Originally Posted by
RichardKenner
Off topic, but on some file systems, a delete is a modification of the directory above it, so you can tell that way.
You could tell that
something happened, but I suspect not
what happened.
Originally Posted by
RichardKenner
But this was a formating of the device. There's a possibility that the creation date and time of the directory might point to when it was formatted.
"Formatting" in MS-DOS parlance is what is referred to as "creating a file system" elsewhere. Typically, it destroys/corrupts existing data. I suspect that the operation performed on my camera was "erase all" rather than "format card".
Originally Posted by
RichardKenner
Did you make a bit-for-bit copy of the card before running your software?
Yes. I powered the camera on, saw its indication that images and videos were gone, powered off, removed card, mounted the card read-only in my laptop, made a bit-for-bit copy, copied that data to a secure, off-site location, and stored the card somewhere safe.