Data recovery from compact flash...

We received a SanDisk 4Gb Compact Flash card where the JPG data had been deleted. This was exasperated by the client attempts to recover the data using free software. When data on SD cards is deleted, the information is still contained within the media, but the signs, which tell the system where they are located, are destroyed so that they do not recognize the fact that the data is still residing within the memory. These signs, called "pointers", are the indicators that data is present within the structure of the computer. 

Deleted information can be recovered even when the pointers are erased, but the chances of success are massively eroded as time passes. As the compact flash writes new data, it will use free space and possibly overwrite stored data that has been previously marked for deletion.

Using a Hex/Text Viewer to view sectors in the media we inspected the integrity of the data. Initial observation showed that the use of Data Doctor Recovery had fragmented the information on the media. Prior to starting the un-delete procedure, we created a hardware clone to work with. This allows us to revisit the media at any point, in the knowledge that we cannot corrupt the original data. Before running our un-delete procedures, the fragmentation had to be reversed. Firstly we ran a basic drive scan, which is a quick and general scan. Most of deleted files and folders can often be found with this type of scan. This did not reveal any further data.

Thereafter, we completed over forty advanced scans using our proprietary forensic tools. These are much slower - as they process the entire surface of the hard drive, detecting all possible clues that may reveal deleted data. Each scan addressed a different level, probing deeper each time, until we reached the lowest possible level. This revealed a significant amount of data, and thankfully much of the data that the client was searching for. Lastly we attempted a signature search, looking specifically for further jpg footprints of the specified files required. This revealed further data. Whilst some of the JPG images were slightly corrupted, we were able to recover 95% of the clients data.