What do I do if recovery software doesn't find any files to recover on SD card?

There are two ways a card (or drive) may be re-formatted "quick" (which simply reallocates the space taken by old files), and complete, in which zeroes are written over all files.

If your camera (or PC) did a quick format, it's possible file data may still be on the card, but if a complete erasure and format was performed, it's doubtful anything could be recovered, even with forensic tools.

A quick check of the card with a hex editor will show if there is any data -- if you see any recognizable file names (perhaps with first character changed to sigma), there's a chance to recover data. There are a number of free hex editing tools, such as Disk Investigator. Be sure to check with VirusTotal after downloading, particularly for disk editors, which have low-level access to disks. The editors are safe enough to use if you do not save any changes to the disk.

If it's a "quick" format, Restorer2000 (for Windows) can find the files even in cases with repartitioning or various DISK layouts that might be the case. If the new format has different parameters than the old, a simple scan might not work.

It has a free trial: if it finds the files then you can buy.

I expect the images to be contiguous files. So, they can be recovered easily even if the old directory is not found or usable enough.

You can clone the card as a block device to a hdd file, and work on that. It will make scanning much faster, and you can save the blob for working more on it later.

If a sector reader (hex editor) shows all blocks as zeroed, then there is no way to recover. If blocks are filled with the old data, then a program (like Restorer) can figure out where each jpeg starts and ends, easily.

If the recovery softwares are not finding any data on the cards, it sounnds like yo may be in need of a physical recovery....that is, a data recovery lab may need to take over now. Have you tried RescuePRO or PHOTORECOVERY recovery software?

I'm sure you've recovered your data by now, but just in case others do not know about data recovery companies, I thought I would throw in my two cents. I had a disk that would not read in any type of device. I tried two different drives, two different card readers, and two identical cameras. Nothing would read the disk. I searched the internet for solutions, and tried every DIY option out there. I couldn't use recovery software, because there was nothing for the software to see, little less recover, so I had to take the next step and look for a good data recovery company.

I searched the internet, and called many places within the US, and could not find one that was reasonably priced (it can cost quite a bit to recover data) or one that cost less, and had favorable reviews. I did however find a company called Recoverfab in Germany, that had great reviews, with costs that were much lower than the companies in the US. I was apprehensive about sending my disk to Germany, but I really had nothing to lose since the disk was worthless to me. I am so glad that I took the risk. I had a great experience! They were friendly, and once they had my disk, they recovered 100% of my data within 2 days. One price covered everything, regardless of what they had to do to retrieve the data. Even micro surgery. Most US based companies priced their services by what they did. The more they did the higher the cost. I knew my disk was going to require more that just software to recover my photos, but did not know the extent of the damage. It was nice to know that they covered it all in one price. Especially since the price was reasonable.

I highly recommend this company, and I will definitely use them in the future, should the need arise. If you do use them, understand that mail takes a while to get there. It took two weeks for my package to arrive. I've heard it can take up to 3 weeks. Well worth the wait!

The first thing to do is create a 1:1, block by block binary image of the medium. Preferrably, use the hardware lock feature on the card to ensure the OS doesn't attempt to even write filesystem housekeeping stuff, metadata, etc to it. Store that binary image away safely, before attempting the use of any recovery tools.

Note that this answer isn't technically accurate, I am nearly trying to explain certain mechanisms!

Some cameras use the equivalent of TRIM which you have heard of in relation to SSD drives. TRIM is often misunderstood and confused for 'erased' as in actually overwritten.

What the SD Card ERASE command does is inform the card's firmware about ranges of LBA sectors it no longer needs. This is useful for the card as it needs erased pages to write data. Erasing is slow, so if the card knows about stale blocks it can erase while being idle, it helps the card to maintain speed when it's asked to store data.

The card responds to the ERASE by sort of 'flagging' these LBA ranges that were passed on by the ERASE command, and when we try to read those LBA sectors it simply returns zero filled sectors without even reading them. It even does so if data was not actually yet erased! So, certain cameras, I know many Sony cameras do send an erase command to the card when you use for format option.

This cuts of the option of recovering data using file recovery software. However if you do not allow the card firmware to perform background tasks, data may still be recoverable by a lab as they have the hardware and software to bypass the controller. To reconstruct data the controller is emulated, however this is labor and time intensive and therefor quite expensive, say $400+.

Now say you inspect the card using a hex editor, for example HxD and you find the card was actually not filled with zeros for for the largest part, or you simply know your camera does not issue an ERASE command?

I have seen cases that were kind of perfect storms that prevented file recovery software, free, open source or commercial from recovering anything while data was present. For example I have helped someone achieve at least partial recovery after this scenario:

• Canon RAW files were all corrupt apart from 2 or 3.
• Recovery was attempted using Recuva but this only resulted in the same corrupt files being recovered.
• He was the given the advise to format the drive
• Now files weren't even detected anymore
• PhotoRec was tried, it only recovered the photos that were initially undamaged.

He then imaged the card (sector-by-sector image) and uploaded it somewhere where I could grab it. Using my home-brew tool I scanned the card (image). Nothing was detected however entropy map showed, proved there was high entropy data. So then my analysis was:

• Somehow format removed all references to files, so files may have been in the root folder.
• raw scans using PhotoRec and such failed due to the files being corrupt in the first place, hence they could not be detected by magic bytes (signature).

I told owner of the card highest achievable was trying to extract full resolution JPEGs from the corrupt RAW Canon files which I then did by adapting my home-brew tool to this specific situation: Normally raw scanners (like my tool and PhotoRec) preferably look for signatures at cluster boundaries and if clustersize is unknown at sector boundaries. As embedded JPEG in raw photos are not sector aligned they weren't detected. I made my tool then:

• Read good chunk of data
• Evaluate if entropy was 'jpeggy'
• If so scan entire chunk for JPEG signature, not just at sector boundaries
• Check if signature was not false positive: FF D8 signature is followed by a marker, check size of marker so we know where to look for next marker. If no marker there then probably fp.
• If not, did it meet minimum resolution requirement (to skip thumbnails)
• If so, recover the JPEG.

For all but a few of the corrupt RAW Canon photos a full res JPEG was recovered. Owner was happy and so was I because these type of cases are very rewarding (not meant in monetary sense)

Just to illustrate that if data can not be recovered it is not per se unrecoverable, and it does not per se require chip-off recovery.