Skip to content
February 14, 2008 / tshrinivasan

Recover Deleted files from Memory Card

    I use my Sony Ericsson W700i mobile extensively. It became my third hand. I take photos, record speeches as video and audio,  enjoy MP3 music and podcasts etc.

I have 1GB memory card and it is always filled with the stuff above mentioned.

Recently, I deleted all files in my memory card, unfortunately. Alas! All my stuff wiped out from memory card.

I gave the command to delete them all.

rm -rf * /media/disk

What to do?
How to recover them all?
Is there any way to recover the deleted files from a memory card?

There are some costly windows tools available for this.

Who needs Gates, in a world of no fences?

Google is my friend and ubuntu is my lover.

Got this link
https://help.ubuntu.com/community/DataRecovery

There are some bunch of tools available in Linux for Data recovery.

  • dd
  • mount
  • PhotoRec
  • foremost
  • sleuthkit.

All helped me a lot.

First thing I did is “Take a image of memory card“.

So,
   

dd if=/dev/sda of=my_card.img bs=512

The file my_card.img is the extract copy of my memory card.
It has everything, but as deleted files.

Next, tried PhotoRec tool. It is a wonderful tool which can recover almost all type of files from the memory cards.

How to recover lost files after you accidentally wipe your hard drive


I installed PhotoRec from ubuntu repositories.

sudo apt-get install testdisk

Now scanned the image with photorec

photorec my_card.img

It recovered all the JPG and GIF files from the image file.
Wow. Great tool indeed!. Isn’t it?

Now I got all my pictures and mp3 files recovered.

So, what next? Looked for my 3gp(video) files and amr(audio) files.
Hmmmm. No. Nope. There are no 3gp and amr files recovered.

what to do? I need them all. I had a nice collections of 3gp and video files.

m. search Shrini. search!

Oops. Googles gives me only loads of windows tools.

If a proprietary tool can do a thing well, then Open Source tool will do it in a better way.

So, next, tried the tool foremost.

Installed as

sudo apt-get install foremost

and scanned the image file as
   
   

foremost my_card.img

Great. It created a directory called “output” and put all the image, and mp3 files separately.
It is same as PhotoRec only. No big difference.

Still I am in the need to recover amr and 3gp files.

There are still some tools in my toolbox.

Let me try, sleuthkit.

sleuthkit? what is this?

Installed as

sudo apt-get install sleuthkit

But, there is no command called sleuthkit.

so what is this tool?

        “Extract unallocated (deleted) blocks from a disk or disk image”

dls inputimage > outputimage

        “Use any tool to search the output image for files.”

It seems to give some hope. what is dls?

man dls” says that dls – disk data recovery.

so tried as

dls my_card.img > new_image.img

It showed me a lot of junks and finally a new file is created.
But, what to do with that file?
can not mount as loop back device too.
showed error when mounted.

So, No hope to recover my 3gp and amr files?

Let me see the site of sleuthkit.
http://www.sleuthkit.org/sleuthkit

sleuthkit is a collection of many tools.

Reading the docs and Tool Details page of the sleuthkit.

http://www.sleuthkit.org/sleuthkit/tools.php
http://www.sleuthkit.org/sleuthkit/docs.php

The description page
http://www.sleuthkit.org/sleuthkit/desc.php

hey. see there! FAT recovery is there.
try that link.

http://www.sleuthkit.org/informer/sleuthkit-informer-14.html#recover

This pages tells about two tools

  1. fls
  2. icat

man fls says as
       fls – List file and directory names in a forensic image

man icat says as
       icat – copy files by inode number

It seems that fls and icat can recover my files.
Let me try.

fls -f fat -r my_card.img | less

Wow. This displayed all the files in the images recursively. ( “-r” for recursive; “-f fat” for filesystem)
 
I can see all the file names of everything in that card. JPG, GIF, MP3, amr, 3gp… everything.
Now only some hope come. I can recover them.

Let me try icat.

icat will recover any file from a image, if you say the inode no of the file.
How to get the inode no?

The tool fls itself tells the name and inode no of the files.

fls -f fat -r my_card.img | grep 3gp

This returns as follows.

++ r/r * 9743: Baby Munbea.3gp
+++ r/r * 9746: God Loves you.3gp
+++ r/r * 9748: Ratcagan.3gp
+++ r/r * 9750: VideoDJ.3gp

Now, I know the inode no of the files inside the image file. 
So, To recover the file Ratcagan.3gp, I got it inode no 9748. Try with icat.

icat -f fat -r my_card.img 9748 > Ratch.3gp

What a Surprise?
I got it.
icat recovered my 3gp file.

Like this, I recovered all the 3gp and amr files by giving their inode no manually, one by one.

Thus, Open Source tools proved that CAN DO ANYTHING.

Powered by ScribeFire.

About these ads

144 Comments

Leave a Comment
  1. Bharathi Subramanian / Feb 15 2008 12:54 am

    Very useful Tip. Thanks Srini.

    • chris / May 28 2013 12:22 pm

      For me, I’d like to follow step by step memory card data recovery guide to recover files from memory card. Last time when I accidentally deleted files from memory card, I search and found this memory card data recovery tutorial
      http://www.asoftech.com/articles/sd-card-recovery.html

      The tutorial is very easy to follow and works well for me. So I guess that you may want to have a try.

    • IvyBray / Mar 7 2014 12:39 pm

      I think you also can try Myjad Data Recovery Wizard.It is similar to the software you introduced.

  2. Gilbert Raja / Feb 15 2008 3:26 am

    hai fantastic tip, keep it up the good work..

  3. verman / Feb 15 2008 5:12 am

    Really a very good recovery tool

    thank you

  4. Ken Otterson / Feb 24 2008 11:29 pm

    Maybe you can help me . I am a computer novice using IMac with OSX. Recently I took some video on once in a lifetime trip to Mexico, with an Aiptek digital camcorder and 1GB Kodak memory card. I downloaded to the computer with delete original command. Of course later I threw out files and emptied trash. I was wondering if there is a way to recover files on memory card, without spending a lot of money. Thanks, Ken

  5. roger / Feb 28 2008 3:45 am

    Would recovery be possible, if videos are not “physically” saved to the memory card is the first place?

    I was shooting some video scene using Nokia 6110 navigator, and closed the camera cover before clicking on the “STOP” button. As a result, no indication of video file being saved, and no file of that video can be found in the folder.

    I suppose recovery is only possible if the phone does write the video data to a temporary cache folder somewhere, before the data is committed to a physical file upon confirmation (on saving).

    Any thoughts? Thanxs for any feedbacks.

    Cheers,
    roger

  6. tshrinivasan / Feb 28 2008 11:55 am

    Hi Roger,

    I dont think we can recover a unsaved video.

    Sluethkit can recover if you provide the inode number of the file in a memory disk.

    Since, you are not saved any file, there wont be any inode no allocated for that file.

    This is my thought. Ask for your Linux User Group friends and forums like linuxforums.org and ubuntuforums.org.

  7. roger / Feb 28 2008 4:21 pm

    Hi Tshrinivasan,

    Thanxs for your reply.

    I thought the same too. The “cache” area is probably like PC’s RAM, where nothing is stored permanently, and will be “overwritten” when subsequent applications are executed.

    Oh well, a lesson learned. :P

    Thanxs for your help.

  8. FN / Mar 11 2008 2:21 pm

    Could you please give me the recipe for an ORF file. I have lost a batch of ORF files which I am trying to currently retrieve? FN

  9. Shrinivasan / Mar 11 2008 6:21 pm

    Hi FN,

    1. install sluethkit
    2. make dd image of your card. i.e my_card.img

    3. fls -f fat -r my_card.img | grep ORF
    4. note down the inode numbers.

    sample recover from inode no
    5. icat -f fat -r my_card.img 9748 > Ratch.3gp

    reply, if you have any doubts.

    surely you can recover.

    wishes.

  10. Kaushik / Mar 12 2008 6:51 am

    Hi shrini,

    This is really a good data recovery guide u have presented here.

    I had once used testdisk to recovery data from a damaged thumb drive and was successful in getting recovering them, but photorec does not give names and file extentions for many files, ie it generalizes the extension like for most of the MS document file (*.ppt, *.pps, *.xls, etc) it will output as *.doc only.

    But photorec as name suggets recovers images beautifully. But the tutorial what u have presented here is way beyond any professional tools and guys do ripping pockets of hunderds of Rs/-.

    Thanks and keep up the wonderful work for the community.

    regards
    Kaushik S

  11. ed wiget / Mar 25 2008 3:23 pm

    I have several articles on using open source tools for data recovery at the MLUG web site http://www.maysville-linux-users-group.org in the downloads section – presentations

    You may want to check out autopsy, which could mount your created image and allow you to browse and export files it finds — tutorial on the link above.

  12. Amund Sjaavaag / Apr 13 2008 9:36 pm

    I just wrote a small script that updates the date of jpeg-files.

    When the files are recovered, my experience is that the file names and dates are corrupted.
    When you organize your pictures, the time and date of the files, might be important.

    #!/bin/bash
    for imagefile in $*; do touch -t $(exif -m -i $imagefile | grep 0×0132 | awk ‘{split($2$3,f,”:”); print f[1]f[2]f[3]f[4]“.”f[5]}’) $imagefile; done

    If you save this text in a file, like ~/bin/datetouchimage, then you can update your jpg-files like this:
    ~/bin/datetouchimage *jpg
    This script requires that exif is installed.
    To see the resault, you can do a ls -la before and after running it.

  13. Krishnan R.S. / Apr 24 2008 4:41 am

    Nice work Shrini. dd is your best friend – ever. Specially if you use Windows and need to recover some stuff from a dead disk. The combination of Knoppix/cd-rom boot and dd saves me tons of heartache!

  14. Robert / May 14 2008 1:45 am

    I have a Sony portable with windows and Ubuntu Linux. I installed the 8.04 Ubuntu update and inadvertently repartitioned the whole hard disk and lost all my WindowsXP files and data.

    I have a USB hard drive to back up to but have found the Ubuntu rescue software confusing.

    Any advice on the best way to recover as much XP data as possible in the simplest way??

    Thanks

    Robert, Alaska USA

  15. Anbumani / May 25 2008 2:25 am

    Hi shrini,

    It was amazing great job. I too will recovery my deleted datas.. Thanks a lot,,

    Keep going..

  16. firoz / Jun 3 2008 9:00 am

    i had a very imp recording 3gp file in my mobile sony w700i somebody deleted it purposefully the file is very imp my future life depends on it.i will go to any part of country to recover it the file was saved on a brand new scandisk 1 gb card i have not used that card after that please help me please help me for god sake please help me to reover the file my contact number is 9970660126 my mail id is fas786@zapak.com please help i will be grateful to you all my life

  17. Rajesh / Aug 19 2008 12:49 am

    Thanks for the detailed instructions and hope that deleted files could be recovered.

    I tried the steps but could not recover mine. I kept getting error
    when I executed command
    icat -f fat -r my_card_sda1.img 47669 > myFile.3GP

    Error recovering deleted file (Starting cluster of deleted file is allocated.

    Has anyone come across such problem and managed to go past it to recover files?

  18. Christophe Grenier / Aug 23 2008 8:50 am

    Hi,
    TestDisk 6.10 has a FAT undelete feature.
    Run “testdisk my_card.img”, in Advanced, choose Undelete, select the files and directory to recover and press ‘c’ to copy them.
    Otherwise since PhotoRec 6.10, amr and 3gp are recovered.

  19. TELZ / Sep 21 2008 9:59 am

    will u pls. help me..i have deleted my important filies in my usb.how can i recover it.?

  20. Meghan / Sep 22 2008 10:44 pm

    Hey!! I was making this video and my dad clicked X and DIDN’T SAVE IT! Dang him! Can I get it back?

  21. sharon / Jan 12 2009 6:54 am

    hi tshrinivasan,

    can u teach me the step how to recover my 3gp video deleted in my memory card?
    urgently tshrinivasan…
    thanks alot…

  22. Maddyk / Jan 24 2009 2:30 am

    Will it work on n70 i cant able to download

  23. engrost / Jan 31 2009 9:00 pm

    Thanks a lot. Great article / live saver ;)

  24. murtuja / Feb 2 2009 8:49 am

    I am able to recover file.
    But while trying to run it through QuickTime Player.
    it is not working.
    I am getting following message.
    Error -2048: the file is not movie file.

  25. Guess / Feb 19 2009 1:25 am

    Hello

    Please help me, I can’t make image of memory card.The command is not working.I need to recover important files.

    I have dd version 5.0 for windows and I use Vista.And my memory card is 1 Gb.What can be the reason for problem?

  26. Prabh / Feb 25 2009 9:49 am

    Thanks a lot.
    Love Linux..:)

  27. jPax / Mar 1 2009 3:27 am

    You are my savior. I was deleting a folder named “SYSTEM” in a brother-in-law pen drive, and I forgot SYSTEM after /media/PENDRIVE hehehe

    Half hour later, I found your marvelous post. THANKYOU!! and yes, Ubuntu is my lover too (^^,)

    Thankyou very, very much. I didn’t know this blog.

  28. Bindu / Mar 31 2009 4:50 am

    Hi,

    Can you help me recover my amr files from my nokia cell? Am not well versed in Linux so cant get much from the instructions.

  29. Someone / Apr 27 2009 4:05 pm

    Are you guys all nuts?? I am not any kind of programmer. And I am saying that that must not be a user friendly software. I cannot even understand what the fuck you the readme.txt talking about. There is no anything like setup.exe. I just want to recover my .amr files. Do I need to study three years of C++ and C# and assembly language to make it possible??

    • ingumsky / May 23 2009 3:02 pm

      Pf-f-f… If you can’t do that and don’t want to learn anything pay some pennies for those who can. There’s no lads obliged to teach you.

  30. Someone / Apr 27 2009 7:02 pm

    **GUIDE LINES FOR NORMAL PEOPLE**

    ok, after some hours of working, i found that readme.txt expect everyone on this earth is computer expert. here is the step.

    1.Build a .img for your memory card, use Stellar Phoenix Windows Data Recovery is a good choice.

    (Notice: We still need to go onto the next step because Stellar Phoenix Windows Data Recovery cannot recover all file type)

    2.Download sleuthkit-win32-3.x.x.zip

    3.Unzip the folder to C drive, rename it “tool”

    4.Go to prompt (Start->Execute: cmd)

    5.Type cd C:/tool/bin (by the way, i don’t think a young girl who just want to recover .amr files knows the command “cd”)

    6.Copy the .img to the bin folder

    7.fls -f -r xxx.img (xxx represent the .img name)

    All type of files even including thumb.db is displayed

    In fact, I still lost all my .amr files T_T..(cry). It shows me the songs and the photos but no .amr finally. Anyway, I just want to help someone who visit this site and cannot understand the nuts’ language.

    • Bindu / May 19 2009 4:06 am

      Hi,

      Thanks for the reply.
      I have downloaded Stellar Phoenix Windows Data Recovery bt am unable to create that img file.
      Perhaps I have a trial version only — do you know if there is a free version or only paid is available?

      Thx

  31. ingumsky / May 23 2009 2:59 pm

    Thank you very much! It’ very useful.

    Linux and open-source rule as ever.

  32. KarDave / Jun 22 2009 8:44 pm

    photorec woked for me, thanx!

  33. saravanan / Jun 26 2009 1:44 pm

    hi
    is it possible to recover deleted files from mobile memory (built in)not memory card?????????pls rply me iam using nokia

  34. Langleyo / Jul 14 2009 10:31 am

    Hi Shrini,

    Thanks for the howto… any thoughts on doing this as a PDF file for us noobs who have to keep looking on the internet please? Would be nice to save the destructions on my hard drive to refer to when I don’t have internet access. :-)

    On my Ubuntu Hardy Heron – Toshiba Satellite system I had to find the memory card like this: (I used system -preferences-partition editor to find the device which showed as /dev/mmcblk0p1). For some reason I’m not sure about, I had to remove the “p1″. Try sudo if it wont run on its own.

    foremost -t jpeg -i /dev/mmcblk0

    which created a folder in my directory with the appropriate jpegs.

    Hope this helps someone.

  35. kolio / Jul 29 2009 3:31 pm

    Thanks man, you just saved my life!!!!

    • tshrinivasan / Jul 29 2009 3:47 pm

      Hi,

      Happy to know that this article helped you.

  36. Nadeer / Aug 1 2009 7:03 am

    hi
    is it possible to recover deleted files from mobile memory card, which was deleted one month before…. kindly advice ,,,,, as i’m in a great trouble… your earliest reply will be highly appreciated ….. thanking you

    hopefully
    Nadeerudhin.v.p

  37. manu k raj / Aug 13 2009 6:30 am

    i need my digital cameras deleted fils
    plz help me……….
    i wat a solution

  38. stefan / Sep 3 2009 2:52 pm

    Thanks man!

  39. Dint / Sep 7 2009 3:20 pm

    Thanks man. You really saved my ass.

  40. kalyan / Oct 31 2009 3:00 am

    Hai,

    I lost my photo taken by w300i,while connected using card reader,i didnt deleted it nor formated, but suddenley i see that there are no photo in the card,my son’s most memorable moments wear lost in that, and recently i climeb 280Mtrs hight,i had those photo’s also, i felt very very depressed.

    kindley helpme to recovery those photos.

    Which tool can i use, and whear to download it,ihave a Xp OS system.

    Please helpme kindley.

    Thank you.

  41. Arne Babenhauserheide / Jan 4 2010 11:13 am

    Foremost worked wonderfully! It saved 499 pictures – many thanks!

    Besides: A nice complementary app is ddrescue. It can also restore quite a lot of data from damaged disks, CDs and such.

    On gentoo you get it via “emerge ddrescue”.

    • tshrinivasan / Jan 4 2010 11:40 am

      Hi Arne,

      Thanks for the comments.

      Regards, Shrini

  42. lume / Apr 16 2010 4:05 pm

    Thanks a lot. Sleuthkit (and you) saved my life. :)

  43. freezway / Apr 18 2010 10:37 pm

    please help me… I have a .gmk file on it ands sleuthkit gives me Invalid magic value (Error: sector size (36352) is not a multiple of device size (512)
    Do you have a disk image instead of a partition image?)

    when i run fls

  44. Burguay / Apr 24 2010 8:58 pm

    Thx a lot! Saves a lot of lost photos!!
    Kxx!!

  45. Faisal Ahmed / May 6 2010 12:53 pm

    I love you Ubuntu… and thankyou brother.

    • tshrinivasan / May 6 2010 12:54 pm

      Hi,

      Thanks for your comment.
      :-)

      All the glories goes to the community.

      Shrinivasan

  46. Doug / May 9 2010 12:04 am

    I would make only one adjustment to your instructions.

    Instead of:

    dd if=/dev/sda of=my_card.img bs=512

    I would use:

    dd if=/dev/sda of=/path/to/local/disk/my_card.img bs=512

    Since most of us tend to need these things in a crisis, and won’t take time to ‘man dd’, issuing the dd command as you have it would create the img file on the camera memory, probably overwriting deleted files. Instead, create the img file somewhere on your hard drive.

    Other than that, EXCELLENT article.

    • tshrinivasan / May 12 2010 7:42 pm

      Hi Doug,

      Thanks a lot for your comment.

      Yes. Your suggestion is so worth to save many lives.
      :-)

      Thanks a lot.

      Regards, Shrinivasan

      • pete / Oct 15 2010 11:31 pm

        thanks so much for your article … it´s really a great guideline.
        Dough´s suggestion also comes in really handy.
        However, in my case of panic + newbieism it´s even worse ….
        frankly i don´t know how to find the source-path “if=/dev/sda” for my camera (viz. the memory-card in there) … if i open the folder on the memory-card the path given is “gphoto2://[usb:002,008]/” but that doesn´t work …

        though a lot of you probably shake your heads, i´d really appreciate your help on that!!!!!

        thanks a lot in advance

      • tshrinivasan / Oct 16 2010 12:03 am

        Hi,

        After connecting the memory card,

        run the following commands to find the device name

        sudo fdisk -l

        The last line will show the memory card.

        df -h

        using the size, you can find the device name.

        Wishes, Shrini

  47. Ian / Aug 7 2010 1:46 am

    Thanks so much for this guide, saved the day, and got me into the wifes good books

    • tshrinivasan / Aug 7 2010 1:56 am

      Hi,

      So happy to know that it helped. All the glories goes to the open source community.

      Shrini

  48. kimsarann / Aug 9 2010 9:48 pm

    error windows7

    • tshrinivasan / Aug 9 2010 9:50 pm

      Hi,

      please explain more on your comment. how ca I help you?

      Shrini

  49. szando / Aug 10 2010 2:11 am

    Not much left to say; Thanks a lot!

  50. usha / Aug 12 2010 7:28 pm

    hi,Accidentally i have formatted my 1 GB memorycard of Nokia express music 5310, I lost my photos and then i have tried with steller recovery tool, i got some JPG files but unable to view those,i am getting the error “preview not available”.i was connected the the memory card to the system and done the recovery, because of this error i copied those recovered jpg files to my phone and tried to view but no result.pl suggest me to do the better,because those are very important for me.pl

    • tshrinivasan / Aug 13 2010 10:59 am

      Hi,

      Will help four sure.

      First keep the card i safer place. Dot use it anymore until you recover the files.

      Do you have linux? If you have linux, we can recover it for sure.

      Contact me if you need any assistance in getting linux.

      be patience. will do my best to recover the files.

      Shrini

  51. snif123 / Sep 10 2010 2:02 am

    Hey all,I have used this to recover my mp3 and jpg files.Howver when I tried to recover the mp4 files using the part about sleuthkit and fls,i paste the command and nothing happens it only goes to the end and shows END,any ideas?

  52. Maks / Oct 21 2010 11:00 am

    Anyone with Stellar Phoenix Photo Recover V 3.5 Keygen? pls upload

  53. Ageu / Feb 12 2011 7:46 am

    Thank you very much, I’m very happy because I could restore my photos !!

    • tshrinivasan / Feb 12 2011 11:54 am

      Ageu,

      Happy to know that this post is helpful to you.

      Wishes, Shrini

  54. mark / Mar 3 2011 8:29 am

    I would like to

    introduce you a very good data Recovery software, called tenorshare data recovery which can be

    used to recover Images from SD card and from other storage devices. This software is an

    assortment of data recovery components designed for recovering deleted / lost files and folders,

    photos, RAW images, music & video files from crashed, re-partitioned, accidentally formatted

    partitions & drives.

    You can get it from: http://www.any-data-recovery.com/

  55. matt mcinvale / Mar 20 2011 11:18 pm

    thanks for the great writeup! i was able to recover all of my lost images without any trouble.

    • tshrinivasan / Mar 20 2011 11:41 pm

      Wow.

      Happy to know that the article helped you.

      Thanks for all Free Open Source Software developers.

  56. lara14x / Mar 25 2011 8:28 pm

    hi how ru
    thx 4 all the info vry helpful n appreciated

    i wonder if u can help me with my small problem?

    i hav a blackberry curve 8520
    i have set it since the very 1st day i bought it to ‘save my chat history on the media card’ in the bb messenger options.
    suddenly a few days ago all the chat history since the vry 1st day for a very dear friend of mine disappeared while all the rest of my contact chat logs stayed =(

    is there anyway i can get them back i tried everything like
    1.from restoring my back up file
    2.using the handy recovery software and recuva program
    2.restarting and rebooting my smartphone yet nuthin worked

    • tshrinivasan / Mar 25 2011 8:35 pm

      Hi,

      I hope we can recover using linux. Do you have any linux machine running?

  57. lara14x / Mar 25 2011 8:39 pm

    no i never realy used it before but i will right away and give u feedback

    • tshrinivasan / Mar 25 2011 8:44 pm

      Thats fine lara.

      Do you know linux? Can you install it in your computer?

      If not, ask for anyone there near you to install ubuntu in your computer. After installing ubuntu, Read my blog post fully and follow it.

      Will help you once you have linux.

      Wishes.

  58. lara14x / Mar 27 2011 9:36 pm

    just finished downloading ubuntu
    at first didnt work out on a usb so i installed the latest version
    of ubuntu 10.10 on a cd and its working

  59. MarcWilliams / Apr 22 2011 9:05 am

    Tenorshare Data Recovery works fine! Thanks for sharing!

  60. Breton77 / May 28 2011 1:55 am

    Problem is that I can’t even mount my card. Only machine that reacts to it, is one running W7, and it only gives an opportunity to format the card. Should I quick format and then take proceed with these instructions?

    • tshrinivasan / May 28 2011 1:58 am

      Do you have a linux machine?

      Can you mount it in linux?

      • Breton77 / May 28 2011 2:17 am

        Mainly trying this in Linux. Running Xubuntu atm. I’m using external card reader. The indicator lights up for a moment when I insert the card but then goes off and nothing happens. Tried with another card and it mounted automatically.

      • tshrinivasan / May 28 2011 2:19 am

        Fine

        After inserting the card, run the following command.

        sudo fdisk -l

        give me the output

  61. Breton77 / May 28 2011 2:22 am

    antti@Silver:~$ sudo fdisk -l

    Disk /dev/sda: 80.0 GB, 80026361856 bytes
    255 heads, 63 sectors/track, 9729 cylinders
    Units = cylinders of 16065 * 512 = 8225280 bytes
    Sector size (logical/physical): 512 bytes / 512 bytes
    I/O size (minimum/optimal): 512 bytes / 512 bytes
    Disk identifier: 0x000606e4

    Device Boot Start End Blocks Id System
    /dev/sda1 * 1 2437 19572736 83 Linux
    /dev/sda2 2437 9730 58575873 5 Extended
    /dev/sda5 2437 9544 57083904 83 Linux
    /dev/sda6 9544 9730 1490944 82 Linux swap / Solaris

  62. Breton77 / May 28 2011 2:24 am

    With the functional card inserted the output looks like this:

    antti@Silver:~$ sudo fdisk -l

    Disk /dev/sda: 80.0 GB, 80026361856 bytes
    255 heads, 63 sectors/track, 9729 cylinders
    Units = cylinders of 16065 * 512 = 8225280 bytes
    Sector size (logical/physical): 512 bytes / 512 bytes
    I/O size (minimum/optimal): 512 bytes / 512 bytes
    Disk identifier: 0x000606e4

    Device Boot Start End Blocks Id System
    /dev/sda1 * 1 2437 19572736 83 Linux
    /dev/sda2 2437 9730 58575873 5 Extended
    /dev/sda5 2437 9544 57083904 83 Linux
    /dev/sda6 9544 9730 1490944 82 Linux swap / Solaris

    Disk /dev/sdd: 2002 MB, 2002780160 bytes
    11 heads, 10 sectors/track, 35560 cylinders
    Units = cylinders of 110 * 512 = 56320 bytes
    Sector size (logical/physical): 512 bytes / 512 bytes
    I/O size (minimum/optimal): 512 bytes / 512 bytes
    Disk identifier: 0×00000000

    Device Boot Start End Blocks Id System
    /dev/sdd1 2 35561 1955775+ 6 FAT16

    • tshrinivasan / May 28 2011 2:30 am

      Your card is detected in linux. It is /dev/sdd1

      Find the following line in the blog post.

      First thing I did is “Take a image of memory card“.

      From there, do the following

      dd if=/dev/sdd1 of=my_card.img bs=512

      You can get the image of the card using above command. once you get the image, follow the same blog to get the files.

      Wishes.

      • Breton77 / May 28 2011 2:39 am

        Problem is the later of the two posts was with a functional card in the reader, the previous was the one with problem card inserted. That one shows no /dev/sdd1.
        Tried the command anyway and got:

        dd if=/dev/sdd1 of=my_card.img bs=512

  63. Breton77 / May 28 2011 2:57 am

    And that was supposed to be:

    dd: opening `/dev/sdd1′: No such file or directory

    Forgetting sometimes to use the shift when copying from terminal (and apparently proofreading too).

    • tshrinivasan / May 28 2011 4:37 am

      Yes. The card is not detected. Try with any other card reader.

  64. Breton77 / May 29 2011 1:29 am

    Tried with internal readers in two linux laptops and one w7 laptop. Only the w7 is willing to do anything with the card. Tried this one external reader in all the same computers with similar results.

    • tshrinivasan / May 29 2011 2:34 am

      Ok. Check for any utility in windows to take the image of the memory card. Then we can use that image in linux to get the data. Check for alternate to dd in windows.

  65. abraham / May 31 2011 9:36 pm

    i lost my datas from my 4GB memory card while working at my laptop. anybody have any solution please help me…………..!

    • tshrinivasan / May 31 2011 11:12 pm

      Hi,

      Do you have a linux installed computer?

  66. Ron / Jul 15 2011 8:46 am

    Hi, loved the article. Opened my eyes to the quality of open source forensics and I reference this page when helping friends find lost data!

    One problem though, attempting FLS on my disk image gives this:

    Invalid magic value (Error: sector size (0) is not a multiple of device size (512) Do you have a disk image instead of a partition image?)

    What have I done wrong? Thanks for any guidance,

    • Ron / Jul 15 2011 11:47 pm

      found it. made a disk image of sdb1 rather than sdb and it worked fine.

      • tshrinivasan / Jul 16 2011 1:20 am

        Happy to know that it works for you. Open source rocks. :-)

  67. Noufal / Jul 26 2011 8:26 pm

    Hi,
    Some how my transcend 4GB micro sd card got a crack on opposite to the pins side. When I insert in my digicam it says “memory card error” and when plugged in to my laptop in Windows through SD card convertor its showing as E:\ , but unable to recover files from it. In ubunto there is no card detected. Also card gets heat. Is there a way to recover photos from it. Your help is highly appreciated.

    Thanks,
    Noufal

    • tshrinivasan / Jul 26 2011 10:15 pm

      Hi,

      After inserting in ubuntu machine, run the following command and paste the output here.

      sudo fdisk -l

      it may be detected.

      else, use a usb card reader and run the same command.

      Shrini

      • Noufal / Jul 27 2011 11:33 pm

        Hi,

        Below is the output. Kindly check.

        Device Boot Start End Blocks Id System
        /dev/sda1 * 1 5762 46283233+ 7 HPFS/NTFS
        /dev/sda2 5763 9227 27831296 83 Linux
        /dev/sda3 9228 9730 4034561 5 Extended
        /dev/sda5 9228 9730 4034560 82 Linux swap / Solaris

        Unable to read /dev/mmcblk0

        Thanks,
        Noufal

  68. Orvil Juarez / Sep 16 2011 1:27 am

    Excellent post, as you say With Open Source we can do Anything and do better.

    Thank you for share this.

  69. Hnatt / Sep 19 2011 3:17 pm

    Thanks man! You saved my vacation photos! Water got inside my waterproof camera (looks like I dived deeper than 3m) and microSD became empty.

    Recovered all with photorec.

    • tshrinivasan / Sep 19 2011 3:22 pm

      so happy to know that you got all photos back.

      thanks to open source developers

  70. anthony cyril / Oct 23 2011 9:38 pm

    Please send softwares

  71. Tim / Mar 21 2012 1:23 am

    Thanks mate! I had the precise same problem and saved a lot of trying by just following your instructions by the letter!

  72. Bala / Sep 15 2012 12:23 am

    Two days before my wife’s data card suddenly not working when try to copy a image. I’m tried a lot but there is no use at all. Atlast your article helped me to recover my files, and saved me from my wife’s curse. My thanks and kisses to you. Thank you, Thank you very much. Also I’m joined “Going GNU”.

    • tshrinivasan / Sep 15 2012 1:19 am

      happy to know that it helped you. :-)

  73. kamran / Sep 20 2012 8:37 pm

    My name is kamran.I use symphonyX99.unfortunatly (AUDIO) file delete from my memory card.but it is vary vary important for me.I want to upload again it from my memory card.so what can Ido now.say quickly.OK

    • tshrinivasan / Sep 20 2012 9:02 pm

      you need a Linux machine to recover files.

      do you have ubuntu Linux?

      where do you live?

  74. web ressource / Oct 15 2012 10:43 pm

    Why viewers still use to read news papers when in this technological
    globe all is available on web?

  75. bits4beats / Mar 15 2013 4:12 am

    Thanks! It helped me a lot. Photorec found 129 deleted files in the FAT partition of the xD card.

  76. hoodia gordonii / Apr 6 2013 10:52 pm

    Wow! In the end I got a webpage from where I can really obtain valuable data regarding my study and knowledge.

  77. banana health / Apr 23 2013 5:16 am

    The Japanese Banana diet works well, but honestly it is not what helped me lose over 60 pounds safely in just a few months.
    o Other important areas for weight loss like exercise and psychological
    factors are not endorsed in this program. Blandness for one thing,
    if only because it is so very redundant.

  78. Vigrx pill reviews / May 9 2013 12:01 am

    Helpful information. Fortunate me I found your site unintentionally,
    and I’m stunned why this twist of fate did not happened in advance! I bookmarked it.

  79. I was recommended this blog by my cousin. I am not sure whether this post is written by him as
    no one else know such detailed about my difficulty.
    You are wonderful! Thanks!

  80. increase men semens / May 9 2013 2:00 pm

    Asking questions are actually nice thing if
    you are not understanding anything completely, but this post gives nice understanding yet.

  81. blogdaclauzinha.blogspot.com / May 18 2013 3:23 pm

    Hi, all is going nicely here and ofcourse every one is sharing data, that’s really fine, keep up writing.

  82. My wife would probably think that buying a $500 handbag is important to her.
    It works by driving more blood to the penis which in turns leading to
    a bigger and stronger erections. The more a
    person shakes a soda can, when it is opened,
    the bigger it will explode.

  83. mehak / May 30 2013 8:21 pm

    i have lost my important recordings from my micromax mobile …is there any way to recover plz tell its very urgent

    • tshrinivasan / May 30 2013 8:25 pm

      How did you lost them?

      Did you delete them in mobile or using computer?

      You can recover by using a linux computer. Do you have it?

      Where do you live?

  84. prakash chandra behera / Jun 29 2013 11:10 am

    delete my amr recording file in memorycard last8month.plz help

  85. palestinian / Jul 7 2013 7:04 pm

    Good day I am so thrilled I found your web site, I really found you by mistake, while I was browsing
    on Google for something else, Anyways I am here now and would just like to
    say thanks a lot for a tremendous post and a all round interesting blog
    (I also love the theme/design), I don’t have time to browse it all at the moment but I have book-marked it and also added your RSS feeds, so when I have time I will be back to read much more, Please do keep up the fantastic job.

  86. finding a used car / Jul 12 2013 11:40 pm

    Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point.
    You clearly know what youre talking about, why throw
    away your intelligence on just posting videos to your blog when you could
    be giving us something enlightening to read?

  87. your credit / Jul 14 2013 10:59 pm

    Spot on with this write-up, I honestly feel this amazing site needs far more
    attention. I’ll probably be back again to read through more, thanks for the info!

  88. tension / Jul 24 2013 2:38 pm

    Accidently deleted photos, music or other crucial stuff on your iPhone or iPad? Improper operation? Broke or damaged your camera and now the data’s gone? Or your USB device failed work? Please don’t be worry now. A photo recovery software for Windows OS-based computer users that recovers deleted or lost photos, images, songs, movies, and other multimedia files.

    Memory Card Recovery Provides Zero loss of Picture/Photo/Video/Audio Recovery. If you want to read more about this program , please click in to learn more and try for free download: http://datas-recovery.com

  89. Ecig Sale / Aug 10 2013 12:39 am

    Hi there! Do you know if they make any plugins to protect against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any suggestions?|

  90. Ruth / Aug 21 2013 10:56 pm

    Fantastic guide, really helpful to me. Thank you.

  91. file recovery tool / Aug 26 2013 2:06 pm

    Hey would you mind stating which blog platform you’re using? I’m looking to start
    my own blog in the near future but I’m having a difficult time making a decision between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design and style seems different then most blogs and I’m looking for something unique.
    P.S Apologies for getting off-topic but I had to ask!

    • tshrinivasan / Aug 26 2013 3:07 pm

      I use wordpress.com

  92. I don’t know if it’s just me or if perhaps everyone else encountering problems with
    your website. It looks like some of the written text in your content are running off the screen.
    Can somebody else please comment and let me know if this is happening to them as well?
    This might be a problem with my web browser because I’ve
    had this happen previously. Kudos

  93. prada プラダ / Sep 12 2013 6:39 am

    marni 財布

  94. cellulitenixed.com / Oct 2 2013 8:07 am

    It is cellulite vacuum finally advised to schedule a maintenance
    session every three or four months after the treatment and during this time of
    the day. A cellulite vacuum cellulite diet should also include cellulite cream and
    it is so good for your health! While the cellular composition of cellulite resembles other body fat, including cellulite vacuum fat from
    cellulite deposits. Number four: Seated BridgeTo work the back of your thighs, stomach and buttocks.

  95. dorisou / Jan 27 2014 8:59 am

    You could read this tutorial for help: http://www.kvisoft.com/tutorials/how-to-recover-files-from-memory-card.html

  96. lpanebr / Jan 28 2014 5:35 pm

    Nice! Helped me. Perhaps a note about finding out what is the correct path prior to the dd command would be nice since /dev/sda is usually one’s main sata disk.

    my memmory card for instance was at /dev/mmcblk0

    thanks!

    • Shrinivasan T / Jan 29 2014 6:17 pm

      You can use /dev/mmcblk0 itself as input device for taking dump using dd

      dd if=/dev/mmcblk0 of=dump.file

  97. aadicool4rnd / Jan 29 2014 6:02 pm

    Direct download sd-card-recovery
    Nice post :)

  98. recover deleted files / Feb 26 2014 1:38 am

    Excellent blog right here! Additionally your site so much up fast!
    What web host are you using? Can I am getting your
    associate link for your host? I wish my website loaded up as fast
    as yours lol

  99. how to hack facebook account / Feb 26 2014 3:32 pm

    Simply because Facebook or myspace is a brand new occurrence, there aren’t any clear-cut solutions to crack that.
    When we surf the internet using our i – Phone, we often don’t realize that the
    wifi connection may not be encrypted; as a result we carelessly conduct transactions over the internet and unknowingly expose information
    related to our identity. You can hack password Windows XP with a built-in
    Administrator.

  100. Jeana / Mar 4 2014 3:28 am

    Nursing was nnot nursing 8 months considered a suitable occupation for a well-educated woman and nurses wsre not yet considered professionals.
    Will also reduce the client’s comfort, preventing the oonset
    off dehydration. If that is you, don t just sit there
    and wait for something to happen. Even if a person is nursing
    8 months on the bundle of joy.

  101. how lose fat / Mar 4 2014 9:02 pm

    have helped many people to lose weight naturally and permanently.

    Unfortunately, spot reduction is not possible, regardless of
    what you have read. This is certain to get your heart pumping and is also great for your legs.

  102. haxball cheat / Mar 18 2014 8:47 pm

    Do you mind if I quote a few of your posts as long as
    I provide credit and sources back to your blog? My website is in the
    very same niche as yours and my visitors would genuinely
    benefit from a lot of the information you present here.
    Please let me know if this alright with you. Regards!

  103. miniclip cheat / Mar 18 2014 10:32 pm

    I’m more than happy to find this page. I want to to thank you for ones
    time due to this wonderful read!! I definitely liked every part of
    it and i also have you book-marked to see new stuff in your web
    site.

Trackbacks

  1. Reševanje podatkov | Aljosa's blog
  2. Recovering files from a corrupt memory card « Explore Ubuntu
  3. Voice Recorder - Aufnahme verschwunden - Android-Hilfe.de
  4. Linux Help - INGunOwners
  5. Recover files in Linux | Sandip Tiwari
  6. Android Forensics Handbook Bewertungen | INFOWEBLOG.NET

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 819 other followers