accidental P2 format - bit for bit data copy of P2 possible?

[rjcam]

Hi,
I have seen a few Q & As on this splashed on here and the internet, but not really an actual solution.

I have a 16GB card that was accidentally FORMATTED - in camera on the HVX200, and I had about 42 minutes of standard miniDV footage recorded to it (not HD). I need to try to salvage some of it, even just the audio or some of the video would be great.

After the format I locked off the overwrite tab and pulled the card and have not recorded a single thing to it since (or modified it in any way).

I have read that it might be theoretically possible to -dd command copy in Terminal or something like this a bit for bit copy of every 1 and 0 that is currently on the card. From what I am understanding, the information is still there somewhere, as a 'quick format' in camera to this FAT32 formatted drive merely replaces the directory and the FAT directory, but the data is still written to the card until it is overwritten.

So, it seems this has happened to other people. Are there any known ways to get some data back and have it useable to any extent after an 'oops' format?

I am primarily a Mac user, although i have a PC here, and certain software, but not the latest data recovery stuff out there. I usually use a G4 powerbook with Tiger. I have an older tower that runs OS9 - yes OS 9 I said it, that has Tech Tools Pro 3 on it and Norton Disk Utilities. Any suggestions from any of the users out there? Anyone know how to use the -dd command in Terminal utility App in OSX to accomplish this? Anyone know the 'block size' of the P2 card?

I have done two -dd copies of the card, and only get a 32k disk image. Once I can get a disk copy of the P2 card I can start some data recovery apps on the data and try to manually rebuild extensions etc... etc... I am sure it will be a good time over the next few days.

Thanks in advance for any suggestions!!:thumbsup:

[DLS]

I have had this happen {and worse} to memory cards from still cameras. They are also formatted FAT32. I use a program called "Picture Rescue". It has never failed me. Best of all it is a Mac application.

http://www.versiontracker.com/dyn/moreinfo/macosx/23958

Hope this helps

Mark

[rjcam]

I am not sure that will apply in this case. I have a feeling that software like that scavenges for picture files and those type of extensions. I am trying to figure out the command line for -dd or even -DCFLdd
to make a clone of the card first with every bit read and written. So far havent figured out how to use it, I am not really a Terminal / command line geek.

[rjcam]

Not a very good update. I used the dd command with someone's help and it seemed like we were able to get past the 1.6MB new format and try to copy the 'older' bits (data), and I think we ran it twice, and wound up with a 31GB file that seemed to contain the new .txt file and then only zeroes. We're not sure we did it correctly, and I can't believe a 2 second format in camera could zero out all the data on the card, but it's possible it did that. If anyone has experience to the contrary I am sure all the people who have viewed this link and myself would appreciate it. Thanks.

[Justyn]

I'm in need of the magic softwear to do this as well. Horrible day to realize I goofed too and I have to pray that something can be done to recover off the HD or off the camera deleted cards...

cheers

[alexberman]

P2 cards store information on a raid 1 array across four sd cards (IIRC) so a simple "picture restorer" wont work. You need software they will restore raided data.

[rjcam]

One small but noteworthy update. I also have a MicroTrack 24/96 sound recorder. It records to standard CF cards. I was recording a multi hr conference, and 52 minutes into a recording the device super crashed and later made a 0kb file that was unrecognizable. HOWEVER, after a lot of attempts, I was in fact able to -dd command it in the command line of a PC laptop using KNOPPIX UNIX software. Later I had a geek friend parse the 2GB image I made and was able to re-build the .WAV file and the file is perfect and sounds great! So, sort of theoretical proof here. One could cretainly -dd image a P2 card. Then there is a clone bit for bit of what's on the card. Then there would have to be someone or software that understands how to re-build all the 1s and 0s and make the raw .MXF files again. This would be a huge headache but it could be possible. Particularly if Panasonic can shed some light on the pattern that the 1s and 0s are written as data across the internal miniSD RAID array that makes up the P2 card. If anyone actually accomplishes this and rebuilds a card and gets useful video out of it after a format I would love to hear about it. Thanks.

[DJDecay]

This is all sheer speculation. You're attributing "file-system" operations to two different types of storage, I cannot make any astute recommendations as I don't know exactly what does the Panasonic ERASE->SLOT1 command actually execute.

If it runs a "newfs bs=512" with a type FAT32, you may be in luck.
If it does anything else, like zero's out the bits on the P2 card. :-(.

dd is just one option, you basically need to read the raw device, but you also need to know the block-size and other structures.

Google recover filesystem after newfs /mkfs dos.

Yes P2 is raid, but its hardware abstracted raid, to the device like HVX or other it just looks like a single block device on which a FAT32 filesystem lives.

Ever since the dos days and Peter Norton's "UNDELETE" there have been fairly easy ways of dealing with what are files in the FAT (File Allocation Table) type file system.

During a format/newfs the table contents of the files is gone, but the bytes that make up the files in theory are not, as new files need to be writte over them.

So the idea is, if the card was formatted (and the P2 camera does not zero it out in some clever way) AND you did not record anything new to the card, chances are good.

Flip the write protect tab on that card "ON" and try to get an image of the card with correct parameters using "dd" - P.S. "dd" is also available in OS X Terminal, Any Linux Box, etc..

I think the bs=512 (but you could use any data-stride) like bs=2048 or any multiple there-of in binary.
The smaller the bs, the slower the dd will run, it just represents the amounts of chunks it will take from the block device and move over to the other side.

Most importantly - what is the block device that you're going to use with the P2 card via if=/dev/....

And could someone verify that this Linux based HVX200 cam runs a newfs/mkfs vs. some clever other thing. It does it fast so its done without badblocks option.

[DJDecay]

Hi,
I have read that it might be theoretically possible to -dd command copy in Terminal or something like this a bit for bit copy of every 1 and 0 that is currently on the card. From what I am understanding, the information is still there somewhere, as a 'quick format' in camera to this FAT32 formatted drive merely replaces the directory and the FAT directory, but the data is still written to the card until it is overwritten.
:thumbsup:

You could also make a RAW DMG of the card using DiskUtil in case DD is giving u problems, and then a HexEditor like HexFeind to see if you footage is still indeed on the image. - You're prob feeding it the wrong device from the /dev filesystem even if your bs= argument is set to 1, it will dump everything available (just slower - way slower).

Remember block device, not character device.

I've been doing some research in the recent w.r.t. digital footage recovery from solid state and hd media, and have some tools. You've pointed another situation I did not think about in my service offering list (accidental erasure with-out overwrite). So I'd be curious/willing to help you so long as your're not in a huge hurry to get this stuff recovered... (I have a backlog of programming work I'm doing).

Let me know via P.M. - I can connect my cam tomorrow and give you the right CLI walkthrough to get a healthy image of the P2 Filesystem + you data with missing references - off the card.

Yes if the CAM actually does indeed issue a newfs or better yet an inode/table delete you're set, the table is missing but the data is still there (as long as you did not write, or have attempted to write anything to the card.)

Before performing any "majic" operations on the card - engage write protect (defeats the purpose - sort of) but you should only perform them on the image of the card, possibly cloned to a identical sized P2 card. Here is where DMG is more helpful as OS-X will mount it no problem, while dd ouput to a file might not mount correctly.

However if you have another P2 card of the same size, just clone it - dd if=/dev/p2card1 of=/dev/p2card2 bs=whateveryoulike to the power of 2 (512,1024,2048....)
then do destructive fix operations with magic tools on the clone card.

[rjcam]

Saw your post a lot later. One thing to note, is that these cards are large; I have a 32GB card and was using the 64GB cards too a lot.*
And they 'format' in camera really really fast. I can pretty much state there is no way it is zero-ing out the cards and over writing the bits.
AND I have a colleague who formatted a card, and apparently got Panny to recover it for him for a fee. So that means the data is all there and should be able to get it back.

[Barry_Green]

I believe Panasonic can recover the cards if they've been formatted. I don't think I've ever heard of a third-party application that's been able to.