[TriLUG] Recover deleted video from SD card?

[Bill Farrow]

On Sun, Apr 27, 2014 at 5:56 PM, David Brain <dbrain at gmail.com> wrote:
> Take a look at photorec http://www.cgsecurity.org/wiki/PhotoRec it can
> recover various file types - I've used it to recover mp3s from a corrupted
> SD card, worked very well, but not sure of its video support.

The fact that the filesystem is on an SD Card is a good thing in this
case. The SD drivers will write new data to erased blocks first, so
your old data should have been left intact when it "overwrote" the
video file.

Make sure you do a low level copy of the SD Card onto a much larger
hard disk before trying the various recovery tools.  dd and loopback
devices are your friend.

Try the extundelete tool:
  extundelete /dev/sda4 --restore-all

Or in your case on your desktop with SD Card at /dev/sdc:
  dd if=/dev/sdc1 of=balloon-sdcard.img bs=1M
  extundelete balloon-sdcard.img --restore-all

This tool is also available on Kali Linux Live (updated BackTrack
Linux) when you boot into the Forensic Boot mode.
  http://kali.org/

I am also a fan of gddrescue which is dd with bad block detection and
recovery when possible. This tool will keep copying even when you get
read errors on the disk, and it will intelligently work around
clusters of back blocks.

Bill