Earlier we talked about preparing for
data recovery. Today, we're going to
talk about how to actually get your pics back from corrupted or accidentally erased digital media. It's not as scary as
many people think. If you use Windows, there are a number of
data recovery programs out there and you may be able to find one to fit your needs and budget. If you use another
OS, though, or you just want complete control over the process, it's surprisingly simple to roll your own recovery
program. Most operating systems have all the tools you need built in, in the form of basic unix commands and utilities,
specifcally dd, and the Perl language. Windows users can use the same
tools through the Cygwin environment or they can install a Perl
binary distribution and use a binary copy tool like
Undisker.
The process relies on some basic assumptions:
-
The files being recovered will all be of the same type (JPEG in this case, modifying for another format wouldn’t be too hard). This is why we recommended using different cards for different file types.
-
The card being recovered is formatted FAT16 or FAT32. Cards from all cameras I’m aware of are.
-
The files to be recovered occupy contiguous sectors on disk. This will normally be true until the total data written to the disk exceeds the capacity, that is, until the camera starts reusing space from deleted files. the more rewrites, the more fagmentation, and the smaller the odds of recovery. This is why we said to reformat often.
The first step is to make a byte copy of your card so that you don’t risk damage to the original. To do this, you need to access the raw device for your card. If you don’t know how to find that information, I posted some pointers with the original version of the script. On most systems, the command to make the copy will be `dd if=”/dev/sg0? of=”flash.img” bs=512`. Replace ”/dev/sg0” with the path to your raw card. The command is the same under Cygwin on windows, or you can use Undisker.
Once that’s done, you need to grap the script that’s going to do the heavy lifting from http://www.engatiki.org/flashrecover. Save it as “flashrecover” (on Windows you may want to save it as flashrecover.pl). At the command line, type `perl flashrecover flash.img`. And that’s it. The script will sift through the copy of your card and save any JPEGs it finds to a directory called “lost+found” in the directory where you run the command. (It’s really about that simple; if you’re interested in exactly how it works, there’s a more detailed discussion here.)
The script can take a while to run. Once it’s done, go through and open up the recoverd files and see how they came out. Some may have been corrupted by being partially written over or fragmented on disk. The last file recovered may also have garbage attached. If you encounter errors, try reexporting the files from your graphics program.








1. You may wish to have a look at my jpeg_recover.c hack:
http://www.flamingspork.com/blog/?p=217
Posted at 6:26AM on Dec 19th 2005 by Stewart Smith