Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my camera and saw that its SD card was formatted. But then I realized that it was formatted in FAT, and the camera doesn't even work with that file system. Nobody had access to a computer, so I think that somebody placed his SD card in my camera and took my SD card (no idea why). So now I have his SD card.

Now, I'm not entirely sure who did this, but I have an idea.

If I could some how check which cameras this SD card has been used on, I could then find out who has that camera, and voilà, I'd know who did it.

I don't know much about security, but is there a way to do this?


Update

Ok, well apparently nobody stole my card. Thanks to HamZa DzCyberDeV and TildalWave, I was able to recover every photo on the card. And it is my card. Somebody just reformatted it...

share|improve this question
9  
My condolences. What you could do is to try some free recovery software, you may find old files or even better pictures/videos. –  HamZa May 19 '13 at 15:35
2  
Haha. Good idea. I hadn't thought of that. –  Dan the Man May 19 '13 at 15:46
    
Your 'friend' could have been wanting to view their photos via your camera? Is the card of your the same size/brand? Are you sure your card isn't corrupted and just behaving weird? –  NULLZ May 19 '13 at 22:53
1  
Out of curiosity, what camera do you use that doesn't work with FAT? All of the cameras I'm familiar with only recognize the FAT filesystem, but I'm only familiar with USA-sold cameras. –  Johnny May 19 '13 at 22:56
    
@D3C4FF, yes, it's the same card size and brand. It's just more beat up. –  Dan the Man May 20 '13 at 11:48
show 2 more comments

2 Answers

up vote 9 down vote accepted

Provided you didn't reformat the new card and/or write anything else on it, there's a good chance you could restore some of the deleted contents with tools like undelete or unformat (some such tools are freely available, just Google for them). I've done it before and is quite possible, that is of course, assuming the card in question was actually used before, and is not new and never written on.

Restored files would probably be missing parts, or at the very least their names would be all wrong (FAT removes the first letter of the filename on delete), but you could perhaps be able to inspect EXIF data on any such restored files (JPeG files), or load RAW files in a compatible reader, and see the camera make from there. Another possibility is also to check for any XML files in the directory structure (usually in a folder named DCIM_XXX where XXX is some incremental number), as some camera manufacturers include thumbnail information in them (e.g. Panasonic does, possibly others too). Often (it is so on my camera), these XML files would contain camera model information. If you have problems finding good tools to read such metadata in, you could also load them in freeware software like Notepad++ and inspect for any identifying file header information (such metadata are normally in the first parts of files).

But whatever you do, don't write on the card (unless you're trying to restore previous files with undelete, or unformat it), and move the read only slider on the side of the card to locked position before putting it in other camera models, as a precaution.

The read-only lock on this photo is the orange part on the side, push the slider down (photo shows it in write enabled mode) to make it read only: SD card

Alternatively, some partition restoration tools (mostly more advanced and as such paid ones though) are also capable of reading your card's raw data, and creating disk's mirror copy that you could upload to your forensically better versed friends to play with, and see if they're able to come up with something. Assuming the raw data stream is not filled with data, such disk's mirror image should compress pretty well with file compression tools, and you might end up with a few MB worth of data to upload - quite reasonable to expect that shouldn't be a problem then. ;)

share|improve this answer
    
Thanks, pal. It worked quite great. See update. –  Dan the Man May 20 '13 at 12:04
add comment

No, this is most likely not possible unless the camera leaves some sort of metadata on the SD card, which is highly doubtful.

share|improve this answer
    
It is even less likely if whoever did this emptied the card before doing the switch. –  Michael Kjörling May 19 '13 at 15:33
    
Ok. I was hoping that every camera did leave something like that. –  Dan the Man May 19 '13 at 15:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.