restored deleted files -> broken headers

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
raulelmagico
Posts: 3
Joined: 10 Sep 2019, 11:16

restored deleted files -> broken headers

#1 Post by raulelmagico »

Hi everybody,

I have a problem here.
My Girlfried has a external 1TB (fat16) HDD to store her precious photos.
2 weeks ago she deleteted them all by mistake. Well done I said, now its up to me to undo her mistake :/

Initial situation:
The harddisk is almost empty, all photos (lots of GBs) are superficial gone, there is only unrelevant stuff left.
Using testdisk, I was able to restore quite some photos. I guess it is the major part of the deleted stuff.

The Problem:
99% of the restored pictures are in a broken state. I assume the image headers are broken
  • All Filenames are very strage
  • The files cant be opened, all image editors report errors on opening (i.e.: we cant open this file)
  • the images are restored in a $RECYCLE.BIN container/folder
What I did:
1) I tried to simply rename some images, this does not have any effect.

2) I tried JPG Repair Shop to fix the images (by providing the whole directory. i.e. $RECYCLE.BIN)
It runs into: "Cannot load file, corrupt header"

3) I also tried "Stellar Toolkit for Windows" on a very reduced fileset (10 files).
It kind of succeeded, at least it was able to restore some pictures complete or partly (like 3 out of 10)
(but I couldnt use them, because I have to spend 299$ for the full version. D'oh! :? )

So I end up in the following two conclustions:
  • EITHER: Out of any reason the image headers got broken.
  • OR: The images are inaccessible, because the are "in a deleted state". Does Windows change/modify/compress images or file, when they get moved into the recylcle.bin?
The question:
Do I have any chance to repair/fix the broken images?
Is there any tool capable like stellar availble on linux/mac as freeware?

Or can I "undelete" the files in some way from the $RECYCLE.BIN?
At least this is not possible in Windows with a right click on that folder.


I would really appreciate some good input on this,
Thanks in advance!


Attachments:

Example Images:
https://drive.google.com/open?id=1G23U_ ... _CRm0q8Q81
https://drive.google.com/open?id=1WewR2 ... FCkXxIqP1f

Strange Filenames of the restored images:
https://drive.google.com/open?id=1JHWLD ... tlOjW_lXvJ

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: restored deleted files -> broken headers

#2 Post by cgrenier »

A FAT16 can't be over 4 Go (2 Go usually). So you have probably another filesystem.
Can you scan the disk using PhotoRec ?
Are the recovered jpg OK ?

raulelmagico
Posts: 3
Joined: 10 Sep 2019, 11:16

Re: restored deleted files -> broken headers

#3 Post by raulelmagico »

HI cgrenier,

thanks for your response. It can't be fat16, it is fat32, you are absolutely right on this.
I am running Photorec now. Lets see what happens, this will take some time.

But isn't Photorec very identical to test disk?

Regards, Ralph

raulelmagico
Posts: 3
Joined: 10 Sep 2019, 11:16

Re: restored deleted files -> broken headers

#4 Post by raulelmagico »

I can answer my question for myself.
Just checkt the output. Photorec recovers plenty readable foots. :)
Photorec seems to be way better to recover images than testdisk.

Thanks for your support. This thread can be closed.

Locked