3

I have deleted a video from my SD card six months ago. How much time does it take to fully destroy this video file on the SD card? If I wanted to recover this video, is it possible to recover?

schroeder
  • 123,438
  • 55
  • 284
  • 319
Sajjad Hossain
  • 33
  • 4

4 Answers4

5

When you delete something from an SD card (or most mass storage media) it doesn't actually get deleted. The space on the card where the file is stored is simply marked as unused and will be reused when space for a new file is needed.

Whether or not the file can be restored with data rescue software depends on how much new space was needed in the meantime for creating new or enlarging existing files.

If there were no write operations on that SD card after the file was deleted, then it is very likely that it can be recovered. But if someone created a couple new files on the card in the meantime, then there is a good chance that some or all blocks of the deleted video were overwritten.

Philipp
  • 48,867
  • 8
  • 127
  • 157
  • For example in Linux you can use the command shred that basically overwrites the file as many times you want with random data. – camp0 Oct 01 '19 at 15:14
  • As campo said, `shred` is available on Linux, use it (both for shred and Linux). – Ed Neville Oct 01 '19 at 18:00
2

To reiterate what Philipp said, it depends on whether or not the space was overwritten. While it's possible to recover the file using tools such as Recuva, you're unlikely to find anything usable as a general end-user if you've been using the SD card long enough.

That doesn't mean that fragments of the video can't be recovered; file carving programs can recover fragments of deleted files unless the space has been completely overwritten. What this means is that a few frames of the video could be recovered, even if everything else is overwritten.

You would need to fill up the remaining space of the SD card a few times to reliably delete it.

Mark Buffalo
  • 22,498
  • 8
  • 74
  • 91
1

For traditional platter HDs and for flash drives (SD cards, pen drives, ...)

In order to delete it for good you need to erase the slack, that is the space where the file still resides and which is made available to new files (or growing existing ones). You can erase this space with tools like CCleaner or Eraser.

For SSDs

You do not need to do anything, the files are automatically erased and unavailable thanks to garbage collection.

WoJ
  • 8,957
  • 2
  • 32
  • 51
  • 1
    This is bad advice because in general, [this isn't true](http://arstechnica.com/security/2011/03/ask-ars-how-can-i-safely-erase-the-data-from-my-ssd-drive/). – Mark Buffalo Nov 08 '15 at 19:22
  • See http://articles.forensicfocus.com/2014/09/23/recovering-evidence-from-ssd-drives-in-2014-understanding-trim-garbage-collection-and-exclusions/, particularly *Acquiring Evidence from SSD Drives* – WoJ Nov 08 '15 at 19:29
-1

If your looking for standards on overwrite passes, one of the commonly referred to ones is DoD 5220.22-M. This calls for 3 overwrite passes followed by a verification pass.

Whitecanyon (I have no affiliation with this resource) has a pretty good write up on it: DoD 5220.22-M Relevancy & the Evolution of Wipe Standards

There is also the NIST 800-88r1 which speaks directly to data sanitation of SD-cards as well as other media. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

Sean E. M.
  • 126
  • 5
  • Where in that DoD document does it say 3 passes for SSD? – schroeder Oct 01 '19 at 13:05
  • Please do not just post links but include the relevant details in those links. For instance, it looks like your suggestion that DoD 5220.22-M says "3 passes" is incorrect. When linking the NIST 800-88r1, include what that document says the process is (1 pass, btw). – schroeder Oct 01 '19 at 13:09
  • Also, the question is not how to purge the media, but how much time it would take for data to naturally get overwritten. – schroeder Oct 01 '19 at 13:10
  • Apoligies if I misintepretted you intention of typical overwite time through some form of typical use. Regarding the 3 pass reference: Under the subheading, 'What is the DOD Standard?' you will find the 3 passes listed, which I'm sure are easily found when following the link: Pass 1: Overwrite all addressable locations with binary zeroes. Pass 2: Overwrite all addressable locations with binary ones (the compliment of the above). Pass 3: Overwrite all addressable locations with a random bit pattern. Verify the final overwrite pass. – Sean E. M. Oct 01 '19 at 14:15