Manual recovery of the unrecognized files
Posted: 11 May 2015, 23:10
Hello all, I stumbled upon PhotoRec while repairing my camera's flash card contents - it went south for the second time in five years while moving files off it (gotta stick to copy+verify+delete instead), losing the MBR, FAT and some contents as well.
PhotoRec did a great job recovering from a DD'ed image of the flash card most of my JPG contents perfectly (sans filenames - f1234567.jpg patterns instead... good enough). After a quick pass on default settings that found 360 "f*" files, I set it to churn on a server for a few days in paranoid mode, with minimal 512b sectors since I was uncertain of older format settings, and all data types enabled (ok, that was an overkill - took greater part of the week to complete) and now it found some 368 "f*" files reliably.
After looking through them I found that I expected yet more files to be there unless the card utterly destroyed them (which it could), and that some 52 files in the found set happen to overlap in contents (as in - identical size and content) which might make sense if they were copied around the flash card, but I doubted the camera would do that. Well, maybe that's some artefact of the flash firmware hiccup...
Indeed, PhotoRec found also tons of b1234567.jpg pieces of photos (undersized bits) or "confetti" with shifted blocks of the image, and a hefty 320Mb (of the 2Gb card) as unrecognized data. It also recognized none of the several videos I've made during that filming session. Overall, it found about 1200 Mb worth of files (as a sum of the recup_dir sizes) and this chunk, which is 500Mb short of the flash-card size. But maybe the zero-blocks were skipped...
Those shifted-block "confettis" make me uneasy because it seems that many of those images are attempts to recombine the jigsaw puzzle of the same blocks used already in the successfuly recovered image. Or it may mean that the card returned same data on many logical offsets, while it was dd'ed over to recovery box.
So, after so much preamble, a couple of questions:
1) what is the suggested way to try and dig out some data from the "unrecognized" pile?
2) any ideas why PhotoRec found no videos? Maybe my recovery system misses some libraries (likely does - it's not desktop-oriented, and I had to install quite a few packages just to get PhotoRec compiled)?
3) is there (planned?) an interactive graphical mode to try and manually recombine the yet-unassigned sectors to some files (so one can visually see in real time whether the selected and ordered puzzle-like bits of JPEG-represented data fit together to form the same image in proper order) so that I can on one hand be more certain that everything possible was recovered, and on the other hand some of those "b*" scraps are put to good use to revive a few more actual files correctly?
Thanks in advance, and thanks a lot for the already reat piece of work,
Jim Klimov
PhotoRec did a great job recovering from a DD'ed image of the flash card most of my JPG contents perfectly (sans filenames - f1234567.jpg patterns instead... good enough). After a quick pass on default settings that found 360 "f*" files, I set it to churn on a server for a few days in paranoid mode, with minimal 512b sectors since I was uncertain of older format settings, and all data types enabled (ok, that was an overkill - took greater part of the week to complete) and now it found some 368 "f*" files reliably.
After looking through them I found that I expected yet more files to be there unless the card utterly destroyed them (which it could), and that some 52 files in the found set happen to overlap in contents (as in - identical size and content) which might make sense if they were copied around the flash card, but I doubted the camera would do that. Well, maybe that's some artefact of the flash firmware hiccup...
Indeed, PhotoRec found also tons of b1234567.jpg pieces of photos (undersized bits) or "confetti" with shifted blocks of the image, and a hefty 320Mb (of the 2Gb card) as unrecognized data. It also recognized none of the several videos I've made during that filming session. Overall, it found about 1200 Mb worth of files (as a sum of the recup_dir sizes) and this chunk, which is 500Mb short of the flash-card size. But maybe the zero-blocks were skipped...
Those shifted-block "confettis" make me uneasy because it seems that many of those images are attempts to recombine the jigsaw puzzle of the same blocks used already in the successfuly recovered image. Or it may mean that the card returned same data on many logical offsets, while it was dd'ed over to recovery box.
So, after so much preamble, a couple of questions:
1) what is the suggested way to try and dig out some data from the "unrecognized" pile?
2) any ideas why PhotoRec found no videos? Maybe my recovery system misses some libraries (likely does - it's not desktop-oriented, and I had to install quite a few packages just to get PhotoRec compiled)?
3) is there (planned?) an interactive graphical mode to try and manually recombine the yet-unassigned sectors to some files (so one can visually see in real time whether the selected and ordered puzzle-like bits of JPEG-represented data fit together to form the same image in proper order) so that I can on one hand be more certain that everything possible was recovered, and on the other hand some of those "b*" scraps are put to good use to revive a few more actual files correctly?
Thanks in advance, and thanks a lot for the already reat piece of work,
Jim Klimov