Mar 19, 2020 07:00:00

What is 'No way' software that has successfully restored corrupted data that could not be retrieved by trial and error?

HDDs and SD cards for storing data are devices that are always subject to data corruption due to failure.

Scott Hanselman, a teacher who has damaged the audio data stored on the SD card, says on his blog that he was able to recover the data in a surprising way after trial and error.

CSI: The case of the missing WAV audio files on the FAT32 SD Card --Scott Hanselman
https://www.hanselman.com/blog/CSITheCaseOfTheMissingWAVAudioFilesOnTheFAT32SDCard.aspx

Scott uses the ZOOM H6 as a voice recorder, which allows stereo recording with two microphones. To record an interview, I bought a new 'formatted' SD card, just inserted the SD card into the ZOOM H6 and recorded the audio in WAV format. After the interview was over, I confirmed that the WAV file could be played on the ZOOM H6, and when I got home and inserted the SD card into the PC, there was no data in the SD card.

Scott has recorded 730 episodes for 14 years, but this was the first time. In a hurry, Scott takes a deep breath and begins to solve the problem.

First, when I right-clicked on the drive and checked the properties, 329MB was displayed as 'used'. This is about the same amount of data as the WAV file of the interview, so it can be estimated that the data itself exists in the SD card.

When I checked the archives and system files under the root directory on the command line, I was able to confirm the existence of the data itself. When I insert the SD card into the ZOOM H6 again, the WAV file can still be played on the ZOOM, which is a strange situation.

In investigating the cause, Scott used the dd command to extract the data on the SD card as an image file in blocks to avoid making changes to the data on the physical SD card.

Since the audio data is 329MB, cut out the data in the range of 400MB from the beginning of the extracted image file. The extracted image file is a collection of byte strings, and at this stage it is not a 'file' that humans can recognize the contents.

Audio software such as

Adobe Audition and Audacity has the ability to capture RAW data. When I imported the image file with the 2-channel setting, the wavelength of the audio was displayed. I checked the audio, but it wasn't audible at all.

Here Scott recalls that 'ZOOM H6 was recording in stereo.' Scott noticed that the data of the image file is a byte string in which the data of the right microphone and the data of the left microphone that were recorded at the same time are mixed, and when he dumped the image file with

hexdump, he said, 'ZOOM0001. Confirm that the file name such as 'is displayed.

Scott thought, 'Isn't it possible to retrieve the data by mounting the image file?' Scott

tried mounting the image file on Ubuntu , but unfortunately the data was not displayed.

Check the image file mounted by

dosfsck , referring to the opinion that 'Assuming that the file name ignoring the 8.3 format is used, the file can be retrieved by complying with VFAT corresponding to a wide range of file names'. When I tried, the file name was displayed, but there are three root entries that should be one. Also, I couldn't retrieve the essential files.

When I skipped some sectors of the image file and read it, it turned out that there was an unnamed folder and the data could not be retrieved because there was a file in it.

Scott will continue to investigate the reason why the data cannot be retrieved. Since each sector contains 512 bytes of data, and the data starts from the 8192th sector ...

If you use the xxd command to output the 512x8192 4194304 bytes of the image file in hexadecimal, the characters 'FAT32' will appear. The file system of the partition containing the data is FAT32, so Scott is confident that he is referencing the correct location.

The 'correct' image that was re-recorded after formatting the SD card, following the advice 'Why don't you format another SD card and record in the same way, then extract the image file and compare the binaries?' When I compared the binaries of the file with the 'broken' image file, it appeared that there were two folders named with spaces. However, rebuilding folders and their contents from here can be a daunting task.

Scott, who was about to give up, suddenly right-clicked on the image file and

opened it with the file compression / decompression software '7-Zip ', and found that an unnamed folder was displayed.

When I opened the folder as it was, I could easily retrieve the recorded data that could not be retrieved by trial and error. Looking at the file path, the part of the anonymous folder is '\\', which is not normally supported, but it seems that it could be read by 7-Zip.

Scott said that he was keenly aware that 'the SD card he purchased should be formatted first' and that he gained the knowledge that '7-Zip is amazing'.