04-02-2019, 07:37 PM | #1 |
New Member
9
Rep 20
Posts |
Is it possible to recover an overwritten video clip from a dash cam's SD card?
Need to recover older video clip recorded by one dashcam which was continuously recording. Is it possible?
|
04-03-2019, 04:15 PM | #2 |
Colonel
2130
Rep 2,882
Posts
Drives: F33 430 and F39 M35i
Join Date: Feb 2009
Location: Cleveland, OH
|
Depends on how many times it was overwritten. Download some free recovery software and give it a shot.
|
Appreciate
0
|
04-03-2019, 06:35 PM | #3 |
Lieutenant
251
Rep 439
Posts |
If it was a major event or collision does your camera not lock those files? My garmin has a G-force sensor so if i go over major bumps or am hit, it records x amount of time before during and after and locks it to prevent auto-overwrite
__________________
2008 SGM 128i - 3 Stage IM - 130i Tune - Dinan Camber Plates - BMW PE - Injen Intake - 1M Mirrors - LCI Blacklines - M4 Spoiler - Blacked 263's - Aero Bumper - Aero Side Skirts - OMGSplitter - AFE Intake Scoops
|
Appreciate
0
|
04-03-2019, 06:58 PM | #4 |
Second Lieutenant
2248
Rep 203
Posts |
|
Appreciate
0
|
04-03-2019, 07:18 PM | #5 |
Colonel
2010
Rep 2,756
Posts |
Unlike Hard Disk Drives (HDD), there are no magnetic platters for conventional recovery software to work against. SD card recovery is only possible through professional recovery firm that specializes in NAND chips.
Here's a good read on this topic: https://www.gillware.com/digital-for...d-nand-memory/ |
Appreciate
1
xQx906.50 |
04-03-2019, 10:50 PM | #6 | |
Major
1115
Rep 1,452
Posts |
Quote:
|
|
Appreciate
0
|
04-03-2019, 11:07 PM | #7 |
General
907
Rep 1,004
Posts
Drives: 2008 BMW 135i (E88 N54 6AT)
Join Date: Aug 2016
Location: Sunshine Coast QLD Australia
|
If it's been deleted due to a time-based retention policy: Maybe.
If it's been over-written by a rolling process of writing over the oldest clip with the newest: No. There are two ways of recovering deleted data: 1) Scan through the disk and re-link any data which is still on the disk but no longer referenced in the File Allocation Table (/Master File Table/Superbock system). When you "delete" something, your storage device often doesn't delete the data (ie. zero it out), it simply unlinks it. This is relitively easy to recover. 2) Scan through the disk and look for 'shadow data' - the magnetic memory of the previous state of a storage block after it's been zeroed out or over-written. This is comparatively extremely difficult, depends on the physical storage medium (SSD/SD/NVRAM/HDD), is quite unreliable, and unless you're willing to pay big money it's simpler to just say - It's just not possible. tl;dr: If it was "deleted", you might be able to get it back. But, (no matter how it was stored,) if it's been "overwritten" it's gone. |
Appreciate
0
|
04-03-2019, 11:31 PM | #8 |
Major
738
Rep 1,087
Posts |
|
Appreciate
0
|
04-04-2019, 01:04 PM | #9 |
Major
1074
Rep 1,268
Posts |
The reason you can recover deleted files from a HDD is due the fact that when a file is deleted, the actual file is not really deleted, just the entry in the file index is deleted this tell the OS where to find the file on the actual platter of the drive. Only after some time when the drives runs it clean up routines and relocate the space where the files was stored then tells the system it is now available to write new data to this locate does the file disappears. However, when writing to this spot there is residual magnetic information store at this location which can be use to reconstruct the original data which was stored there. This is why software which wipes a drive will right alternating 1's and 0's to all the storage locations on the drive to disrupt and residual magnetic fields from data which has been stored there fore long time. Trying to get to this residual data requires going back the HDD manufactures they have the tools to look at this.
Flash memory operate in similar ways since it used almost the same data and file management systems as a HDD. A deleted file is not really deleted, it most likely is still there, only index information was removed pointing to the starting and ending point of the file. The other issue Flash has especial on devices which lots of information is stored to the device over time. Flash does what is know as wear leveling, storage cells wear out if written and erase too much, so the data management system will move data around to ensure all cells are used the same amount of time. Even if new data is writing to the device at later time in a new location as is usually done it would be rewriting to an deleted file located via the wear level algorithm. If the file was deleted, and no new data written since it was deleted means the data is still there, the file structure index needs to be reconstructed to find the original file locate and type, so the data can be manually read from the storage location and reconstructed. This take a profession most times to do correctly, fixing a corrupt index can be done with third party software as well as the ability to recover a delete file as long as no new data was written to the storage device after the file was deleted. I have done this on HDD many time but never tried in on Flash since more of software is made for HDD not a solid state devices. Last edited by Maestro; 04-04-2019 at 01:11 PM.. |
Appreciate
1
xQx906.50 |
04-04-2019, 11:17 PM | #10 |
New Member
9
Rep 20
Posts |
The SD card was meant to save 10 hours of 3 min clips and I need to see the previous 10 hours (or maybe the previous 20 hours), overwritten by the dashcam. Guess it's gone...
|
Appreciate
0
|
Post Reply |
Bookmarks |
Tags |
recover, sdcard, videoclip |
|
|