Post by Mayayana......
Interesting results here. EaseUS sess all the files,
takes a ridiculous amount of time, but will recover
up to 500 MB.
Con: $70 to do more. YThat seems absurd for a
FAT32 analyzer. There must be something else free
that can do the same thing.
Recuva, Minitool and Kickass all found olny corrupt
files. Minitool claimed to save out 1 GB worth but
they were all nonsense.
So I'm still looking for a highly competent, free
undelete. I don't mind paying for important software,
but recovering deleted files shouldn't be so expensive
and I can't believe that someone hasn't created a
free version. On the bright side, I have an SD card to
experiment with. Anything that can find all those
photos for free wins the contest. :)
The claim here, is it works on FAT.
No mention of NTFS ?
https://en.wikipedia.org/wiki/Undeletion
I tried this one in a simple test, and it
worked. But the test case was carefully controlled
or contrived, so it couldn't help but get the right
result :-)
https://www.cgsecurity.org/wiki/PhotoRec
(Doesn't rely on file system)
Here is another.
https://www.ccleaner.com/recuva
Seems to offer a free version.
No indication it springs they ole "$39.95 please" trick.
In the picture here, the "red" entries indicate cluster
overlap.
https://en.wikipedia.org/wiki/Recuva
Yes, you can flip the single byte that controls
deletion in a FAT entry, but if the cluster numbers
in that entry happen to overlap, that means a write
done after the deletion, has reused the clusters already.
Even if the FAT entry itself is still intact.
I had some other tool, which I can't find a reference to
now, that has text for each file, with words like "good"
indicating no cluster overlap and damage due to subsequent
write operations.
And this is where programs like Photorec take
over. They might not even rely on the FAT, instead
scanning for identifying information. But if the
files are fragmented, and don't fit a single cluster,
then you can't expect the files to make any sense.
The information inside a file, probably isn't sufficient
to reassemble all the pieces. Only a file format that
made some assumptions about storage could do that. Like
writing a GUID into every 4KB segment or something.
And I'm not aware of any file formats that do that.
So if Recuva showed "Red" for everything, or a text
listing of files indicates "Bad" or "overlap" or the
like, then probably too many writes have been done
to the partition, since the event.
If I was doing that here, I'd probably "image" the SD
to a file and work on the "image" rather than the SD
itself. As any scans might work faster. And getting that
to work, would be its own little project, since the
typical imaging situation only captures "visible" files
when imaging. If using Macrium, Smart Copy would have
to be turned off, and I've been let down by tools and
their "dumb copy" option before. If a dumb copy takes two hours
normally, and some tool does it in only ten minutes,
then you know the tool doesn't actually work properly.
Paul