cgsecurity.org

Hi everybody,

I have a problem here.
My Girlfried has a external 1TB (fat16) HDD to store her precious photos.
2 weeks ago she deleteted them all by mistake. Well done I said, now its up to me to undo her mistake :/

Initial situation:
The harddisk is almost empty, all photos (lots of GBs) are superficial gone, there is only unrelevant stuff left.
Using testdisk, I was able to restore quite some photos. I guess it is the major part of the deleted stuff.

The Problem:
99% of the restored pictures are in a broken state. I assume the image headers are broken

• All Filenames are very strage

• The files cant be opened, all image editors report errors on opening (i.e.: we cant open this file)

• the images are restored in a $RECYCLE.BIN container/folder

What I did:
1) I tried to simply rename some images, this does not have any effect.

2) I tried JPG Repair Shop to fix the images (by providing the whole directory. i.e. $RECYCLE.BIN)
It runs into: "Cannot load file, corrupt header"

3) I also tried "Stellar Toolkit for Windows" on a very reduced fileset (10 files).
It kind of succeeded, at least it was able to restore some pictures complete or partly (like 3 out of 10)
(but I couldnt use them, because I have to spend 299$ for the full version. D'oh! )

So I end up in the following two conclustions:

• EITHER: Out of any reason the image headers got broken.

• OR: The images are inaccessible, because the are "in a deleted state". Does Windows change/modify/compress images or file, when they get moved into the recylcle.bin?

The question:
Do I have any chance to repair/fix the broken images?
Is there any tool capable like stellar availble on linux/mac as freeware?

Or can I "undelete" the files in some way from the $RECYCLE.BIN?
At least this is not possible in Windows with a right click on that folder.


I would really appreciate some good input on this,
Thanks in advance!


Attachments:

Example Images:
https://drive.google.com/open?id=1G23U_ ... _CRm0q8Q81
https://drive.google.com/open?id=1WewR2 ... FCkXxIqP1f

Strange Filenames of the restored images:
https://drive.google.com/open?id=1JHWLD ... tlOjW_lXvJ

A FAT16 can't be over 4 Go (2 Go usually). So you have probably another filesystem.
Can you scan the disk using PhotoRec ?
Are the recovered jpg OK ?

HI cgrenier,

thanks for your response. It can't be fat16, it is fat32, you are absolutely right on this.
I am running Photorec now. Lets see what happens, this will take some time.

But isn't Photorec very identical to test disk?

Regards, Ralph

I can answer my question for myself.
Just checkt the output. Photorec recovers plenty readable foots.
Photorec seems to be way better to recover images than testdisk.

Thanks for your support. This thread can be closed.