Phimolo ya faele ka phoso, karata ya SD e e fometetsweng, le go busetsa senepe¶

Go lemoga gore o sa tswa go fometa karata ya SD ya khamera e e sa siamang, wa ntsha Recycle Bin kgotsa Trash mo drive ya tiro ya kwa ntle, kgotsa wa phimola ka phoso karolo yotlhe ya dinepe tsa lelapa tse di ka se emisediweng ke mathata a a bogale a setegeniki. Fa faele e phimolwa kgotsa sedirisiwa sa polokelo se fometelwa ka bonako, ga se gantsi tsamaiso ya tiriso e phimolang tshedimosetso e e tala ya binary mo teng ga disele tsa memori ka yone nako eo. Go na le moo, e tlosa tshupo ya lenaane la tsamaiso ya difaele mme e tshwaya diaterese tseo tsa boloko tse di utlwalang jaaka "sebaka se se gololesegileng" se se leng teng go ka kwalwa godimo. Gore a o tla boelwa ke diperesente di le 100 tsa tshedimosetso ya gago kgotsa o tla e latlhegela go ya go ile go ikaegile gotlhelele ka gore go diragalang mo metsotswaneng ya ntlha e le 60 morago ga gore e phimolwe. Motsotswana mongwe le mongwe polatefomo e nna e le mo mokgweng wa go bala le go kwala, go dira ditshupane tsa tsamaiso ya tiriso ya lemorago, go ananya difaele, dipolokelo tsa sebatli, le dithulaganyo tsa go phutha matlakala tsa Solid State Drive (SSD) (TRIM / UNMAP) e ka tlosa makala a a ka fa tlase ruri.

Fa e le gore go phimola kgotsa go fometa ka phoso go akaretsa go dirisa thelemeteri ya kalafi, bosupi jwa semolao jwa bosenyi jo bo dirang, kgotsa go palelwa ga tsamaiso ya pabalesego ya botshelo, leletsa nomoro ya tshoganyetso ya lefelo la lona (911 kwa United States le kwa Canada, . 112 go kgabaganya Yunione ya Yuropa, 999 kwa United Kingdom) kgotsa leba lenaane la rona la dibuka tsa boditšhabatšhaba dinomoro tsa tshoganyetso pele o ama serweboleta. Bakeng sa diketsahalo tsohle tsa bareki, tsa dinepe, tsa thuto, le tsa tahlehelo ya data ya kgwebo, emisa mosebetsi ohle wa disiki hanghang mme o latele tsamaiso ya mosebetsi ya ho hlaphoheloa ha forensiki e ka tlase.

Dira se jaanong¶

1. Goga karata ya SD e e ka tlosiwang, karata ya CFexpress, kgotsa drive ya USB ka bonako: Fa e le gore o sa tswa go fometa karata ya memori ya khamera kgotsa o phimotse difaele mo drive ya USB ya kwa ntle, tima switšhi ya maatla a khamera ka bonako kgotsa ntsha thapo ya USB ya kwa ntle mo khomphuteng. O se ka wa tsaya "senepe se le sengwe sa teko" go bona gore a karata e a dira, mme o se ka wa letlelela Windows (chkdsk) kgotsa macOS (fsck_apfs) go "skena le go baakanya" drive.
2. Haeba o hlakotse difaele ho tswa ho khomphutha ya hao ya tsamaiso ya ka hare (C: drive kapa macOS Macintosh HD), yank matla kapa qobella matla a thata-off: O se ke wa kwala ditiriso tse dingwe ka tlwaelo, o se ke wa jarolla data hlaphoheloa ya data ho khomphuteng e amehang, 'me o se ke oa tobetsa "Tswala Fatshe holim'a ho registry, gigaves diboloko tsa gago tse di phimotsweng). Tshwara konopo ya maatla a mmele metsotswana e le 5 go ya go e le 10 go fitlha motšhini o tima gotlhelele, kgotsa ntsha thapo ya maatla a desekethopo mo polakeng fa e le thulaganyo e e sa diriseng beteri.
3. Relela switšhi ya tshireletso ya go kwala mo dikarata tsa SDHC/SDXC tsa bogolo jo bo tletseng go ya kwa boemong jwa LOCK: Leba ntlha ya molema ya karata ya SD ya dimilimitara di le 32 ka dimilimitara di le 24 (1.26 intšhe ka intšhe e le 0.94) mme o sutuletse thebo e nnye ya polasetiki go ya kwa tlase go ya kwa tseleng e nnye ya polasetiki go ya kwa tlase go ya kwa botleng). kwala ka phoso .DS_Store, System Volume Information, kgotsa difaele tsa tshupane ya Spotlight fa o e tsenya moragonyana.
4. Tlhaloganya serai sa SSD TRIM pele o tsenya SSD ya ka fa gare maatla gape: Dikgweetso tsa segompieno tsa NVMe le SATA Solid State di diragatsa maemo a serweboleta TRIM (ATA) kgotsa Deallocate (NVMe) ditaelo mo metsotswaneng go ya go metsotso ya go phimolwa ga faele kgotsa go fometa. Fa molaodi wa SSD a sena go kokoanya matlakala a lemorago mo ditsebeng tse di kgabisitsweng, serweboleta se se tala sa go betla se tla bala fela dinomoro (0x00). Ho boloka matla a tima ho emisa ka hare SSD microprocessor ho qeta lemorago matlakala pokello.
5. Baakanyetsa khomphutha e e farologaneng, e e phepa ya bobedi le drive e kgolwane ya kwa o yang teng: Le ka motlha o se ke wa tsenya didirisiwa tsa go busetsa mo drive e e latlhegetsweng ke tshedimosetso, mme o se ke wa busetsa difaele tse di buseditsweng gape mo drive e e tshwanang ya motswedi ka nako ya go sekaseka. Dirisa khomphutara ya bobedi (kgotsa simolola PC e e amegang go tswa mo flash drive ya USB ya Ubuntu Linux Live ya kwa ntle) mme o gokelele hard drive ya kwa ntle e e senang sepe e e nang le bokgoni jwa polokelo jo bo menaganeng gabedi jwa polatefomo e e amegang.
6. Tlhama setshwantsho sa bobedi se se tala sa lekala ka lekala (.img kgotsa .dd) pele o dirisa setlhatlhobi sepe sa go busetsa faele: Pele o dirisa PhotoRec, R-Studio, DMDE, kgotsa UFS Explorer, dirisa ddrescue kapa HDDSuperClone ho clone lekala le leng le le leng la karete ya SD kapa drive ho ba faele e le nngwe ya setshwantsho ho drive ya hao ya bekapo. O ka ntan'o matha multiple hlaphoheloa dikgatotharabololong ka pabalesego khahlanong le setshwantsho faele ntle le ho kopa ho eketsehileng apara kapa phoso ngola ka mecha ea litaba pele.

Setlhare sa tshwetso: go tlhopha leano le le siameng la go boela mannong ka metswedi ya polokelo le thulaganyo ya difaele¶

Dirisa tšhate eno ya go tlhatlhoba ya forensiki go bona gore a tshedimosetso ya gago e e phimotsweng e ka busediwa ka go aga sešwa ga tafole ya faele ka tsela e e utlwalang, go betla mosaeno wa faele e e tala, kgotsa tshekatsheko e e kgethegileng ya go ntsha ditšhipi:

flowchart TD
    A["Phimolo ya Faele ka Phoso kgotsa Fomete ya Draive e Lemogilwe"] --> B["Tima Sediriswa ka bonako kgotsa Ntsha Mmedia o o Tlosiwang"]
    B --> C{"Ke mofuta ofe wa serweboleta sa polokelo sa mmele se se amegang?"}
    C -->|"Khemera SD / MaekeroSD / CFexpress / Folashe ya USB"| D["Dirisa Switch ya Tshireletso ya go Kwala kgotsa Dirisa USB Blocker ya go Buisa Fela"]
    C -->|"Hard Drive ya Metšhini ya kwa Ntle kgotsa ya ka fa Gare (HDD)"| E["Ga go na Kotsi ya TRIM: Kgonagalo e e Kwa Godimo ya go Boela mannong fa go na le Dikwalo Tse Disha Tsa Lefela"]
    C -->|"SSD / NVMe / Mac / Selulafouno ya mo teng kgotsa ya kwa ntle"| F{"Ke Tsamaiso efe ya Faele le Kgolagano ya OS e e Dirisitsweng?"}
    F -->|"NTFS, APFS, kgotsa ext4 mo SSD ya NVMe/SATA ya ka fa Gare"| G["Kotsi e e Kwa Godimo ya TRIM: Simolola ka Linux Live USB ka libata.force=noncqtrim"]
    F -->|"exFAT kgotsa FAT32 mo godimo ga Polokelo e e Tlwaelegileng ya USB"| H["Kotsi ya TRIM e e Magareng/e e kwa Tlase: Maborogo a mantsi a USB ga a Fete TRIM mo exFAT"]
    F -->|"Polokelo ya ka fa Gare ya iOS / Android"| I["Encryption e e Theilweng mo Faeleng ya Serweboleta (FBE): Dinotlolo di Senngwa fa di Phimolwa, Tlhola Dibekapo tsa kwa Lerung/tsa Lefelo leo ka bonako"]
    D --> J["Tlhama Kopiso e e Tletseng ya Bitstream (.img) O dirisa ddrescue ya GNU mo Polaefo e e Kgaoganeng"]
    E --> J
    G --> J
    H --> J
    J --> K{"A Difaele di ne tsa Phimolwa ka Bongwe kgotsa A Drive e ne e Fometilwe?"}
    K -->|"Phimolo ya motho ka bongwe / Fomete ya ka bonako (Metadata e sa senyega)"| L["Tsamaisa Kagosešwa ya Tshedimosetso e e Utlwalang (DMDE, R-Studio, Motlhotlhomisi wa UFS, Diseke ya Teko)"]
    K -->|"Lenaneo la Faele le le Kwadilweng godimo / Fomete ya mo Mmeleng wa Khamera"| M["Tsamaisa Faele e Tala ya Mosaeno wa go Betla + Moagi wa Dibidio o o Kgaoganeng (PhotoRec, Paakanyo ya GoPro/MP4)"]

Fisika ya go phimola: dipoleiti tsa makenete tsa HDD kgatlhanong le folashe ya SSD NAND le dikarata tsa SD tsa Khamera¶

Go tila go senya tshedimosetso e e ka busediwang, o tshwanetse go tlhaloganya kafa dipolane tse di farologaneng tsa polokelo di dirisanang ka gone le go phimola le go fometa ka fa tlase ga hood.

1. Dikgweetsi tsa Diseke tse di Thata tsa Metšhini (HDD) le Go Rekota ga Makenete ga Ditlhare (SMR)¶

Mo rekotong e e tlwaelegileng ya makenete (CMR) e e dikologang hard drive, go phimola faele kgotsa go dirisa "Fomete e e Bofefo" go tsaya metsotswana e e kwa tlase ga e mebedi ka gonne ditlhogo tsa go buisa/kwala di fetola fela tshupane ya lenaanethalo le legolo, jaaka $MFT (Lenaneo la Faele ya Motheo) mo NTFS, Bitmap ya Kabo le Setlhare sa B sa Khathaloko mo HFS+/APFS, kgotsa Lenaneo la Kabo ya Faele mo FAT32/exFAT. Diphetogo tsa mmatota tsa makenete tse di emelang di-JPEG tsa gago, di-PDF le di-spreadsheet di nna di sa amiwe mo dipoleiteng tsa cobalt-alloy go fitlha tsamaiso ya tiriso e tlhopha go kwala faele e ntšhwa mo godimo ga Diaterese tseo tsa Logical Block (LBAs).

Le fa go ntse jalo, di-hard drive tse dintsi tsa segompieno tsa kwa ntle tsa bareki tse di nang le bokgoni jo bo kwa godimo (ka tlwaelo di-terabyte di le 2 go ya go di-terabyte di le 5 mo di-terabyte di le 2.5-inch mo di-inch di le 2.5) di dirisa Kgatiso ya Makenete ya Shingled (SMR) mmogo le lera la thanolo ya serweboleta sa ka fa gare se se bidiwang Media Cache. Di-hard drive dingwe tsa segompieno tsa SMR tota di tshegetsa TRIM taelo fela jaaka SSD. Fa o phimola foltara e kgolo mo hard drive ya SMR e e kgonang go dirisa TRIM mme o e tlogela e tsentswe e sa dire sepe metsotso e le 20, serweboleta sa ka fa gare sa polatefomo se ka nna sa rulaganya sešwa dibente tsa sone tse di shingled mme sa ntsha makala a a sa abewang kwa morago go ya go ile. Go ntsha polaka ya drive ka bonako go thibela modikologo ono wa go tlhokomela ntlo ka fa gare.

2. Di-Drive tsa Boemo jo bo Thata (SSD), NVMe, le TRIM / Deallocate Lefensetere la Tiragatso¶

NAND flash memoring ya ka hare ho SSDs ke ke overwrite teng ya data ka kotloloho sebakeng. Pele ga sele ya folashe ya NAND e ka amogela tshedimosetso e ntšhwa, boloko yotlhe ya folashe (ka tlwaelo e le bogolo jwa dimegabaete di le 4 go ya go dimegabaete di le 16) e tshwanetse go feta pele mo modikologong o o bonya wa motlakase wa Lenaneo/Phimola (P/E). Fa SSD e ne e ka leta go fitlha o boloka faele e ntšha go phimola diboloko tsa bogologolo, lebelo la go kwala le ne le tla wela tlase.

Go boloka di-SSD di le bofefo, ditsamaiso tsa segompieno tsa go dira (difensetere 7 go fitlha ka difensetere 11, macOS 10.10+, le di-kernel tsa Linux tse di nang le fstrim kgotsa discard) romela ka bonako TRIM (SATA) kgotsa Dataset Management: Deallocate (NVMe) taelo go molaodi wa SSD ka nako ya fa o tsholola Bini/Matlakala kgotsa o diragatsa Fomete e e Bofefo:

1. Bala Lefela la Botlhomamisi morago ga TRIM (DZAT / DRAT): Mo e ka nnang di-SSD tsotlhe tsa segompieno tsa bareki tsa NVMe le SATA di gapeletsa Lefela la Botlhomamisi morago ga TRIM. Millisecond e e tlhomameng e molaodi wa SSD a amogelang TRIM taelo ya mefuta e fapaneng ya makala, lona ka hare Flash Thanolo Lera (FTL) unmaps tseo diaterese utloahalang ho tloha 'meleng NAND maqephe.
2. Go Busediwa ga Lefela ka Bonako: Le pele ga motlakase o o bonalang o phimolwa mo diseleng tsa silicon, fa e le gore go na le sofotewere epe (go akaretsa le ddrescue, PhotoRec, kgotsa R-Studio) e kopa SSD go bala makala ao a a kgaotsweng ka ditaelo tse di tlwaelegileng tsa SATA kgotsa NVMe, molaodi wa SSD o kganela kopo mme o busetsa dinomoro tse di phepa tsa hexadecimal (00 00 00 00) ntle le go tlhola le ditšhipi tsa NAND tsa mmatota.
3. Fa SSD Recovery e santse e kgonega:
   • Dikhurumelo tsa USB tsa kwa ntle tse di senang go feta ga UASP/TRIM: Ditšhipi tsa bogologolo tsa borogo tsa USB 3.0 tse di dirisang porothokholo ya bogologolo ya BOT (Dipalangwa tsa Bontsi) go na le UASP (Prothokholo ya SCSI e e Gokeletsweng mo USB) ga di kgone go ranola tsamaiso ya tiriso TRIM ditaelo go kgabaganya thapo ya USB.
   • FAT32 le exFAT Dibolumo mo Mefuteng e e rileng ya OS: Go ya ka hisitori, dikago di le mmalwa tsa tsamaiso ya tiriso di ne di romela fela ka nako ya mmatota e e itirisang TRIM ditaelo mo ditsamaisong tsa difaele tse di kwadilweng mo jenaleng (NTFS, APFS, ext4) mme ga e a ntsha nako ya mmatota ka bonako TRIM e e tlosiwang FAT32 kgotsa exFAT dikarolo.
   • Phimola Tafole ya Karolo (diskpart clean kgotsa go phimolwa ga karoganyo ka phoso) ntle le go Fometa: Go phimola tsenyo ya karoganyo go tswa mo Lenaneong la Karoganyo la GUID (GPT) kgotsa Rekoto ya Master Boot (MBR) ka dinako tse dingwe go tlogela makala a a ka fa tlase a sa kgaoganngwa go fitlha tsamaiso e ntšhwa ya faele e fometelwa mo godimo ga yone.

3. Go Fometa ga Khamera mo Mmeleng le Sony / Canon / Nikon SD_ERASE Serai¶

Batshwantshi le batshwantshi ba dibidio gantsi ba tsaya gore go fometa karata ya SD, microSD, kgotsa CFexpress mo teng ga khamera ya dijithale go tshwana le "Fometa e e Bofefo" mo khomphuteng ya desekethopo. Le fa gone go ne go ntse jalo dingwaga di le lesome tse di fetileng, dikhamera tsa segompieno tse di senang seipone di itshwara ka tsela e e farologaneng thata go ikaegile ka gore di dirilwe ke mang:

Phase 1: Immediate OS containment and blocking automatic writes¶

Before you try to recover files from an internal drive or attach an external drive to a computer, you must neutralize the operating system mechanisms that silently overwrite deleted space.

1. Recovering from an Internal Windows Drive (C: Drive)¶

If you deleted an important folder from your Windows Desktop, Documents, or Downloads folder and emptied the Recycle Bin:

1. Do NOT keep using Windows on that drive: Even leaving Windows sitting idle at the Desktop allows SearchIndexer.exe, Windows Defender background scans, Chrome/Edge cache updates, Volume Shadow Copy rotation, and the Windows Pagefile (pagefile.sys) to write hundreds of megabytes per minute directly over your newly freed clusters.
2. If you cannot power off immediately (for example, on a remote workstation with no physical access), disable TRIM instantly via Administrator Command Prompt:
   • Tobetsa Win + X, click Terminal (Admin) or Command Prompt (Admin), and execute:

     fsutil behavior set DisableDeleteNotify 1
     

   • This stops Windows from sending any further TRIM notifications for NTFS and ReFS volumes, though it cannot undo TRIM commands sent seconds earlier.
3. Check if a Volume Shadow Copy (Previous Versions) already exists before shutting down (takes 15 seconds):
   • Right-click the parent folder that held your deleted files, click Properties -> Previous Versions.
   • Or run vssadmin list shadows in an Administrator Command Prompt. If a shadow snapshot exists from earlier today or yesterday, you can mount that shadow copy read-only (mklink /d C:\ShadowRestore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\) and copy your intact files directly to an external USB thumb drive.
4. If no Shadow Copy exists, shut down hard and boot from a Linux Live USB: Create an Ubuntu or SystemRescue USB flash drive on a different computer, boot the affected PC from that USB drive in Try Ubuntu (Live RAM mode) without mounting the internal drive rw, and image or extract the files from outside Windows.

2. Recovering from a macOS System Drive (Apple Silicon M1/M2/M3/M4 & T2 Macs)¶

Modern Apple computers running macOS on APFS (Apple File System) present two strict architectural hurdles:

1. Aggressive APFS TRIM: macOS sends TRIM commands immediately upon emptying the Trash on internal Apple SSDs.
2. Hardware FileVault / Secure Enclave Encryption: On all Macs with an Apple T2 chip or Apple Silicon (M1, M2, M3, M4), the internal SSD is hardware-encrypted at rest by default using keys tied to the Secure Enclave, even if FileVault is turned "Off" in System Settings.
   • Immediate Check 1: Local Time Machine Snapshots (tmutil): Even if your external Time Machine backup drive was unplugged at the time of deletion, macOS automatically creates hidden hourly APFS Local Snapshots on the internal SSD if Time Machine is configured. Open Terminal immediately and run:

     tmutil listlocalsnapshots /
     

     If you see snapshots listed (such as com.apple.TimeMachine.2026-10-31-091522.local), open the folder where the file lived and launch the Time Machine app from Applications to restore the file in seconds.
   • Immediate Check 2: Cloud Sync Trash Bins (iCloud Drive, OneDrive, Dropbox, Google Drive): Because macOS Desktop and Documents folders are frequently synced to iCloud Drive, deleting a file from your Mac Desktop deletes it via iCloud sync rather than just locally. Open a browser on your phone or another PC, log into icloud.com -> Drive -> Recently Deleted (bottom right corner), where deleted files are retained for 30 days completely untouched by local SSD TRIM.

3. Blocking macOS and Windows from Polluting a Plugged-in SD Card or External Drive¶

When you plug a camera SD card or external USB drive into a computer to recover files, the host operating system immediately tries to write hidden metadata files onto the root of the drive (.DS_Store, .Spotlight-V100, .fseventsd, .Trashes on macOS; System Volume Information le $Recycle.Bin on Windows). Those tiny writes land right at the beginning of the free space bitmap, often corrupting the exact directory headers you are trying to recover.

• Mo Linux (Mokgwa o o Babalesegileng wa Forensiki): Linux ga e kwale ditsholadifaele tsa tshupane tse di fitlhegileng ka go itirisa fa o thibela go tsenya ka go itirisa kgotsa go tsenya sediriswa sa boloko se se buisiwang fela (ro,noload).
• Mo Windows (Kgontsha Ponagalo ya Diseke ya go Buisa Fela ka DiskPart PELE ga o tsenya polatefomo, kgotsa dirisa Rejisetara WriteBlocker):
  • Bula regedit.exe jaaka Motsamaisi, tsamaela kwa HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies (tlhama StorageDevicePolicies konopo fa e seyo), mme o tlhame DWORD (32-bit) boleng jo bo bidiwang WriteProtect seta go 1. Tsenya sebadi sa gago sa karata ya USB morago ga moo, mme Windows e tla tshwara polokelo yotlhe ya USB e e ka tlosiwang jaaka e e sireleditsweng mo go kwaleng ga serweboleta.
• Mo macOS (Thaba ka Motsereganyi wa Diseke): Laisolola le go simolola tiriso ya motswedi o o bulegileng Motsereganyi wa Diseke pele ga o tsenya sebadi sa karata ya gago ya SD kgotsa polatefomo ya kwa ntle. Seta Motsereganyi wa Diseke go Thibela Ditlhomo kgotsa Tlhoma Puiso-Fela, ka jalo macOS ga e kgone go kwala .DS_Store kgotsa Ditshupane tsa Spotlight mo karolong e e senyegileng.

Kgato 2: Go tlhama kholounu ya forensiki ya lekala ka lekala (ddrescue)¶

Le ka motlha o se ke wa tsamaisa di-scans tsa ho hlaphoheloa ha faele ka kotloloho ho hard drive e hlolehang, karete ya microSD e fedileng, kapa khopi e le nngwe ya karolo e rulagantsweng. Go tlhama faele ya setshwantsho se se tala sa dipalo tse pedi (.img kgotsa .dd) e netefatsa gore o na le senepe se se gatsetse, sa lekala lengwe le lengwe jaaka le ne le le teng ka nako ya fa o ne o ntsha polaka mo polakeng.

Go Tshwara Kgato ka Kgato ka GNU ddrescue (Linux / macOS) kgotsa HDDSuperKlone¶

1. Supa sesupo sa sediriswa sa karata ya gago ya motswedi kgotsa polatefomo:
   • Mo Linux, dirisa lsblk -o NAME,SIZE,MODEL,RO,FSTYPE,MOUNTPOINT pele le morago ga go tsenya sebadi sa karata. A re re karata ya gago ya SD ya khamera ya di-gigabyte di le 59,6 e tlhagelela jaana /dev/sdc (make sure it is not mounted; if mounted, run sudo umount /dev/sdc1).
   • On macOS, run diskutil list to find the disk number (for example, /dev/disk4), then unmount its volumes without ejecting the hardware: diskutil unmountDisk /dev/disk4.
2. Mount your large destination storage drive: Suppose your external 2 terabyte backup drive is mounted at /mnt/backup (kgotsa /Volumes/BackupDrive on macOS). Verify it has enough free space to hold the entire raw capacity of the source drive (a 64 gigabyte SD card produces a 64 gigabyte .img file, even if only 10 gigabytes of photos were on it).
3. Diragatsa ddrescue with a mapfile (log file):

   sudo ddrescue -d -r3 /dev/sdc /mnt/backup/sdcard_raw_clone.img /mnt/backup/sdcard_rescue.map
   

   • -d uses direct disk access (bypassing the operating system kernel page cache for accurate sector reads; on macOS use /dev/rdisk4 instead of -d).
   • -r3 tells ddrescue to copy all healthy sectors across the entire drive on the first fast pass, skip over any slow or damaged flash blocks immediately so the card does not overheat or lock up, and then retry bad sectors up to 3 times at the end.
   • sdcard_rescue.map saves your exact progress every few seconds. If the USB reader disconnects or the power goes out, running the exact same command resumes seamlessly from where it stopped without re-reading already rescued sectors.
4. Make a working copy or mount the .img file read-only: Once sdcard_raw_clone.img finishes at 100.00% rescued, eject your physical SD card and store it in a safe drawer. You will perform 100 percent of your recovery work on sdcard_raw_clone.img.

Phase 3: Executing file recovery (Logical Metadata Reconstruction vs. Raw Carving)¶

Once you have a safe .img file (or a hardware write-blocked drive), there are two completely different technical methods to extract your deleted data. You should always attempt Method A (Logical File System Reconstruction) first before falling back to Method B (Raw Signature Carving).

Kgato ka Kgato 1: Go Busetsa Karolo e e Phimotsweng kgotsa Lekala la Boot le le Senyegileng ka TestDisk¶

Fa drive ya gago ya kwa ntle kgotsa karata ya SD e botsa ka tshoganyetso "O tlhoka go fometa disiki mo drive E: pele o ka e dirisa" kgotsa e bonala e le RAW / Unallocated mo Disk Management morago ga go ntshiwa mo polakeng kwantle ga go e ntsha ka pabalesego, difaele tsa gago ga di a phimolwa gotlhelele. Go na le moo, Rekoto ya Boot ya Motheo (MBR), Lenaneo la Karoganyo ya GUID (GPT), kgotsa Lekala la Boot (BPB) e ne e sentswe.

1. Tsamaisa TestDisk kgatlhanong le faele ya gago ya setshwantsho se se kopisitsweng:

   testdisk /mnt/backup/sdcard_raw_clone.img
   

2. Tlhopha Tswelela -> tlhomamisa mofuta wa lenaanethalo la karoganyo (Intel/PC bakeng sa dikarata tsa MBR SD tse ka tlase ho di-terabyte tse 2, kapa EFI GPT bakeng sa di-drive tse kgolo tsa sejwalejwale).
3. Tlhopha Sekaseka -> Patlo ka bonako.
4. TestDisk e tla sekaseka ditlhogo tsa karoganyo ya bekapo (tse di jaaka lekala la go simolola la NTFS la bekapo e e itirisang le le bolokilweng mo lephateng la bofelo la bolumu ya NTFS, kgotsa lekala la go simolola la FAT32 la bekapo mo lephateng la 6).
5. Tlhaola karoganyo e e bonweng o bo o tobetsa P (Difaele tsa Lenaane). Fa ka bonako o bona ditsholadifaele tsotlhe tsa gago le difaele di kwadilwe di sa senyega mo teng ga fensetere ya theminale:
   • O se ke wa tshwenyeha ka ho ngola hape tafole ya karohano haeba o batla difaele feela. Tobetsa fela C mo ditsholadifaeleng tse o di batlang mme o di kopolole ka tlhamalalo go ya kwa polatefomong ya gago e e itekanetseng ya lefelo le o yang kwa go lone le le nang le maina a difaele a ntlha a diperesente di le 100 le dibopego tsa ditsholadifaele.

Kgato ka Kgato 2: Go Sekaseka Tshedimosetso e e Utlwalang ka go Dirisa DMDE, R-Studio, kgotsa UFS Explorer¶

Fa difaele di ne di phimolwa ka Shift + Delete, emptied from the Recycle Bin, or wiped via a standard Quick Format:

1. Bula .img faele mo teng ga DMDE (kgatiso ya mahala e busetsa difaele di ka nna 4 000 ka tiro ya lenaanethalo; laesense e e feletseng ga e ture), R-Studio, kgotsa Puso ya Tlwaelo ya UFS Explorer.
2. Check the Existing Virtual File System Tree First:
   • On NTFS drives, each file has a 1,024-byte (1 kilobyte) record in the Master File Table ($MFT). Even when a file is deleted, its $MFT slot remains marked with an inactive flag (0x00 instead of 0x01) containing the exact filename, parent directory ID, and exact starting cluster and length runs, until a new file reuses that $MFT slot. Furthermore, files smaller than ~700 bytes (such as brief text notes, crypto keys, or small scripts) are stored resident entirely inside the $MFT record itself and rarely get overwritten quickly.
   • Look in the $Root or Deleted / Found virtual folder generated within the first 5 seconds of opening the partition. If your files appear with a red x or trash icon and show a healthy size, select them and click Recover to your separate destination drive immediately.
3. Run a Full Volume Scan if the Directory Header Was Overwritten:
   • If a Quick Format overwrote the root directory or the first few megabytes of the $MFT, dira Sekene sa Bolumo e e Tletseng. Sofotewere e tla sekaseka setshwantsho sotlhe go bona dinoutu tsa tshupane tsa lenaanepotlana tse di sa ntseng di le teng (INDX di-buffer mo NTFS, diketane tsa setlhopha sa di-subdirectory mo FAT32/exFAT, kgotsa mafelo a bogologolo a go tlhola kgwebisano mo APFS/ext4) le go kopanya metadata e e utlwalang le go lemoga mosaeno wa faele e e tala.

Step-by-Step 3: Raw File Carving with PhotoRec (Fa Metadata e Senngwa Gotlhelele)¶

When the File Allocation Table (FAT) or $MFT has been completely zeroed out by a format, logical directory pointers are gone, leaving only the raw file contents sitting in unallocated data clusters. PhotoRec (bundled alongside TestDisk, completely free, open-source, and available for Windows, macOS, and Linux) excels at carving over 480 file formats (including Canon .CR2/.CR3, Sony .ARW, Nikon .NEF, Adobe .DNG/.PSD, .JPG, .PNG, .PDF, .DOCX/.XLSX zip containers, and .SQLITE databases):

1. Launch PhotoRec against your disk image:

   photorec /mnt/backup/sdcard_raw_clone.img
   

2. Select the target partition (or Whole disk if the partition table was wiped).
3. Before starting, go to [File Opt] at the bottom of the screen:
   • Tobetsa s to deselect all 480 file types if you only care about specific files (for example, check only jpg, cr2/cr3, tif for raw photos, mov/mp4, and zip/docx), which drastically speeds up recovery and prevents false-positive garbage fragments.
4. Select [Options] -> keep Keep corrupted files : No unless recovering damaged video streams.
5. Select [Search], choose file system type [Other] (for FAT/exFAT/NTFS/HFS+), and select [Free] (if you only deleted files on an active partition) or [Whole] (if the partition was formatted).
6. Choose a destination folder on your separate large backup drive and press C to begin carving.
7. Post-Recovery Sorting for PhotoRec Output: Because PhotoRec saves files as f123456.jpg across dozens of recup_dir folders, you can automatically reorganize all recovered photos into clean YYYY/MM-Month/ folders with their exact camera timestamp filenames using the free command-line tool ExifTool:

   exiftool "-Directory<DateTimeOriginal" -d "%Y/%Y-%m-%d" -r /mnt/backup/photorec_output/
   

Specialized recovery: fragmented camera MP4/MOV videos (GoPro, DJI Drones, Sony, Canon)¶

One of the most frequent frustrations after running PhotoRec or standard file recovery software on a formatted camera card is discovering that 100 percent of the recovered .JPG le .RAW photos open perfectly, but every single recovered .MP4 kgotsa .MOV video file refuses to play (0:00 duration or black screen).

Why Standard Recovery Software Breaks Modern Camera Videos¶

1. Interleaved Stream Recording: Modern action cameras (GoPro Hero series, DJI Air/Mavic/Mini drones, Insta360) and cinema mirrorless cameras do not write a single .MP4 file sequentially from start to finish. While recording 4K or 5.3K video, the camera simultaneously writes a high-resolution .MP4 stream, a low-resolution preview .LRV molapo, sethibela-modumo, le metadata ya telemetry go nna ditlhopha tse di refosanang mo karateng ya exFAT/FAT32 (ka sekai: di-megabyte di le 4 tsa bidio ya resolushene e e kwa godimo, e e latelang ke di-kilobyte di le 512 tsa .LRV preview, followed by 4 megabytes of high-res video).
2. Missing moov Atom in Unfinalized Recordings: If your drone crashed into water, your camera battery died mid-recording, or the SD card disconnected before you pressed the Stop Record button, the camera never wrote the moov atom (the master index table written at the very end of an MP4/MOV file that tells media players where every video frame and audio chunk sits).

How to Rebuild Unplayable or Fragmented Camera Videos¶

1. Case A: Unfinalized Video After Battery Loss or Crash (File Exists on Card, Shows Multi-GB Size, Won't Play):
   • The clusters are intact in the file system, only the moov index header is missing.
   • Use the free, open-source tool untrunc (specifically the anthwlock/untrunc fork) or recover_mp4 (slydiman). Provide untrunc with one healthy, playable reference .MP4 recorded on that exact same camera with the exact same resolution and framerate settings, alongside your broken .MP4:

     untrunc reference_working_video.MP4 corrupted_unfinalized_video.MP4
     

   • untrunc reads the codec parameters (avcC/hvcC and audio track layouts) from the working reference video, scans the raw H.264/H.265/HEVC NAL units in your damaged file, and synthesizes a brand-new moov atom in seconds.
2. Case B: Formatted SD Card with Interleaved / Fragmented Video (GoPro, DJI, Sony, Canon):
   • Because the FAT/exFAT cluster map was wiped during formatting, a standard carver grabs the ftyp/mdat tlhogo ya bidio ya gago ya 4K mme o bo o kopolola ka bofofu .LRV preview clusters and thumbnail clusters right into the middle of your video file, corrupting every single second of footage.
   • Instead of standard carvers, scan your sdcard_raw_clone.img using a fragmentation-aware video reconstructor that recognizes camera-specific cluster allocation cadences, such as SanDisk RescuePRO Deluxe (which includes specific GoPro/drone fragmented video assembly algorithms), Klennet Carver, or Disk Drill 5+ (which includes a dedicated GoPro/DJI fragmented video signature reconstructor).

Smartphone photo deletion: iOS (iPhone) and Android hardware encryption realities¶

A common and dangerous misconception is that you can plug a modern iPhone or Android smartphone into a laptop via USB and run traditional disk carving software (like Recuva or PhotoRec) on the phone's internal storage.

Why Traditional Sector Carving Cannot Read Modern Phones¶

Every iPhone since the iPhone 3GS (and all current iOS devices) uses Data Protection (File-Based Encryption) powered by a dedicated hardware AES crypto engine between the flash storage and main system memory. Similarly, every Android device shipped since Android 7.0+ (and mandatory since Android 10) uses File-Based Encryption (FBE) backed by the hardware Keystore/Titan M/Knox chip.

On both platforms, every single individual photo and file on the internal storage is encrypted with its own unique per-file cryptographic key. When a file is permanently purged from the phone's file system, the phone does not even need to erase the multi-megabyte photo blocks; it immediately destroys the 256-bit per-file encryption key in the metadata table. Without that key, the raw NAND blocks contain cryptographically unbreakable random noise. Even top-tier government forensic labs cannot "carve" permanently deleted photos from the internal flash of a modern iPhone or Android once the per-file key is wiped.

The Actual Recovery Paths for Deleted Smartphone Photos¶

Because hardware encryption blocks raw carving, recovering deleted photos from an iPhone or Android relies on recovering copies before retention timers expire or extracting cached thumbnail databases:

1. Check the On-Device "Recently Deleted" Album Immediately (30-Day Window):
   • iOS (iPhone / iPad): Open Photos -> scroll down to Utilities -> tap Recently Deleted (requires Face ID / Touch ID / Passcode). Photos stay here for 30 days before permanent key destruction.
   • Android (Google Photos / Samsung Gallery): Open Google Photos -> Library / Collections -> Trash / Bin (retained for 60 days if backed up, 30 days if device-only). Also check Samsung Gallery -> Menu (three lines) -> Trash (retained for 30 days), and open the Files by Google or My Files app -> Trash, which maintains a separate 30-day trash folder.
2. If You Deleted Photos from "Recently Deleted" on iPhone, Call Apple Support for an Emergency iCloud Server-Side Restore:
   • Many users do not realize that even after you manually click "Delete from All Devices" / "Empty Recently Deleted" in iCloud Photos, Apple's backend servers retain a soft-deleted server recovery buffer for a brief window (typically up to 7 to 14 days after permanent deletion).
   • Contact Apple Support immediately by phone or chat, ask to speak with a Senior Advisor, and ask them to trigger an iCloud Photo Library Server-Side Recovery on your Apple Account. They can frequently flip a server switch that dumps recently purged iCloud Photos right back into your album within 15 minutes.
3. Restore from an Older Unsynced Device or Encrypted Local Backup:
   • Airplane Mode Trick on Secondary iPad / Mac: If your iPhone synced a deletion to iCloud, grab your iPad or MacBook before it connects to Wi-Fi (turn off your home Wi-Fi router unplugging the power cord first if the iPad is asleep on your desk). Power on the iPad in total radio isolation, copy the still-present photos via USB cable or AirDrop to another device before the iPad receives the iCloud deletion push command.
   • Check iCloud Backup vs. iCloud Photos: If you had iCloud Photos turned OFF (Settings -> [Your Name] -> iCloud -> Photos -> Off), your Camera Roll is included inside your nightly iCloud Device Backup. You can wipe an old spare iPhone (or temporarily back up and reset your current iPhone) and restore the nightly iCloud Backup from before the moment you deleted the photo.
   • Check Local Finder / iTunes Backups on Your PC or Mac: Check ~/Library/Application Support/MobileSync/Backup/ on macOS or %APPDATA%\Apple Computer\MobileSync\Backup\ on Windows. You can browse and extract photos from old local backups without overwriting your phone using iMazing or iBackup Viewer.
4. Check Messaging App Local Caches (WhatsApp, iMessage, Telegram, Signal):
   • Did you ever text the deleted photo or video to a spouse, friend, or family group chat? Messaging apps store independent copies of media inside their own application sandboxes (Media/WhatsApp Images/Sent on Android, or inside chat attachments in iMessage). Even if you delete a photo from your main Camera Roll and empty the Trash, the copy inside your WhatsApp Sent folder or iMessage thread history remains completely untouched.

Cloud drive and enterprise accidental deletion recovery (Google Drive, OneDrive, Dropbox)¶

When an entire shared folder disappears or is overwritten on a cloud drive (or when ransomware or a syncing glitch deletes local files and syncs the deletion to the cloud), local disk recovery is often unnecessary because enterprise and consumer cloud platforms maintain multi-tier version histories:

1. Microsoft OneDrive & SharePoint Online:
   • First-Stage Recycle Bin (onedrive.live.com): Retains deleted files for 30 days on personal accounts and 93 days on Work/School accounts.
   • Second-Stage Site Collection Recycle Bin (Work/School): Even if an employee or hacker empties the main OneDrive Recycle Bin, click the link at the bottom of the Recycle Bin page labeled "Second-stage recycle bin", where purged files remain recoverable for the remainder of the 93-day window.
   • Restore Your OneDrive (Point-in-Time Rollback): Microsoft 365 subscribers can click Settings (gear icon) -> Options -> Restore your OneDrive, which uses a visual histogram slider to roll every single file, rename, and deletion across the entire cloud drive back to any exact minute within the last 30 days.
2. Google Drive & Google Workspace:
   • Google Drive Trash (drive.google.com/drive/trash): Retains deleted files for 30 days.
   • Go Busetsa Matlakala ga Motsamaisi wa Lefelo la Tiro la Google (Fensetere ya Mohau ya Malatsi a le 25): Le fa modirisi a sena go tobetsa "Phimola Ruri" le go ntsha Matlakala a gagwe a Google Drive, Motsamaisi wa Lefelo la Tiro la Google (kgotsa modirisi ka bongwe yo o ikgolaganyang le Tshegetso ya Google Drive mo diakhaontong tsa gagwe tsa Google One) a ka kgona go bula (Go Conadmin.google.com)** -> Directory -> Users -> [Select User] -> More Options -> Restore Data, and restore permanently purged Google Drive files and Gmail messages for up to 25 additional days after the Trash was emptied.
3. Lebokoso la go latlhela:
   • Deleted Files (dropbox.com/deleted_files): Retains deleted files and folders for 30 days on Basic/Plus/Family plans, and 180 days to 1 year on Professional/Business plans.
   • Dropbox Rewind (dropbox.com/rewind): Allows rolling back an entire folder or the entire account to undo mass deletions, accidental drags-and-drops, or encryption events.

Dipotso tse di bodiwang kgapetsakgapetsa¶

Metswedi e tlhotlhomisitswe¶

• National Institute of Standards and Technology (NIST, United States): Special Publication 800-88 Revision 1, Guidelines for Media Sanitization (ATA TRIM, NVMe Deallocate, and NAND Flash Translation Layer behavior) and Computer Forensics Tool Testing (CFTT) Program Disk Imaging Specifications (csrc.nist.gov).
• Cybersecurity and Infrastructure Security Agency (CISA, United States): Data Backup, Forensic Preservation, and Incident Handling Guidelines (cisa.gov).
• GNU Project / Antonio Diaz Diaz (International): Official GNU ddrescue Manual: Data Recovery Tool and Block Device Mapfile Algorithms (gnu.org/software/ddrescue).
• CGSecurity / Christophe Grenier (International): TestDisk & PhotoRec Official Documentation: Partition Recovery and File Carving Signatures (cgsecurity.org).
• Apple Platform Security (United States): FileVault, Data Protection Classes, Per-File Encryption Keys, and APFS Trim Architecture on Apple Silicon and T2 Systems (support.apple.com/guide/security).
• Android Open Source Project (AOSP, International): File-Based Encryption (FBE) and Metadata Encryption Architecture (source.android.com/docs/security/features/encryption).
• SD Association (International): SD Specifications Part 1: Physical Layer Simplified Specification (Erase Commands CMD32, CMD33, CMD38 and Write-Protect Mechanical Switch) (sdcard.org).

Dikaedi tse di tsamaelanang¶

• Go palelwa ga hard drive le go busetsa tshedimosetso
• Computer backups: 3-2-1 strategy and disaster recovery
• Ransomware and malware
• Broken or water-damaged phone
• Linux system boot failure and GRUB repair
• Windows Blue Screen (BSOD) and boot repair