Fa'afuase'i le tapeina o faila, fa'atulagaina le SD card, ma le toe fa'aleleia o ata¶

O le iloaina ua na'o lou fa'atulagaina o le SD card pu'epue sese, fa'amama le Recycle Bin po'o Lapisi i luga o se ta'avale galuega i fafo, po'o le soloia fa'afuase'i o se vaeluaga atoa o ata aiga e le mafai ona suia o se fa'alavelave fa'apitoa fa'apitoa. Pe a tape se faila po'o se mea e teu ai ua vave fa'atulagaina, e seasea ona tapeina e le faiga fa'agaoioi le fa'amaumauga fa'atasi mata i totonu o sela manatua i le taimi lava lena. Nai lo lena, e aveese le fa'ailoga o le fa'atonuga o faila ma fa'ailoga ia tuatusi poloka fa'atatau o le "avanoa avanoa" avanoa e fa'asolo. Pe e te toe maua le 100 pasene o au faʻamatalaga pe leiloa e faʻavavau e faʻalagolago atoa i le mea e tupu ile 60 sekone muamua pe a uma ona tape. O sekone ta'itasi e fa'apipi'i pea le ta'avale i le faiga faitau-tusi, fa'asologa o fa'asinomaga fa'agaioiga, fela'ua'iga faila, fa'amaumauga o su'esu'ega, ma faiga masani o le aoina o lapisi (SSD) Solid State Drive (SSD).TRIM / UNMAP) e mafai ona fa'ato'a fa'ate'aina vaega fa'avae.

If the accidental deletion or formatting involves medical telemetry, legal evidence in an active crime, or a life-safety system failure, call your local emergency number (911 i le Iunaite Setete ma Kanata, 112 i totonu o le Iuni a Europa, 999 i Peretania) pe faʻafesoʻotaʻi la matou lisi o faʻasalalauga faavaomalo numera fa'afuase'i a'o le'i pa'i i meafaigaluega. Mo fa'aletonu uma o fa'amatalaga a tagata fa'atau, ata, a'oga, ma atina'e, tu'u uma fa'agaioiga tisiki ma mulimuli i le fa'asologa o galuega toe fa'afo'i fa'afoma'i i lalo.

Fai nei loa¶

1. Pull out the removable SD card, CFexpress card, or USB drive immediately: If you just formatted a camera memory card or deleted files on an external USB drive, turn off the camera power switch immediately or unplug the external USB cable from the computer. Do not take "one test photo" to see if the card works, and do not allow Windows (chkdsk) or macOS (fsck_apfs) to "scan and repair" the drive.
2. If you deleted files from your computer's internal system drive (C: drive or macOS Macintosh HD), yank the power or force an hard power-off: Do not close apps normally, do not download data recovery software onto the affected computer, and do not click "Shut Down" (which writes gigabytes of hibernation files, registry hives, and session logs over your deleted blocks). Hold the physical power button for 5 to 10 seconds until the machine powers off completely, or unplug the desktop power cord if it is a non-battery system.
3. Slide the physical write-protect switch on full-size SDHC/SDXC cards to the LOCK position: Look at the left edge of a standard 32 millimeter by 24 millimeter (1.26 inch by 0.94 inch) SD card and push the tiny plastic tab down toward the bottom edge (away from the gold contact pins) so no reader can accidentally write .DS_Store, System Volume Information, or Spotlight index files when you plug it in later.
4. Understand the SSD TRIM trap before powering an internal SSD back on: Modern NVMe and SATA Solid State Drives execute hardware-level TRIM (ATA) or Deallocate (NVMe) commands within seconds to minutes of file deletion or formatting. Once the SSD controller runs background garbage collection on trimmed pages, raw carving software will read only zeros (0x00). Keeping power off stops the internal SSD microprocessor from finishing background garbage collection.
5. Prepare a separate, clean secondary computer and a larger destination drive: Never install recovery tools onto the drive that lost data, and never restore recovered files back onto the same source drive during the scan. Use a second computer (or boot the affected PC from an external Ubuntu Linux Live USB flash drive) and attach a blank external hard drive with at least twice the storage capacity of the affected drive.
6. Create a sector-by-sector raw binary image (.img pe .dd) before running any file recovery parser: Before running PhotoRec, R-Studio, DMDE, or UFS Explorer, use ddrescue or HDDSuperClone to clone every sector of the SD card or drive into a single image file on your backup drive. You can then run multiple recovery algorithms safely against the image file without ever risking further wear or accidental writes on the original media.

Decision tree: choosing the right recovery strategy by storage media and file system¶

Use this forensic triage flowchart to determine whether your deleted data can be recovered via logical file-table reconstruction, raw file signature carving, or specialized chip-off analysis:

flowchart TD
    A["Accidental File Deletion or Drive Format Detected"] --> B["Immediately Power Off Device or Eject Removable Media"]
    B --> C{"What type of physical storage hardware is affected?"}
    C -->|"Camera SD / MicroSD / CFexpress / USB Flash"| D["Engage Physical Write-Protect Switch or Use Read-Only USB Blocker"]
    C -->|"External or Internal Mechanical Hard Drive (HDD)"| E["No TRIM Risk: High Recovery Probability if Zero New Writes Occurred"]
    C -->|"Internal or External SSD / NVMe / Mac / Smartphone"| F{"What File System and OS Connection Was Used?"}
    F -->|"NTFS, APFS, or ext4 on Internal NVMe/SATA SSD"| G["High TRIM Risk: Boot via Linux Live USB with libata.force=noncqtrim"]
    F -->|"exFAT or FAT32 over Standard USB Mass Storage"| H["Moderate/Low TRIM Risk: Many USB Bridges Do Not Pass TRIM on exFAT"]
    F -->|"iOS / Android Internal Storage"| I["Hardware File-Based Encryption (FBE): Keys Destroyed on Deletion, Check Cloud/Local Backups Immediately"]
    D --> J["Create Full Bitstream Clone (.img) Using GNU ddrescue onto Separate Drive"]
    E --> J
    G --> J
    H --> J
    J --> K{"Were Files Deleted Individually or Was the Drive Formatted?"}
    K -->|"Individual Deletion / Quick Format (Metadata Intact)"| L["Run Logical Metadata Reconstruction (DMDE, R-Studio, UFS Explorer, TestDisk)"]
    K -->|"Overwritten File Table / Camera In-Body Format"| M["Run Raw File Signature Carving + Fragmented Video Rebuilder (PhotoRec, GoPro/MP4 Repair)"]

The physics of deletion: HDD magnetic platters vs. SSD NAND flash and Camera SD cards¶

To avoid destroying recoverable data, you must understand how different storage architectures handle deletion and formatting under the hood.

1. Mechanical Hard Disk Drives (HDD) and Shingled Magnetic Recording (SMR)¶

On a traditional conventional magnetic recording (CMR) spinning hard drive, deleting a file or running a "Quick Format" takes less than two seconds because the read/write heads only modify the master directory index, such as the $MFT (Master File Table) on NTFS, the Allocation Bitmap and Catalog B-Tree on HFS+/APFS, or the File Allocation Table on FAT32/exFAT. The actual magnetic flux reversals representing your JPEGs, PDFs, and spreadsheets remain untouched on the cobalt-alloy platters until the operating system chooses to write a brand-new file over those exact Logical Block Addresses (LBAs).

However, many modern high-capacity consumer external hard drives (typically 2 terabytes to 5 terabytes in 2.5-inch portable enclosures) use Shingled Magnetic Recording (SMR) alongside an internal firmware translation layer called a Media Cache. Some modern SMR hard drives actually support the TRIM command just like an SSD. If you delete a large folder on a TRIM-enabled SMR hard drive and leave it plugged in idle for 20 minutes, the drive's internal firmware may reorganize its shingled bands and permanently zero out the unallocated sectors in the background. Unplugging the drive immediately prevents this internal housekeeping cycle.

2. Solid State Drives (SSD), NVMe, and the TRIM / Deallocate Execution Window¶

NAND flash memory inside SSDs cannot overwrite existing data directly in place. Before a NAND flash cell can accept new data, an entire flash block (typically 4 megabytes to 16 megabytes in size) must first undergo a slow electrical Program/Erase (P/E) cycle. If the SSD waited until you saved a new file to erase old blocks, write speeds would plummet.

To keep SSDs fast, modern operating systems (Windows 7 through Windows 11, macOS 10.10+, and Linux kernels with fstrim pe discard) send an immediate TRIM (SATA) or Dataset Management: Deallocate (NVMe) command to the SSD controller the moment you empty the Recycle Bin/Trash or execute a Quick Format:

1. Deterministic Read Zero after TRIM (DZAT / DRAT): Almost all modern consumer NVMe and SATA SSDs enforce Deterministic Zeroing after TRIM. The exact millisecond the SSD controller receives the TRIM command for a range of sectors, its internal Flash Translation Layer (FTL) unmaps those logical addresses from the physical NAND pages.
2. Immediate Zero Return: Even before the physical electrical charge is erased from the silicon cells, if any software (including ddrescue, PhotoRec, or R-Studio) asks the SSD to read those trimmed sectors via standard SATA or NVMe commands, the SSD controller intercepts the request and returns pure hexadecimal zeros (00 00 00 00) without even checking the physical NAND chips.
3. When SSD Recovery IS Still Possible:
   • External USB Enclosures without UASP/TRIM pass-through: Older USB 3.0 bridge chips using the legacy BOT (Bulk-Only Transport) protocol rather than UASP (USB Attached SCSI Protocol) cannot translate operating system TRIM commands across the USB cable.
   • FAT32 and exFAT Volumes on Certain OS Versions: Historically, several operating system builds only sent automatic real-time TRIM commands on native journaled file systems (NTFS, APFS, ext4) and did not issue immediate real-time TRIM on removable FAT32 pe exFAT partitions.
   • Partition Table Wipe (diskpart clean or accidental partition deletion) without Formatting: Deleting a partition entry from the GUID Partition Table (GPT) or Master Boot Record (MBR) sometimes leaves the underlying sectors un-trimmed until a new file system is formatted on top of it.

3. Camera In-Body Formatting and the Sony / Canon / Nikon SD_ERASE Trap¶

Photographers and videographers frequently assume that formatting an SD, microSD, or CFexpress card inside a digital camera is identical to a "Quick Format" on a desktop computer. While that was true ten years ago, modern mirrorless cameras behave very differently depending on the manufacturer:

Vaega 1: Fa'atonu OS fa'apipi'i ma poloka otometi tusitusi¶

Ae e te leʻi taumafai e toe faʻaleleia faila mai se taʻavale i totonu pe faʻapipiʻi se taʻavale fafo i se komepiuta, e tatau ona e faʻaitiitia le faʻaogaina o faiga faʻaoga e faʻamalo lemu ai le avanoa.

1. Toe fa'aleleia mai le Pupuni Pupuni Tutotonu (C: Drive)¶

Afai na e tapeina se faila taua mai lau Windows Desktop, Documents, poʻo le Downloads folder ma sasaa le Recycle Bin:

1. AUA LE fa'aogaina pea le Windows i luga o lena ta'avale: E o'o lava i le tu'u ai o Windows e nofonofo vale i le Desktop e mafai SearchIndexer.exe, Su'esu'ega i tua o le Windows Defender, fa'afouga fa'afouga o Chrome/Edge, suiga o le Volume Shadow Copy, ma le Windows Pagefile (pagefile.sys) e tusi le faitau selau o megabytes i le minute saʻo i luga o au fuifui fou faʻasaʻoloto.
2. Afai e le mafai ona e tape vave (fa'ata'ita'iga, i luga o se fale faigaluega mamao e leai se avanoa fa'aletino), tape TRIM vave e ala i le Administrator Command Prompt:
   • Tusitala Win + X, kiliki Terminal (Admin) poʻo le Command Prompt (Admin), ma faʻatino:

     fsutil behavior set DisableDeleteNotify 1
     

   • O lea e taofia ai Windows mai le auina atu o se isi isi TRIM fa'amatalaga mo voluma NTFS ma ReFS, e ui e le mafai ona fa'aleaogaina TRIM poloaiga na auina atu i sekone na muamua atu.
3. Siaki pe o se Volume Shadow Kopi (Previous Versions) ua iai a'o le'i tapuni (e 15 sekone):
   • Kiliki-matau le faila matua sa i ai au faila ua tapeina, kiliki Properties -> Previous Versions.
   • Po o le tamoe vssadmin list shadows i totonu o le Administrator Command Prompt. Afai ei ai se ata ata mai le taimi muamua i aso nei poʻo ananafi, e mafai ona e faʻapipiʻi lena ata ata kopi faitau-naʻo (mklink /d C:\ShadowRestore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\) ma kopi sa'o au faila faila i se pusi limamatua USB fafo.
4. ** Afai e leai se Shadow Copy o iai, tapuni malosi ma taʻavale mai le Linux Live USB *: Fausia se Ubuntu poʻo SystemRescue USB flash drive i luga o se isi * komepiuta, faʻamalo le PC afaina mai lena USB drive i ** Taumafai Ubuntu (Live RAM mode) e aunoa ma le faʻapipiʻiina o le internal drive rw, ma ata pe aveese faila mai fafo o Windows.

2. Toe fa'aleleia mai le MacOS System Drive (Apple Silicon M1/M2/M3/M4 & T2 Macs)¶

O komipiuta fa'aonaponei a Apple o lo'o fa'aogaina macOS i le APFS (Apple File System) o lo'o tu'uina mai ai ni fa'alavelave fa'apitoa e lua:

1. Aggressive APFS TRIM: macOS auina atu TRIM fa'atonu vave pe a sasaa le lapisi i totonu ole Apple SSDs.
2. ** Meafaigaluega FileVault / Secure Enclave Encryption**: I Mac uma e iai le Apple T2 chip poʻo le Apple Silicon (M1, M2, M3, M4), o le SSD i totonu o loʻo faʻapipiʻiina meafaigaluega i le malologa e ala i le faʻaogaina o ki o loʻo nonoa i le Secure Enclave, tusa lava pe ua "Off" FileVault i Faiga Faʻatonu.
   • ** Vave Siaki 1: Fa'alotoifale Time Machine Snapshots (tmutil)**: E tusa lava pe le'i fa'apipi'iina lau masini faaleoleo Time Machine i le taimi o le tapeina, e otometi lava ona faia e macOS natia itula ta'i itula APFS Local Snapshots i luga o le SSD i totonu pe a fa'atulaga le Time Machine. Tatala vave le Terminal ma tamoe:

     tmutil listlocalsnapshots /
     

     Afai e te vaʻaia ata o loʻo lisiina (pei o com.apple.TimeMachine.2026-10-31-091522.local), tatala le faila lea na nofo ai le faila ma faʻalauiloa le ** Time Machine ** app mai Talosaga e toe faʻafoʻi le faila i sekone.
   • ** Vave Siaki 2: Cloud Sync Trash Bins (iCloud Drive, OneDrive, Dropbox, Google Drive)**: Ona o le macOS Desktop ma Documents folders e masani ona faamaopoopo i le iCloud Drive, o le tapeina o se faila mai lau Mac Desktop e tapeina ai e ala i iCloud sync nai lo na o le lotoifale. Tatala se su'esu'ega i lau telefoni po'o se isi PC, ulufale i totonu icloud.com -> Drive -> Tau'a'i Aveesea (pito i lalo taumatau), lea e tape ai faila mo 30 aso e le'i pa'i uma e SSD i le lotoifale TRIM.

3. Puipuia le macOS ma le Windows mai le Fa'aleagaina o se Pepa SD Card po'o le Ta'avale i fafo¶

A e faʻapipiʻi se meapue SD card poʻo fafo USB drive i totonu o se komepiuta e toe faʻaleleia ai faila, o le polokalama faʻaoga talimalo e taumafai vave e tusi faila metadata natia i luga o le aʻa o le taavale (.DS_Store, .Spotlight-V100, .fseventsd, .Trashes i macOS; System Volume Information ma $Recycle.Bin luga o Windows). O na tama'i tusi tusitusi fanua sa'o i le amataga o le avanoa avanoa bitmap, e masani ona fa'aleagaina ai ulutala fa'atonu tonu o lo'o e taumafai e toe fa'aleleia.

• I luga ole Linux (Metotia Fa'asinomaga Saogalemu): E le otometi ona tusia e Linux ni fa'ailoga fa'ailoga natia pe afai e te fa'amalo le fa'apipi'iina o le ta'avale po'o le fa'apipi'iina o le masini poloka na'o le faitau-na'o (ro,noload).
• ** I luga o le Pupuni (Ia mafai ona faitau na'o le uiga o le Disk e ala i le DiskPart A'O LE'I fa'aofiina le ta'avale, po'o le fa'aoga le Registry WriteBlocker)**:
  • Tatala regedit.exe as Administrator, fa'afeiloa'i i HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies (faia le StorageDevicePolicies ki pe afai e le o iai), ma fatuina se DWORD (32-bit) taua ua faaigoaina WriteProtect seti i 1. Fa'afeso'ota'i lau faitau card USB mulimuli ane, ma o le a fa'aogaina e Windows uma le teuina o USB e mafai ona aveese e pei o meafaigaluega e puipuia tusitusi.
• I macOS (Mauga e ala i le Disk Arbitrator): La'u mai ma fa'alauiloa le fa'aogaina o le fa'aogaina Disk Arbitrator a'o le'i fa'apipi'iina lau faitau card SD po'o le ta'avale fafo. Seti le Disk Arbitrator i Ploka Mauga po o le Mauga Faitau-Na'o, ina ia le mafai e macOS ona tusitusi .DS_Store po'o le fa'ailoga Spotlight i luga o le vaeluaga ua fa'aleagaina.

Vaega 2: Fausiaina o se fa'ailoga fa'apitoa a vaega ma lea vaega (ddrescue)¶

'Aua ne'i fa'agasolo sa'o le su'ega fa'aleleia o faila i luga o se kesi malo vaivai, se microSD card ua masaesae, po'o le kopi e tasi o se vaeluaga ua fa'avasegaina. Fausia o se faila ata binary mata (.img pe .dd) e fa'amaonia ai o lo'o iai sau ata fa'aaisa, bit-mo-bit ata o so'o se vaega e pei ona i ai i le taimi na e tatalaina ai le ta'avale.

Laasaga-ma-Laasaga Cloning ma le GNU ddrescue (Linux / macOS) poʻo HDDSuperClone¶

1. Faailoa le mea e iloa tonu ai le masini o lau kata puna po'o le taavale:
   • I luga o Linux, tamoe lsblk -o NAME,SIZE,MODEL,RO,FSTYPE,MOUNTPOINT a'o le'i fa'apipi'iina ma pe a mae'a fa'apipi'i le card reader. Fa'apea o lau 64 gigabyte (59.6 gibibyte) meapueata SD card e aliali mai /dev/sdc (ia mautinoa e e le fa'apipi'i; a fa'ae'e, tamo'e sudo umount /dev/sdc1).
   • I luga o macOS, tamoe diskutil list e su'e le numera tisiki (mo se fa'ata'ita'iga, /dev/disk4), ona aveese lea o ana voluma e aunoa ma le faʻaaogaina o meafaigaluega: diskutil unmountDisk /dev/disk4.
2. Fa'amau lau ta'avale tele e teu ai mea e alu i ai: Fa'apea o lo'o fa'apipi'i lau ta'avale faaleoleo 2 terabyte i fafo /mnt/backup (or /Volumes/BackupDrive i luga ole macOS). Fa'amaonia o lo'o lava le avanoa avanoa e taofi ai le malosi atoa o le ta'avale puna (o le 64 gigabyte SD card e maua ai le 64 gigabyte. .img faila, tusa lava pe na o le 10 gigabytes o ata o loʻo i ai).
3. Fai ddrescue fa'atasi ai ma se fa'afanua (faila faila):

   sudo ddrescue -d -r3 /dev/sdc /mnt/backup/sdcard_raw_clone.img /mnt/backup/sdcard_rescue.map
   

   • -d fa'aogaina le avanoa tu'u sa'o (a'alo le fa'aogaina o le fa'aogaina o le kernel page cache mo faitau sa'o a le vaega; i le fa'aoga macOS /dev/rdisk4 nai lo le -d).
   • -r3 ta'u mai ddrescue e kopi uma vaega soifua maloloina i luga o le taavale atoa i le pasi vave muamua, faase'e i luga o so'o se poloka moli lemu pe faaleagaina vave ina ia le vevela pe loka le kata, ona toe taumafai vaega leaga e oo atu i le 3 taimi i le faaiuga.
   • sdcard_rescue.map sefe lou alualu i luma tonu i nai sekone uma. Afai e motusia le USB faitau po'o le paoa, o le fa'atonuga lava e tasi e toe fa'aauau mai le mea na tu ai e aunoa ma le toe faitauina o vaega ua uma ona lavea'iina.
4. ** Fai se kopi galue pe faapipii le .img faila faitau-na'o**: E tasi sdcard_raw_clone.img mae'a i 100.00% rescued, aveese lau kata SD faaletino ma teu i totonu o se pusa saogalemu. O le ae faia le 100 pasene o lau galuega toe faʻaleleia sdcard_raw_clone.img.

Vaega 3: Fa'atinoina o le toe fa'aleleia o faila (Logical Metadata Reconstruction vs. Raw Vane)¶

A maua loa sau sefe .img faila (poʻo se masini e faʻapipiʻiina le masini), e lua auala faʻapitoa faʻapitoa e aveese ai au faʻamaumauga ua tapeina. E tatau ona e taumafai i taimi uma Metotia A (Logical File System Reconstruction) muamua a'o le'i toe fo'i i tua i le Metotia B (Raw Signature Vane).

Laasaga-i-Laasaga 1: Toe Fa'afo'isia se Vaevaega Aveesea po'o Fa'aleaga Vaega Fa'auma ma TestDisk¶

Afai e faʻafuaseʻi ona fesili lau taʻavale fafo poʻo le SD card * "E manaʻomia le faʻapipiʻiina o le tisiki i le taʻavale E: ae e te leʻi faʻaaogaina"* pe faʻaalia o le RAW / Unallocated i le Disk Management pe a uma ona tatala e aunoa ma le aveeseina ma le saogalemu, e leʻi tapeina uma au faila. Ae, o le Master Boot Record (MBR), GUID Partition Table (GPT), poʻo le Boot Sector (BPB) na faaleagaina.

1. Fa'asolo le TestDisk faasaga i lau faila ata fa'akolo:

   testdisk /mnt/backup/sdcard_raw_clone.img
   

2. Filifili Faʻagasolo -> faʻamaonia le ituaiga laulau vaeluaga (Intel/PC mo MBR SD kata i lalo ole 2 terabytes, po o EFI GPT mo ta'avale tetele fa'aonaponei).
3. Filifili Su'esu'e -> Su'esu'e Faavave.
4. TestDisk o le a su'esu'e mo ulutala vaeluaga fa'apolopolo (e pei o le vaega fa'amaufa'ailoga otometi NTFS o lo'o teuina i le vaega mulimuli lava o le voluma NTFS, po'o le vaega fa'amau fa'amau FAT32 i le vaega 6).
5. Faailoga le vaeluaga ua maua ma lolomi P (Lisi Faila). Afai e te vaʻaia vave au faila ma faila uma o loʻo lisiina i totonu o le faʻamalama faʻamalama:
   • Aua e te faʻalavelave e toe tusi le laulau vaeluaga pe afai e te manaʻo i faila. Na'o le omi C i luga o laupepa e te manaʻo ai ma kopi saʻo atu i lau taʻavale soifua maloloina faʻatasi ma le 100 pasene uluai igoa faila ma fausaga faila.

Laasaga-ma-Laasaga 2: Su'esu'e Metadata Fa'atatau Fa'aaogā le DMDE, R-Studio, po'o le UFS Explorer¶

Ina ua tape faila e ala i Shift + Delete, sasa'a mai le Recycle Bin, po'o solo i se fa'asologa vave Fa'asologa:

1. Tatala lau .img faila i totonu DMDE (tusi fua e toe maua e oo atu i le 4,000 faila i le fa'atonuga; e le taugata le laisene atoa), R-Studio, po'o le UFS Explorer Standard Recovery.
2. Siaki le La'au Fa'atonu Fa'atonu Fa'atonu Muamua:
   • I ta'avale NTFS, o faila ta'itasi e iai se fa'amaumauga e 1,024-byte (1 kilobyte) i le Lisi Fa'atonu Sili ($MFT). E tusa lava pe tape se faila, o lona $MFT o lo'o fa'ailogaina pea le avanoa i se fu'a le gaioi (0x00 nai lo le 0x01) o lo'o i ai le igoa sa'o o le faila, ID fa'asinomaga matua, ma le fuifui amata ma le umi e alu, se'ia toe fa'aaoga e se faila fou lena mea. $MFT avanoa. E le gata i lea, o faila laʻititi nai lo le ~ 700 paita (e pei o faʻamatalaga puʻupuʻu, crypto ki, poʻo nai tusitusiga laiti) o loʻo teuina **nofo ** atoa i totonu o le $MFT fa'amaumau ia lava ma e seasea ona vave fa'asolo.
   • Va'ai i le $Root po o Deleted / Found faila virtual na faia i totonu o le 5 sekone muamua o le tatalaina o le vaeluaga. Afai e aliali mai lau faila i se lanu mumu x po'o le lapisi icon ma fa'aalia se lapo'a maloloina, filifili ma kiliki Toe Laveai i lau ta'avale ese'ese i le taimi lava lena.
3. Fa'asolo le Su'esu'ega Atoa o le Volume pe a Suia le Ulutala Fa'atonu:
   • Afai o se Fa'asologa Fa'avave e fa'asolo ai le lisi a'a po'o nai megabytes muamua o le $MFT, fai se Full Volume Scan. O le polokalame o le a su'esu'e le ata atoa mo nodes faasino igoa subdirectory ola (INDX pa'u i luga ole NTFS, filifili fa'apipi'i i luga ole FAT32/exFAT, po'o siaki fa'atauga tuai ile APFS/ext4) ma tu'u fa'atasi metadata fa'atatau ile su'eina o saini faila.

Laasaga-ma-Laasaga 3: Raw File vaneina ma PhotoRec (Pe a Faʻaumatia Metadata)¶

Pe a o'o i le Lisi Fa'asoa Faila (FAT) or $MFT has been completely zeroed out by a format, logical directory pointers are gone, leaving only the raw file contents sitting in unallocated data clusters. PhotoRec (bundled alongside TestDisk, completely free, open-source, and available for Windows, macOS, and Linux) excels at carving over 480 file formats (including Canon .CR2/.CR3, Sony .ARW, Nikon .NEF, Adobe .DNG/.PSD, .JPG, .PNG, .PDF, .DOCX/.XLSX zip containers, and .SQLITE databases):

1. Launch PhotoRec against your disk image:

   photorec /mnt/backup/sdcard_raw_clone.img
   

2. Select the target partition (or Whole disk if the partition table was wiped).
3. Before starting, go to [File Opt] at the bottom of the screen:
   • Tusitala s to deselect all 480 file types if you only care about specific files (for example, check only jpg, cr2/cr3, tif for raw photos, mov/mp4, ma zip/docx), which drastically speeds up recovery and prevents false-positive garbage fragments.
4. Select [Options] -> keep Keep corrupted files : No unless recovering damaged video streams.
5. Select [Search], choose file system type [Other] (for FAT/exFAT/NTFS/HFS+), and select [Free] (if you only deleted files on an active partition) or [Whole] (if the partition was formatted).
6. Choose a destination folder on your separate large backup drive and press C to begin carving.
7. Post-Recovery Sorting for PhotoRec Output: Because PhotoRec saves files as f123456.jpg across dozens of recup_dir folders, you can automatically reorganize all recovered photos into clean YYYY/MM-Month/ folders with their exact camera timestamp filenames using the free command-line tool ExifTool:

   exiftool "-Directory<DateTimeOriginal" -d "%Y/%Y-%m-%d" -r /mnt/backup/photorec_output/
   

Specialized recovery: fragmented camera MP4/MOV videos (GoPro, DJI Drones, Sony, Canon)¶

One of the most frequent frustrations after running PhotoRec or standard file recovery software on a formatted camera card is discovering that 100 percent of the recovered .JPG ma .RAW photos open perfectly, but every single recovered .MP4 pe .MOV video file refuses to play (0:00 duration or black screen).

Why Standard Recovery Software Breaks Modern Camera Videos¶

1. Interleaved Stream Recording: Modern action cameras (GoPro Hero series, DJI Air/Mavic/Mini drones, Insta360) and cinema mirrorless cameras do not write a single .MP4 file sequentially from start to finish. While recording 4K or 5.3K video, the camera simultaneously writes a high-resolution .MP4 stream, a low-resolution preview .LRV stream, an audio buffer, and telemetry metadata into alternating clusters on the exFAT/FAT32 card (for example: 4 megabytes of high-res video, followed by 512 kilobytes of .LRV preview, followed by 4 megabytes of high-res video).
2. Missing moov Atom in Unfinalized Recordings: If your drone crashed into water, your camera battery died mid-recording, or the SD card disconnected before you pressed the Stop Record button, the camera never wrote the moov atom (the master index table written at the very end of an MP4/MOV file that tells media players where every video frame and audio chunk sits).

How to Rebuild Unplayable or Fragmented Camera Videos¶

1. Case A: Unfinalized Video After Battery Loss or Crash (File Exists on Card, Shows Multi-GB Size, Won't Play):
   • The clusters are intact in the file system, only the moov index header is missing.
   • Fa'aaogā le mea faigaluega e leai se totogi untrunc (aemaise lava le anthwlock/untrunc tui) po o recover_mp4 (slydiman). Tuuina atu untrunc fa'atasi ai ma se fa'amatalaga maloloina e mafai ona ta'alo .MP4 fa'amauina i luga o lena meapueata tutusa ma le fa'ai'uga tutusa ma fa'atulagaga fa'avaa, fa'atasi ma lou gau .MP4:

     untrunc reference_working_video.MP4 corrupted_unfinalized_video.MP4
     

   • untrunc reads the codec parameters (avcC/hvcC and audio track layouts) from the working reference video, scans the raw H.264/H.265/HEVC NAL units in your damaged file, and synthesizes a brand-new moov atom in seconds.
2. Case B: Formatted SD Card with Interleaved / Fragmented Video (GoPro, DJI, Sony, Canon):
   • Because the FAT/exFAT cluster map was wiped during formatting, a standard carver grabs the ftyp/mdat header of your 4K video and then blindly copies the .LRV va'ai fuifui ma fuifui ata i totonu tonu o lau faila vitiō, fa'aleagaina sekone ta'itasi o ata.
   • Instead of standard carvers, scan your sdcard_raw_clone.img using a fragmentation-aware video reconstructor that recognizes camera-specific cluster allocation cadences, such as SanDisk RescuePRO Deluxe (which includes specific GoPro/drone fragmented video assembly algorithms), Klennet Carver, or Disk Drill 5+ (which includes a dedicated GoPro/DJI fragmented video signature reconstructor).

Smartphone photo deletion: iOS (iPhone) and Android hardware encryption realities¶

A common and dangerous misconception is that you can plug a modern iPhone or Android smartphone into a laptop via USB and run traditional disk carving software (like Recuva or PhotoRec) on the phone's internal storage.

Why Traditional Sector Carving Cannot Read Modern Phones¶

Every iPhone since the iPhone 3GS (and all current iOS devices) uses Data Protection (File-Based Encryption) powered by a dedicated hardware AES crypto engine between the flash storage and main system memory. Similarly, every Android device shipped since Android 7.0+ (and mandatory since Android 10) uses File-Based Encryption (FBE) backed by the hardware Keystore/Titan M/Knox chip.

On both platforms, every single individual photo and file on the internal storage is encrypted with its own unique per-file cryptographic key. When a file is permanently purged from the phone's file system, the phone does not even need to erase the multi-megabyte photo blocks; it immediately destroys the 256-bit per-file encryption key in the metadata table. Without that key, the raw NAND blocks contain cryptographically unbreakable random noise. Even top-tier government forensic labs cannot "carve" permanently deleted photos from the internal flash of a modern iPhone or Android once the per-file key is wiped.

The Actual Recovery Paths for Deleted Smartphone Photos¶

Because hardware encryption blocks raw carving, recovering deleted photos from an iPhone or Android relies on recovering copies before retention timers expire or extracting cached thumbnail databases:

1. Check the On-Device "Recently Deleted" Album Immediately (30-Day Window):
   • iOS (iPhone / iPad): Tatala Photos -> tusi i lalo ile Utilities -> tap Recently Deleted (manaomia Face ID / Touch ID / Passcode). O ata o lo'o nofo iinei mo 30 aso a'o le'i fa'aumatia ki tumau.
   • Android (Google Photos / Samsung Gallery): Tatala Google Photos -> Library / Collections -> Trash / Bin (taofia mo 60 aso pe a fai i tua, 30 aso pe afai na'o masini). Siaki foi Samsung Gallery -> Menu (tolu laina) -> Trash (taofia mo 30 aso), ma tatala le Files by Google or My Files app -> Trash, lea e tausia ai se pusa lapisi 30 aso ese.
2. ** Afai na e tapeina ata mai le "Ta'i'i'i Deleted" i luga o le iPhone, Valaau Apple Lagolago mo se Faʻalavelave faʻafuaseʻi iCloud Server-Side Toe Faʻafoʻisia**:
   • O le tele o tagata faʻaoga latou te le iloa e tusa lava pe a uma ona e kiliki ma le lima "Tape mai Mea Uma" / "Empty Recently Deleted" i iCloud Photos, o loʻo faʻatumauina e le auʻaunaga pito i tua a Apple se faʻamalo le toe faʻaleleia o le server mo se faʻamalama puupuu (e masani lava ** e oʻo atu i le 7 i le 14 aso ** pe a uma le tapeina tumau).
   • Fa'afeso'ota'i le Apple Support i le telefoni po'o talatalanoaga, fai atu e talanoa ma le Senior Advisor, ma fai atu ia i latou e fa'aoso se iCloud Photo Library Server-Side Recovery i lau Apple Account. E mafai ona latou felafoa'i soo se ki o le server e lafoa'i lata mai nei iCloud Photos i totonu o lau album i totonu ole 15 minute.
3. ** Toe fa'afo'i mai se masini tuai e le'i fa'aogaina po'o se fa'aigoa fa'alotoifale fa'aigoaina**:
   • ** Va'alele Mode Trick on Secondary iPad / Mac**: Afai na fa'aogaina e lau iPhone se tape i le iCloud, pu'e lau iPad po'o le MacBook ** a'o le'i fa'afeso'ota'i i le Wi-Fi** (tapē lau telefoni Wi-Fi ile fale e tatala muamua le uaea eletise pe a moe le iPad i luga o lau kesi). Malosi i luga ole iPad ile fa'aesea ole leitio, kopi ata o lo'o iai pea ile USB cable po'o le AirDrop i se isi masini a'o le'i maua e le iPad le fa'atonuga tu'i fa'amalo iCloud.
   • Siaki iCloud Backup vs. iCloud Photos: Afai na e iCloud Photos ua tape (Settings -> [Your Name] -> iCloud -> Photos -> Off), o lau Lola Meapueata o lo'o aofia i totonu o lau po iCloud Device Backup. E mafai ona e tapeina se iPhone tuai tuai (pe toe fa'afo'i le tumau ma toe fa'afo'i lau iPhone o lo'o iai nei) ma toe fa'afo'i le iCloud Backup i po mai le mua'i le taimi na e tapeina ai le ata.
   • Siaki Local Finder / iTunes Backups i lau PC po'o Mac: Siaki ~/Library/Application Support/MobileSync/Backup/ i macOS poʻo %APPDATA%\Apple Computer\MobileSync\Backup\ luga o Windows. E mafai ona e su'esu'e ma ave'ese ata mai fa'amaumauga tuai i le lotoifale e aunoa ma le fa'asili o lau telefoni e fa'aaoga ai le iMazing po'o le iBackup Viewer.
4. Siaki Fe'au Fa'amatalaga Fa'alotoifale Caches (WhatsApp, iMessage, Telegram, Fa'ailoga):
   • Na e tusia se ata po o se vitio ua tapeina i se to'alua, uo, po'o se talanoaga fa'avae a le aiga? O polokalame fe'au e teu ai kopi tuto'atasi o ala o faasalalauga i totonu oa latou lava pusa oneone (Media/WhatsApp Images/Sent i luga ole Android, poʻo totonu ole talatalanoaga faʻapipiʻi ile iMessage). E tusa lava pe e te tapeina se ata mai lau Roll Camera autu ma tuʻu ese le otaota, o le kopi i totonu o lau WhatsApp Sent faila po o iMessage filo talafaasolopito tumau atoatoa le pa'i.

O le ta'avale ao ma le atina'e fa'afuase'i ona tapeina (Google Drive, OneDrive, Dropbox)¶

Pe a mou atu se faila fefa'asoaa'i atoa pe fa'asolo i luga o le cloud drive (pe a tape e le ransomware po'o se fa'aogaina o le syncing faila i le lotoifale ma fa'amaopoopo le tapeina i le ao), e masani ona le mana'omia le toe fa'aleleia o tisiki fa'apitonu'u ona o lo'o fa'atumauina e fa'aputuga o ao fa'apisinisi ma tagata fa'atau le tele-tier versions history:

1. Microsoft OneDrive & SharePoint Online:
   • Laasaga Muamua Talone Toe Fa'aaogā (onedrive.live.com): Taofi faila ua tapeina mo 30 aso i tala a le tagata lava ia ma 93 aso i tala o Galuega/A'oga.
   • ** Laasaga Lona Lua a le Site Collection Recycle Bin (Galue/A'oga)**: Tusa lava pe sasaa e se tagata faigaluega po'o se tagata ta'avale le mea autu o OneDrive Recycle Bin, kiliki le sootaga i le pito i lalo o le Recycle Bin itulau ua faaigoaina "Second-stage recycle bin", lea e mafai ona toe maua mai faila mama mo le taimi o totoe o le 93-day window.
   • ** Toe Faafo'isia Lau OneDrive (Point-in-Time Rollback): Microsoft 365 tagata fai saofaga e mafai ona kiliki ** Seti (gear icon) -> Filifiliga -> ** Toe fa'afo'isia lau OneDrive**, lea e fa'aogaina ai le fa'asolo ata e fa'asolo ai faila ta'itasi, toe fa'aigoa, ma tapeina i luga o le ao atoa i tua i so'o se minute sa'o i totonu o le 30 aso talu ai.
2. Google Drive ma Google Workspace:
   • Google Drive lapisi (drive.google.com/drive/trash): Taofi faila ua tapeina mo 30 aso.
   • Google Workspace Admin Post-Trash Recovery (25-Day Grace Window): E tusa lava pe a uma ona kiliki e se tagata e faaaogāina le "Delete Forever" ma sasaa a latou Google Drive Trash, e mafai e le Google Workspace Administrator (poʻo le tagata lava ia e faʻafesoʻotaʻi le Google Drive Support i Google One accounts) e mafai ona tatala le Google Admin Console (admin.google.com) -> Directory -> Users -> [Filifili Tagata] -> More Options -> Restore Data, ma toe faʻamamā tumau faila Google Drive ma Gmail feʻau e oʻo atu i le 25 aso faaopoopo ina ua uma le otaota.
3. Dropbox:
   • ** Aveese faila (dropbox.com/deleted_files)**: Taofi faila ma faila ua tapeina mo 30 aso i Fuafuaga Autu/Plus/Aiga, ma 180 aso i le 1 tausaga i fuafuaga Fa'apitoa/Pisinisi.
   • ** Toe fa'afo'i le Dropbox (dropbox.com/rewind)**: Fa'ataga le toe fa'afo'i i tua o le faila atoa po'o le tala atoa e fa'ate'aina le tele o tapeina, toso-ma-pa'u fa'afuase'i, po'o fa'ailoga fa'ailoga.

Fesili e fai soo¶

Punavai ua siaki¶

• National Institute of Standards and Technology (NIST, United States): Special Publication 800-88 Revision 1, Guidelines for Media Sanitization (ATA TRIM, NVMe Deallocate, and NAND Flash Translation Layer behavior) and Computer Forensics Tool Testing (CFTT) Program Disk Imaging Specifications (csrc.nist.gov).
• Cybersecurity and Infrastructure Security Agency (CISA, United States): Data Backup, Forensic Preservation, and Incident Handling Guidelines (cisa.gov).
• GNU Project / Antonio Diaz Diaz (International): Official GNU ddrescue Manual: Data Recovery Tool and Block Device Mapfile Algorithms (gnu.org/software/ddrescue).
• CGSecurity / Christophe Grenier (International): TestDisk & PhotoRec Official Documentation: Partition Recovery and File Carving Signatures (cgsecurity.org).
• Apple Platform Security (United States): FileVault, Data Protection Classes, Per-File Encryption Keys, and APFS Trim Architecture on Apple Silicon and T2 Systems (support.apple.com/guide/security).
• Android Open Source Project (AOSP, International): File-Based Encryption (FBE) and Metadata Encryption Architecture (source.android.com/docs/security/features/encryption).
• SD Association (International): SD Specifications Part 1: Physical Layer Simplified Specification (Erase Commands CMD32, CMD33, CMD38 and Write-Protect Mechanical Switch) (sdcard.org).

Taiala fa'atatau¶

• Fa'aletonu le ta'avale malo ma le toe fa'aleleia o fa'amaumauga
• Computer backups: 3-2-1 strategy and disaster recovery
• Ransomware and malware
• Broken or water-damaged phone
• Fa'aletonu le ta'avale a le Linux ma le toe fa'aleleia o le GRUB
• Windows Blue Screen (BSOD) ma le fa'aleleia o seevae