Page 1 of 1

Corrupted MRW althoug EXIF is correct.

Posted: 19 Feb 2013, 11:28
by busybear
Hello!
I'm using PhotoRec with great success, it finds what I'm looking for, some lost MRW-files which is Minolta RaW pictures. But the problem is that the picture is totally corrupted although the EXIF is all there, complete with date, lens used, focal lenght, flash fired or not, you name it... The size of the files are also correct, 8.2-8.9 Mb, which is normal.
All the jpg:s are found correctly, although those dowloaded from camera only in thumbs, system pics turn up in original size. Some tif:s are also found, they are scanned documents, but they are partly corrupted although I can recognize them.
I use 6.14 under Debian on a WDC 320Gb, originally NTFS but overwritten with Linux ext3, whole disk, paranoid brute force, not keeping corrupted files. The disk is healthy with no bad sectors, and since I find so much correct info I think the offset is right. But since I'm a photographer and not a forensic I might be wrong...
Any suggestions???

BTW: This program is awesome, and I recommend it to everyone who has lost something, may it be info or their mind...

Re: Corrupted MRW althoug EXIF is correct.

Posted: 28 Feb 2013, 13:27
by cgrenier
When a partition is formated as ext2/3/4 filesystem, backup superblocks are written a little bit everywhere.
MRW are big files, so some of them may have been overwritten by such superblock.
If you set paranoid:no in FileOpts, do you get more good MRW files ? (Files will be larger than originals).

Re: Corrupted MRW althoug EXIF is correct.

Posted: 06 Mar 2013, 11:10
by busybear
Hello!
First of all, excuse me for the late reply...
No, I didn't get it any better than that, the EXIF info is there but the pics are gone. Or maybe not gone, but lost somewhere on the disk... But since the last attempt I did I've managed to locate a (hidden & encrypted) backup on a 1TB Linux low level cryptodisk and voilá, there they were!!! So I actually didn't try any harder, but at least I know that it's possible to recover even a reformatted and overwritten NTFS, or at least get a lot of useful information out of it. Those tools are amazing, and it seems that the only way to hide info from them is to crush the disk physically... Thanks a lot, and keep up the good workl!!!