File Show not be overwritten

[zephn]

Hi,

 

I was doing a video at a cabaret. After the videow as recorded I took a single photo. I didn't like the photo and hit delete, confirm. When the thumbnail for the video came up it looked like a s***ty photo and my fingers hit delete and confirm again so quickly I couldn't stop myself like an idiot. I immediately turned off the camera and yanked the card.

 

Getting home I tried several supposedly free sofware recovery systems before purchasing easus and recuva.   Easus indicated the file ahd a deleted state and recovered the correct sze file but it was all digital noise in the video even though it played.

 

Recuva gave me more information that the file was supposedly overwritten by another photo. This shocked me as I had immediately yanked the card and not taken any more photos. Efforts to recover were ranked as poor and had the same results as easus.

 

 

Can anyone help me understand what may have caused this to not recover?   Did another recovery software somehow suffle old data around to overwrite?

 

The file is a

.Mov from a canon 5Dmark III on a kingston 32 Gig CF card with a FAT32 format, and the file itself is 680 megs.

 

Thanks

Andrew

 

[Augeas]

Have a read of http://forum.piriform.com/index.php?showtopic=41963 especially post 5. Saves me typing it all again.

[zephn]

Thank you it made incredible sense even to one who doesn't get things on a technical level that deep.    So you are saying that it's impossible for any software to recognize these issues or just presently impossible because they're not yet programmed to account for this?

[Augeas]

Thanks for those kind words. As far as I can reason, if one half of an address has been set to zero then no software can use that address to retrieve any data. However I don't know everything and I don't know how other recovery software goes about its business. I haven't been able to find another valid cluster address in the FAT32 directory entry, which is quite small. I might look again when I have time.

[Augeas]

I should add that there are techniques that can be used to attempt a recovery in this case. You - or the recovery software - could run a deep scan looking at the start of every cluster to identify file types by their signature. If the last two bytes of the cluster address match the two bytes of the address still surviving in the directory entry, and the file type is the same, then a forward cluster read can be used to retrieve the data. However, and it is a big however, if the file is fragmented then this method will not work, nor will it work if any part of the data has been overwritten by another file. But it's a chance worth taking. Fragmented files might be reconstituted by matching different file er, fragments, but this is a task best left to data recovery professionals. Overwritten data unfortunately has been lost forever.