Fragments recovery (raw disk copy)

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Felice
Posts: 1
Joined: 28 Aug 2014, 20:44

Fragments recovery (raw disk copy)

#1 Post by Felice »

Hello,
I'm trying to recover from a CF card a photo that has been deleted and PARTIALLY OVERWRITTEN.

I've just run photorec, that's what I can see in the report.xml:

<fileobject>
<filename>f0999659.jpg</filename>
<filesize>2002259</filesize>
<byte_runs><byte_run offset="0" img_offset="511857664" len="2015232"/></byte_runs>
</fileobject>

<fileobject>
<filename>f1010219.ctg</filename>
<filesize>16384</filesize>
<byte_runs><byte_run offset="0" img_offset="517264384" len="16384"/></byte_runs>
</fileobject><fileobject>

511857664 + 2015232 = 513872896

Remembering the exact time in which my photo has been taken, I'm pretty sure that fragments of that file can be found from 513872896 and 517264384. Without header, of course (file has been partially overwritten).
Is there any way to have a raw copy of that data?
Thanks a lot.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Fragments recovery (raw disk copy)

#2 Post by cgrenier »

In Options, enable the expert mode, enable keep corrupted copy, start a recovery, use a blocksize of 512 when asked, use the default options otherwise. Do you recover your pictures or picture fragments this way ?

Locked