With the popularization of smart terminal products and storage technologies, Digital Forensic Investigators often acquire some digital devices at the scene of a crime, such as smartphones, tablet computers, digital cameras, car DVR, and so on.
There may be a lot of evidence related to criminals in these digital devices, especially the videos stored in them, which play an irreplaceable role in restoring the truth of the case.
However, in many actual cases, criminals will deliberately delete videos on digital devices in order to destroy evidence. Once these videos are deleted, it would not only increase the difficulty of the investigation but even make it impossible to find out certain facts of the case. Many cases were left unattended due to a lack of key evidence.
Therefore, for the investigators, the restoration of the video in the digital device has become a crucial issue, which is often related to the success of cracking the crime case.
Why can deleted video be recovered?
Generally speaking, when a video is deleted from the SD card, the video still remains on the card. The storage method of video on the SD card is related to the SD card partition.
The current mainstream partition usually divides the storage of data into two components: the index area and the data area.
The index area is responsible for recording the location, date, and size of the data. The data area stores physical data in the form of a combination of binary 0 and 1.
When the operating system performs operations such as reading, writing, deleting, and modifying data, it first performs deletion and modification operations on the index area, which is called a logical deletion.
The logically deleted data is still there before being erased. It is just marked as a free area. When the data in the data area has not been overwritten, we call it logical deletion. At this time, it can be restored with professional recovery tools, and the success rate can reach almost 100%.
After data is deleted, it is first marked as a free area. When new data is written, the system will randomly select a free area. If the data area is unfortunately selected, then the data will be overwritten.
We call it physical deletion.
Objectively speaking, the difficulty and cost of recovering physically deleted videos are very high. Therefore, we believe that under such a case, the recovery of the videos can basically be regarded as impossible.
Before the data area is overwritten, all videos can be recovered.
It has nothing to do with time in principle.
However, the longer the time, the more new data is generated, and the greater the probability of being overwritten.
Therefore, we strongly recommend that after the data is deleted, back up as soon as possible and image the SD card. In this way, the probability of recovery will be greatly improved.
Please don't delay!
How to use DRS from SalvationDATA to recover deleted video from SD card?
SalvationDATA, as one of the leading providers of data recovery and digital forensics solutions globally, provides a classic data recovery tool, DRS(Data Recovery System), to do an excellent job in data recovery.
It has a friendly user interface and does not require any technical experience to perform data recovery. All you need to do is to take the following steps to recover deleted files from SD cards using DRS.
1. Download and install DRS
To begin with, download the DRS data recovery application on your system. You can apply for a free trial license of DRS from the website of SalvationDATA. If you want to enjoy unlimited services, you can get its premium plan later. Open the setup file to launch the installer of the DRS. Agree to the terms and conditions, and finish the installation by following a simple click-through process.
2. Connect the SD card to the computer
Remove your SD card from your digital camera, camcorder, or any other device, and connect it to your system instead. Your computer will automatically detect it.
3. Select the SD card and scan the Files
Now, you can just launch the DRS application on your system to scan the SD card. From its home, you can view the list of connected media and available partitions to scan. Select the connected SD card from External Devices once it gets detected, and click on the Start button.
4. Wait Until the Scan Is Finished
Simply wait for a few minutes as DRS begins to scan the SD card and extract all sorts of deleted or lost content from it. The software will scan both the existing and the deleted files from your SD card, which include photos, videos, audio files, documents, emails, etc.
5. Preview the data
Once the data recovery process is over, both the existing and the deleted files will be listed under various categories. From here, you can go to the search bar on the screen and choose to show all files or only display the deleted content. To save time and find deleted files quickly, you can choose to display only the deleted content and preview the extracted photos, videos, or documents on DRS’s own interface.
6. Select the data you want to save
Now, you can just select the videos or any other kind of files that you wish to recover from the SD card. You can make multiple selections or choose an entire folder to recover. After you've chosen the files you need, just click on Recover.
7. Save your data
In the end, you just need to select a location to restore the data. We suggest you do not restore the data to the same SD card from which you lost your files. You can save the files to another SD card or to your computer.
DRS gives you an easy way to recover deleted video files from SD card. Both individual users and law enforcement agencies need tools like DRS to recover deleted files. If you want positive results, then follow the suggestions listed below.
Give it a try on DRS and it'll save your files on an SD card especially your vital video files in investigations!
The latest update of VIP 2.0 (Video Investigation Portable) is released now!
V220.127.116.113 Version upgrade instructions:
1.Added Walsh, Ezviz, xinhanshi, keshian and huiershi file system
2. Optimized NVR analysis of glass particle, Zhiteng and Yushi technology
3. Optimized the saving method of video files, and store the saved video files and corresponding verification files respectively
4. Optimized the filtering of video retrieval objects and cancel the upper limit of displaying up to 99 retrieval results
5. Optimized the scan result list and support inverse selection
6. Optimized disk imaging
7. Optimized batch transcoding tools and increase the upper limit of simultaneous transcoding
8. Supported closing the video service after closing the program
9. Supported the selection of mapped network disk path
10. Optimized search tools
11. Compatible with 2k and 4K resolution display
The latest update of SPF Pro (SmartPhone Forensic System) is released now!
V6.115.2 Version upgrade instructions:
1. Added OPPO dual APPs data extraction, allow manually setup WIFI
2. Optimized the scheme of copying media files for Android phones to improve the process speed of forensics
3. Added the maintenance entry of “material information” during the process of extraction
4. Optimized automatic extraction of Huawei mobile phone, supporting backup parsing to the latest version (18.104.22.1680)
5. Supported HarmonyOS data backup and parsing
6. Updated some plug-ins
Android: UC Browser, Quark; iOS: AKeyChat, Quark
7. Added APPs search
8. Added plug-in online upgrade function
9. Bug fixed
Recently, Huawei announced that they plan to officially launch the long-awaited Harmony OS on June 2nd, by holding a product launch event.
Before then, the operating system, which has only been used in products such as smart screens and wearable devices.
Soon after the event, it’s expected to be used in more product categories including cellphones.
Besides, they also released a video of the startup of the Harmony mobile OS on Weibo on May 27th.
Due to chasing the most cutting-edge tech on mobile forensics, we made every efforts to obtain the qualification of the internal test long before so that we made great progress in advance for the upgrade of SPF Pro.
SalvationDATA began to pay close attention to HarmonyOS at the very beginning of its emergence. Until now, we have obtained a preliminary technical breakthrough and we’re proud to say we’re capable of data extraction from devices that run HarmonyOS!
After integrating the technology into Smartphone Forensics System（SPF Pro), it’ll officially meet with you guys in the next updated version (the new version is expected to be released on June 5th).
SPF Pro is able to support the extraction and forensics investigation of normal data and deleted data of mobile phones equipped with HarmonyOS, including data of mobile phones themselves and data of third-party applications.
The existing commonly used third-party applications are also supported, including but not limited to: QQ, WeChat, Yidui, Momo, Sina Weibo, QQ mailbox, Lianxin, Tantan, WhatsApp, Snapchat, and other mainstream apps.
Customers who want to be the first to experience HarmonyOS smartphone forensics could download the next version of SPF Pro from our official website after the release on June 5.
The latest update of DBF 6300 (Database Forensic Analysis System) is released now!
V6.113 Version upgrade instructions:
1. Added online database for Oracle, PostgreSQL, support data parsing, analyzing and exporting
2. Added file mode for CSV parsing, support CSV document parsing, analyzing, and exporting
3. New online database collection tool, support MySQL, SQL Server, Oracle, PostgreSQL database online collection
4. Rebuilt hierarchical analysis, added relationship chain marking, filtering deleted data, and improve the processing capacity of million-level hierarchical analysis
5. Added functions of identification and conversion of special data for data statistical analysis (PRC Resident ID card, currency rate, etc.) and real-time editing of map data
6. Added advanced query for filtering deleted data
7. Bug fixed
The latest update of SPF Pro (SmartPhone Forensic System Professional) is released now!
V6.113 Version upgrade instructions:
1. Optimized the automatic extraction of Huawei. Improved the backup speed, support to the latest HiSuite version backup analysis.
2. Optimized the OPPO automatic extraction and backup tool. Improved the backup speed, allow users to try to continue the backup in the event of a backup failure, and improved stability.
3. Optimized the automatic extraction of vivo. Solved the problem that some mobile phones cannot extract data from some third-party apps.
4. Added “default iTunes backup password” setting, no need to manually enter when extracting.
5. Added “Calculate MD5 value of file when extracting file” setting, support export to report.
6. Optimized the analysis of iOS WeChat. Added group nickname, group joining method, and WeChat favorites data analysis.
7. Upgraded the “photo/screenshot” function. Support to save screenshots and photos to a custom node, and synchronize to the extraction results.
8. Updated some plugins:
Android: Skype(Intl), Line, ArticleNews, KakaoTalk, NinthChat, OperaBrowser, OutlookMail, Snapchat, Whatsapp, XiaoMiBrowser
As an integrated digital forensics & forensic data recovery solution provider, would never stop satisfying clients by keeping updated its software. Here we are excited to announce that newest version of DRS (Data Recovery System) is releasing today!
Let’s have a look what new features have been added to this all-in-one forensic data recovery tool:
1. Physical diagnostics is now available for all drives attached to the DRS hardware unit and your PC. Quick Diagnostics, Scan Bad Sector and Sector View are all accessible for drives plugged to the hardware unit or not.
2. New file system support: CDFS, UDF, F2FS are now supported for analysis (CDFS & UDF not supported for Pattern Scan).
3. New image format support: VHD, VHDX.
4. New search options: folder name search and time search. Allow users to search for folders with certain keywords or specify a certain time period to narrow down their search.
5. New feature in Disk Imaging: large disk image to small disk.
6. New feature in Hash Calculator: Hash calculation for physical drives.
7. New feature in imaging report: authentication of forensic image.
8. Multiple bugs fixed.
Click HERE to learn more about DRS.