnení koša.
3. Dropbox:
   • Vymazané súbory (dropbox.com/deleted_files): Uchováva vymazané súbory a priečinky 30 dní v prípade plánov Basic/Plus/Rodina a 180 dní až 1 rok v prípade plánov Professional/Business.
   • Dropbox Rewind (dropbox.com/rewind): Umožňuje vrátiť späť celý priečinok alebo celý účet a vrátiť tak hromadné vymazania, náhodné presunutia myšou alebo udalosti šifrovania.

Často kladené otázky¶

Zdroje skontrolované¶

• (csrc.nist.gov).
• Agentúra pre kybernetickú bezpečnosť a bezpečnosť infraštruktúry (CISA, Spojené štáty americké): Zálohovanie údajov, forenzné uchovávanie a pokyny na riešenie incidentov (cisa.gov).
• Projekt GNU / Antonio Diaz Diaz (medzinárodné): Oficiálny GNU ddrescue Manual: Nástroj na obnovu dát a algoritmy blokových mapových súborov zariadení (gnu.org/software/ddrescue).
• CGSecurity / Christophe Grenier (International): Oficiálna dokumentácia TestDisk & PhotoRec: Obnova oddielu a podpisy na vyrezávanie súborov (cgsecurity.org).
• Apple Platform Security (Spojené štáty americké): FileVault, triedy ochrany údajov, šifrovacie kľúče pre jednotlivé súbory a architektúra APFS Trim Architecture na systémoch Apple Silicon a T2 (support.apple.com/guide/security).
• Android Open Source Project (AOSP, International): File-Based Encryption (FBE) a Metadata Encryption Architecture (source.android.com/docs/security/features/encryption).
• Pridruženie SD (medzinárodné): Špecifikácie SD Časť 1: Zjednodušená špecifikácia fyzickej vrstvy (príkazy vymazania CMD32, CMD33, CMD38 a mechanický spínač ochrany proti zápisu) (sdcard.org).

Súvisiaci sprievodcovia¶

• Porucha pevného disku a obnova dát
• Počítačové zálohy: stratégia 3-2-1 a obnova po havárii
• Ransomvér a malvér
• Rozbitý alebo vodou poškodený telefón
• Zlyhanie zavádzania systému Linux a oprava GRUB
• Modrá obrazovka systému Windows (BSOD) a oprava zavádzania