A family friend asked me to try and recover some photos from his Android phone's MicroSD card when it was accidentally reformatted. Not having done this before, I did some googling and found PhotoRec as a tool to try.

Using it, I successfully recovered >1000 photos!

The only problem is, all the photos are the same!?

It looks like a Modern Warfare cover or something - which is odd, because he's an older gentleman and isn't a gamer, afaik.

Here it is:

[Edit:] Yep, Modern Warfare 2's cover, but without the text or anything.

Multiply that by 1,376 files with different filenames, all with a filename like "f11746222.jpg". Always starting with an 'f', 8 numerical digits, and then .jpg.

It's possible I selected the wrong drive (It's using the linux-style names of the drives (/dev/sdc/ is the one I was doing it on), rather than Windows single-letter drive names (F:/)), I was going off of the listed size of the drives to guess which one was the MicroSD card; seeing that the MicroSD card is 16 gb, and my harddrives are both >300GB, it seems like I chose the right one. Even if I messed up, I'm fairly sure none of my harddrives have a thousand thumbnails of the MW2 cover art. But Modern Warfare 2 was recently re-installed on this computer... Not while the SD card was plugged in though (MW2 was installed two weeks ago. I was given the MicroSD card this morning).

Anyone have a guess what I'm doing wrong? I was expecting photos of his family.

Actually, I did recover one photo (and a resized thumbnail of the photo) of two women standing in front of a nice office building - guessing it's his daughters. But other than that, just thousands of duplicates of the exact same image (at the exact same resolution) of the above photo.

Is there a different tool you would recommend?

Sell it on Ebay as a haunted MicroSD card. Or go to the gravesite of the deleted files and have an all-out war with the dead.

Or you could try this: http://www.z-a-recovery.com/. I have not personally tried it but I searched and saw people recommending it.

I saw when googling that some people release fake data recovery software that damages the PC you run it on, as a prank (instead of using PC A to recover data from accidentally formatted drive B, the software reformats PC A itself).

I've no idea if the link you gave does that, but to be safe, I use the wikipedia-test for software downloads (if I can't find it on Wikipedia, it's to be dealt with as extra suspicious).

Recuva is my goto data recovery tool.

Recuva is identifying the files (first it said >340 found, now it's only saying 102 found), but whenever I try to 'Recover' the files, it complains that: "the volume for a file has been externally altered so that the opened file is no longer valid" - which appears to be a standard Windows error message.

Weird that it seems like the contents of the MicroSD card is changing... the card didn't fail (afaik), it was accidentally reformatted. I wonder if it's just my MicroSD->SD->USB reader that is giving sporadic results. I'll let the card rest and then give it a try tomorrow.

Anyone have any insight or any other suggestions? Recuva for a moment there found a bunch of filenames, dates, filesizes, but couldn't recover the files themselves (giving the aforementioned message)... but said that their sectors weren't overwritten.

Recovered a good portion of them - running PhotoRec from a Linux boot disk was able to do a much better job, and recovered almost 2000 files (mostly text XML metadata files, but at least 500 photos).

PhotoRec was installed by default on the Knoppix disc I had laying around. This is probably the fourth time Knoppix has come in handy.

Thanks for the help, gentlemen!

I have had decent success using Recuva, but PhotoRec sounds like it is a useful program.

The big thing is most of the time it just drops the file table and leaves the files themselves alone. Recovery programs look for bit patterns that match certain file types. Unless the area of the storage was used for something else and the bits overwritten/partially overwritten, it is possible to recover files most of the time.

I've used PhotoRec a few dozen times to recover data from mistakenly formatted/damaged disks, but it has always worked fine for me and never had an issue with it showing some random data that wasn't on the card. That's just weird.

We also used it at one of the places I work. It was one of a half dozen or so tools that were bundled into an automated scan system that all hard drives and digital media were passed through to ensure no critical data remained on the disk before disposal. If they passed the test the disks were then tossed into a modified wood chipper. If they failed then they went back for additional formatting and overwriting. Apparently SSDs have been proving troublesome and are now being melted in a three stage thermite based process. (However I have a suspicion that change in protocol was more of an excuse to use thermite in 'the office', more so than an actual valid issue on security over the wood chipper.)

Apparently SSDs have been proving troublesome and are now being melted in a three stage thermite based process. (However I have a suspicion that change in protocol was more of an excuse to use thermite in 'the office', more so than an actual valid issue on security over the wood chipper.)

Eh? shoudn't SSD's be more secure in terms of wiping data, due to how data is erased on a SSD.