...making Linux just a little more fun!
Neil Youngman [ny at youngman.org.uk]
Recently I've needed to recover photos from 2 compact flash cards, one of which was accidentally formatted and one of which was faulty. Subsequently I have used the "expertise" acquired to recover photos from a formatted SD card as a favour to a random stranger on the internet.
The first thing I did was backup the card, using a simple dd if=/dev/sdX1 of=/path/to/data
The first time I did this, I was in a hurry. I had seen a lot of recommendations for a Windows tool called Recuva and I didn't want to spend much time on research, so I just grabbed a copy of that. It seemed to work just fine "recovering" 1045 files, but on closer inspection, none of them were complete. They should have been 3-5 MB jpegs, but they were all about 1.5MB and only the thumbnails were viewable. I messed about with the settings, to no effect and looked at a couple of other Windows tools, before I saw a recommendation for photorec, which is part of Christophe Grenier's testdisk suite. http://www.cgsecurity.org/wiki/PhotoRec
Photorec looked like a Unix native tool, so I downloaded the appropriate tarball, unpacked it and ran it. It took the file name of my backup as an argument, so I didn't even need to have the card handy. I walked through a few simple menu options and it recovered just over 1000 photos. This time they all appeared to complete, full resolution photos. As far as I could tell there was nothing missing.
Reading through the instructions, I found that there was probably junk data at the end of the photos, which could be removed by running convert (from the ImageMagick suite) on the jpeg.
The sequence of commands below is how I recovered the photos from the SD card.
$ dd if=/dev/sdd1 of=/tmp/sdcard.bin $ ~/testdisk-6.11.3/linux/photorec_static /tmp/sdcard.bin $ mkdir /tmp/recovered $ for file in /tmp/recup_dir.1/*.jpg; do convert "$file" "/tmp/recovered/$(basename $file)"; done
The first command is just a binary copy of the raw data from the SD card to a file.
The next command obviously runs photorec itself. In the menus, just accepting the defaults is usually sufficient, but you have to select a directory in which to store the results. Photorec actually creates subdirectories under that directory, called recup_dir.N. In this case I selected /tmp/ to store the recovered photos in.
Having recovered the photos, I created the directory /tmp/recovered and ran a loop, calling convert on the files, as explained above. That directory, containing the final results was then burned to a CD, which was sent to the owner of the photos.
As you can see photorec is a very simple tool to use and as far as I could, it recovered all the files that we expected to find on the various flash cards. I would recommend it to anyone who has a need to recover photos from a corrupt, defective or formatted flash card.
Neil Youngman
Mulyadi Santosa [mulyadi.santosa at gmail.com]
Hi..
to the best I know, Photorec is the one of the most trusted tools in data recovery (forensic). The other one is foremost.... AFAIK, these tools are created originally for military (or funded? maybe just created by) needs.
Anyway, it depends on how the tools parse and recognize the correct headers and boundaries IMHO.
-- regards,
Mulyadi Santosa Freelance Linux trainer and consultant
blog: the-hydra.blogspot.com training: mulyaditraining.blogspot.com