East Imperial Soft
September 25, 2014
Flash Data Recovery: Inside SD Cards Part II
There is something unique about how SD and Compact Flash cards store and organize data. Built-in microcontrollers and wear leveling mechanisms not only prolong the life of the flash storage device, but they can help recover lost data. Read how to choose a data recovery tool and how to use it to take full advantage of the way SD and Compact Flash cards organize information.
This article continues Flash Data Recovery: Inside SD Cards Part I.
In the first part of the series, we discussed how wear leveling works in SD cards. Let’s have a look at how wear leveling affects data recoverability.
Wear Leveling and Data Recovery
See what this means? After shooting the first photo session of 1.5GB, the user deletes the data. Now another 2GB of data are written onto the same SD card. If no wear leveling would be available, the new data set would simply overwrite the original data. However, as most SD cards do implement wear leveling, there is a very high chance of new data being written into fresh memory cells, with the original data becoming remapped but still available on that card.
As a result, running a full scan of the memory card may reveal that at least some data from the first photo session is still available for recovery.
What about Compact Flash?
Similar to SD cards, Compact Flash storage is also equipped with a built-in controller. Better yet, Compact Flash cards have more advanced controllers conforming to ATA interface, appearing to your computer as regular hard drives of a kind. Compact Flash specification includes wear leveling, so every CF card in existence should use wear leveling calculations before writing new data. As a result, when recovering from Compact Flash cards, you may get the same level of recoverability as from an SD card.
Software to Use When Recovering Data from SD/CF Cards
While you could use any tool to attempt the recovery, the only ones that really work are those that support content-based recovery. If you followed this article and not simply skipped to the end, you’ll realize that there is no fixed relation between physical memory cells and logical addresses in an SD card. As a result of dynamic remapping, file system records point to existing files, but any deleted records may point to random physical cells after some new data was written. (This is not the case if you deleted a file and want to immediately undelete it without writing anything else). As a consequence, you generally should not rely on the file system when it comes to recovering data. Use a tool that supports file carving, signature search, or content-aware recovery (which are basically different names for the same technology).
Content-aware recovery reads the entire content of the memory card and matches raw data against a database of known file types. If a familiar signature is encountered, content-aware recovery algorithm picks up these blocks and attempts to reconstruct a file. This technology really works. If you’ve never seen it working, download Magic Photo Recovery and see what it can find on your ‘empty’ memory card.