Luke Ashe-Browne Open source, web technology and feeble attempts at eloquence

Camera file and Jpeg Recovery

Wow, well it's been some time since i stuck something up here, thought I'd pressure myself into logging in again, first task, I'd lost my password so reset the database field in the database for my user. That was annoying.

So down to the subject of this post. File recovery under linux, specifically in this case recovering photos and videos from an accidentally wiped SD HC memory card. I went through a painful experience recovering data from SD cards from our camera lately. Thought it might be nice to share with any who care to read, the summation of the tests and trial it took to get where I got to. Ultimately i recovered maybe 95% of what i wanted, but there were still some images and a video that i didn't get back that are really still on my mind. for this reason I have removed the 2 discs in question from the camera they inhabited and stored them safely for future recovery attempts.

Step 1.
simple jpeg recovery
command:
recoverjpeg -b 1 -r(ram/4)1024m -m 120m -v
reasonable success rate
no videos recoverd at this point

Step 2.
dd_rescue (or gddrescue) ddrescue:
dd_rescue /dev/sde1 ./diskimage.img
this will image the disk, so you must try to do a forensic file recovery from this image.
"foremost" is an application for this.
command:
user@host:~/foremost -vaT -b 1 -k 1024 -t jpeg,jpg,avi,mov,mpg -i cnn8gb.dd

We seem to have had this happen twice to us, though i'm not sure anyone hit the format button, i'm actually worried about it having received a knock at some stage, and now twice we have lost photos on 2 differen SD HC memory cards.
So as a little hlpe, i used a set of linux tools to recover data off them.
First off i connected the memory card to my laptop using a usb multi card reader. I plugged in the memory card and had to unmount it once it connected.
I run a command terminal to execute a few simple commands, "gnome-terminal" is normal for ubuntu based linux desktops, though kterm or others may be available. use whatever is in your applications->accessories direcotry. I had to install a few packages to get access to the tools i needed, simple enough though, "sudo aptitude install ddrecover recoverjpeg testdisk foremost scalpel" and i have everything i could hope to need.
I made a directory, Pictures/recoverjpeg/ in my home directory and cd'd into it.
Next i ran "dd_recover /dev/sde1 ./memcrd8gb.dd" this makes a backup image of the sector by sector data on the drive in a resilient mannor, any disk errors should be handled quite well by this tool. Took a little while.
Next i ran "recoverjpeg -b 1 -r 128m -m 1024m ./memcrd8gb.dd" this took some time again, but i got about 90% of the images back. Some important ones still were missing, 2 videos and a few others. So next on the list of tools is foremost, they refere to it as a phorensic file recovery tool. Sounds like a serious utility.
"foremost -vaT -b 1

In the end

In the end i didn't get all the images i wanted. And one video still remains outsanding that i failed to recover. Annoying  !! Well maybe in time when I get a chance to retry everything on other apps on different OS's they may yet be recovered.

I attach two of the images I did manage to recover from the disks, a rather nice pair of shots of Piaza San Marco in Venice. One of the main views is the cathedral and looking towards the docks and the other is up the square itself toward the museum. It was a great holiday.

If anyone manages to use any of the information i provide to recover their images, leave a comment, it would be nice to have comments.

Thanks and hopefully I won't leave it so long to post again.

Luke.