Deleted files written over each other

[Amber Shore]

I have some video files from a Panasonic GH5 that I'm trying to recover. I don't expect to be able to get them all, but the main one I want to recover says it been overwritten by another file, and that file says it has been overwritten by another. Now the part that's weird is that these files that are occupying the same space as the big file I want... They were created BEFORE I accidentally formatted the card. How's that possible? I think that Recuva is seeing the files incorrectly. 

 

[Rtic-Jan H te A]

You probably defragmented the volume. Defragmentation does not change the dates but could well have used the "deleted" space of your video.

[Amber Shore]

I didn't. This all happened in-camera.

[Rtic-Jan H te A]

36 minutes ago, Amber Shore said:

I didn't. This all happened in-camera.

Then there's the possibility that at one point your camera ran out of power and the date was reset to a point prior to the actual date.
Happens to me all the time  You say all happened "in-camera". For the format operation this might be true. But for the recovery
operation you certainly had to get the memory card out. By the way, was the format the reason the video got deleted or a previous 
"in-camera" delete operation. Because the scenario I describe are based on losing it from a delete and not from a reformat.

[Amber Shore]

It was from an in-camera reformat.

[Amber Shore]

Also, none of the recovered files will play in VLC, and attempting to import them into Premiere Pro results in program crash.

[Rtic-Jan H te A]

9 minutes ago, Amber Shore said:

It was from an in-camera reformat.

Presumably the used filesystem for the format is exFat. Do you now if this is true? Did you by any chance interupted
the reformat as soon as you discovered that you made a mistake in formatting the card.

The manual states "Since data cannot be recovered after formatting, make sure to back up necessary data in advance."
https://www.panasonic.hk/usm.ashx/e/7zt1rwYXAiWEX1X3Hkyy9Oya-c1I6Tp~RB5G1h6nzkK0J5LOPzceY89CTan60f_WT_9uHtwthepX4ieljaqKF_2TQ2w4IxW20FlS_dqC9R-UEqim0k0eiNIJxDI6R7Gg/DCGH5_EN.pdf

Whether that's universaly true and due to the formatting proces as Panasonic implemented it, I don't know.

[Augeas]

This 'file is overwritten by an earlier file' is common for a deleted file in FAT32. However you're almost certainly using exfat so that might not apply. I am not familiar with exfat structure, nor the deletion or your camera's formatting process. It seems strange that after a format these user files can be seen, as a format should (and will) empty the root directory except for any system files.

As for replaying them, if they're overwritten then not a chance. You'll be recovering, and trying to play, part of an entirely different file.

Is that large file 32gb?

 

[Rtic-Jan H te A]

The entries in the Directory and FAT are merely marked available when a quick format takes place. A recovery tool can see the
original structure when the formatting is not destroying them in any other way.

[Amber Shore]

Yeah it is formatted ExFat. I didn't find out that the formatted SD had anything we wanted until we had shot about 8GB on top of the newly formatted card. I see that many files were overwritten by post-format files. Those are toast for sure. All I want to recover are those that were not overwritten after the format. The fact that some are showing up as overwritten by pre-format files is what has me confused. 

[Rtic-Jan H te A]

3 hours ago, Amber Shore said:

The fact that some are showing up as overwritten by pre-format files is what has me confused. 

What you see are cross linked files. What is convincing you that the old files are written over the large video. And that it's not the 
video that occupied old previous ?deleted? files. Iaw maybe you should try to recover the video (to another medium!!!) and see what comes out.

[Augeas]

Were all those files listed created (4 Aug) after the format? Did you delete them straight away? Where are the files overwritten by files created before the format? Are they the seven at the top of the list?

I've never known a deleted file to be overwritten by anything other than a live file. I am guessing that:

During the format the new root directory was written on top of the old root and has pre-allocated space to keep it in one extent. The previous file names in the root directory are thus available to be read by Recuva.

ExFat is significantly different from FAT32 as it no longer uses the FAT to identify used space, this is done by a cluster bitmap. FAT entries are no longer zeroed on file deletion or (I assume) a format.

If a file uses contiguous clusters then the FAT is not referenced at all.

I think that Recuva might be getting confused over non-zero FAT entries and deleted clusters shown by the bitmap. None of us actually knows Recuva internals and I bet a pound to a penny nobody knows how ExFat works either, as it is proprietary software. I should write it off as a curiosity.