Corrupted JPEG files after recovery

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
felixsark
Posts: 3
Joined: 30 Dec 2013, 01:09

Corrupted JPEG files after recovery

#1 Post by felixsark »

I have successfully recovered over 20,000 jpeg images from a partition that had its file system corrupted.
I used 'dd' command to copy the unreadable/unmountable partition to another hard drive which created a 451GB file!
I then used the PhotoRec program and had over 380 folders created with many, many files. The pictures where stored on the hdd using iPhoto, so there were pictures, two size of thumbnails and the faces pictures from each picture. Then I used EXIFtool by Phil Harvey to change the name of the jpgs to their creation date and automatically place them in year and month folders. All seemed fine specially in the really old files from the year 2000 through 2010. But once I got into the 2013 pictures, mostly a particular month most of the recovered files are corrupted. They are either cut off partially or some are scrambled or some have bunch of colors missing. There are also some that contain multiple pictures all in pieces! Overall, going through two years worth of pictures (tedious process) I have identified about 150 pictures that are corrupted (most are from our last vacation that I hadn't backed up, yet!)
When running the EXIFtool, I kept the log that shows which recovered file is changed to what name, so I can go back and find the file in the correct folder. I also still have the original copied partition (the one that is 451GB).

Here comes the question: Has anyone tried to fix a situation like this? I don't know how to search a file that size and start looking for headers and other info to see if the files were recognized correctly by PhotoRec.
Is anyone out there that has had a similar problem and has been able to try to recover more of the pictures than what PhotoRec was able to do?

Any ideas are welcome!
Thanks...
F.S.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Corrupted JPEG files after recovery

#2 Post by cgrenier »

What was the original filename of the jpg ?
If the filename is of the form "f*.jpg", the jpg should be ok, "t*.jpg" are thumbnails, "b*.jpg" are corrupted files.
If you have set Paranoid to No in Options, all files, broken or not, are recovered as f*.jpg

felixsark
Posts: 3
Joined: 30 Dec 2013, 01:09

Re: Corrupted JPEG files after recovery

#3 Post by felixsark »

Thanks for the response.
I must've used the "Paranoid = No" option, since I didn't find any files starting with "b*".
I have resigned to the fact that there are some files that are corrupted. My question is when I do a hexdump of a good conversion and a corrupted file, I see that in the corrupted file the end marker of the JPEG file (xFF D9) is not at the "end of file", but rather I see a couple xFF D9 locations in the same file (perhaps one for thumbnail and one for actual image?) and also large blocks of zeros in the file!

partial example from one corrupt file (file too big to attach):

(start of file)
00000000: FF D8 FF E1 58 FE 45 78 ÿØÿáXþEx
00000008: 69 66 00 00 49 49 2A 00 if..II*.
00000010: 08 00 00 00 0C 00 0E 01 ........
00000018: 02 00 20 00 00 00 9E 00 .. ...ž.
00000020: 00 00 0F 01 02 00 05 00 ........
00000028: 00 00 BE 00 00 00 10 01 ..¾.....
00000030: 02 00 09 00 00 00 C4 00 ......Ä.
00000038: 00 00 12 01 03 00 01 00 ........
.
(data)
.
00002D40: F9 FA FF C0 00 11 08 00 ùúÿÀ....
00002D48: 78 00 A0 03 01 21 00 02 x. ..!..
00002D50: 11 01 03 11 01 FF DA 00 .....ÿÚ.
00002D58: 0C 03 01 00 02 11 03 11 ........
00002D60: 00 3F 00 FF 00 3F FA 28 .?.ÿ.?ú(
00002D68: 00 A2 80 0A 28 00 A2 80 .¢€.(.¢€
00002D70: 0A 28 00 A2 80 0A 28 00 .(.¢€.(.
00002D78: A2 80 0A 28 00 A2 80 3E ¢€.(.¢€>
.
(data)
.
00005B80: F5 F6 F7 F8 F9 FA FF C0 õö÷øùúÿÀ
00005B88: 00 11 08 08 08 0E 40 03 ......@.
00005B90: 01 21 00 02 11 01 03 11 .!......
00005B98: 01 FF DA 00 0C 03 01 00 .ÿÚ.....
00005BA0: 02 11 03 11 00 3F 00 FA .....?.ú
00005BA8: 38 3B B4 A6 6D C5 65 31 8;´¦mÅe1
00005BB0: F9 6F B4 60 11 EF 52 A0 ùo´`.ïR 
00005BB8: 31 2B 49 95 2E 72 85 18 1+I•.r….
.
(data)
.
001617F8: 00 2A E3 A7 6A 7B 14 DF .*ã§j{.ß
00161800: 31 5C ED 41 F8 35 6B 4C 1\íAø5kL
00161808: 0F FF D9 00 00 00 00 00 .ÿÙ.....
00161810: 00 00 00 00 00 00 00 00 ........
.
(all zeros)
.
00161FC0: 00 00 00 00 00 00 00 00 ........
00161FC8: 00 00 00 00 00 00 00 00 ........
00161FD0: 00 00 00 00 00 00 00 00 ........
00161FD8: 00 00 00 00 00 00 00 00 ........
00161FE0: 00 00 00 00 00 00 00 00 ........
00161FE8: 00 00 00 00 00 00 00 00 ........
00161FF0: 00 00 00 00 00 00 00 00 ........
00161FF8: 00 00 00 00 00 00 00 00 ........
00162000: 9E 2B F6 17 E1 B7 FC 12 ž+ö.á·ü.
00162008: 0F E1 86 95 36 87 7B F1 .ᆕ6‡{ñ
00162010: 8F E2 47 8A FE 2C DF F8 âGŠþ,ßø
00162018: 53 29 E1 0D 1B 45 B4 B1 S)á..E´±
00162020: F0 C5 87 85 50 80 18 43 ð҅P€.C
00162028: 6B 62 14 AB 1C 01 BC 38 kb.«..¼8
00162030: 20 00 2B E1 B3 7C 26 61 .+á³|&a
00162038: C4 95 E3 52 52 7C 9D 13 ĕãRR|.
.
(data)
.
002698C0: 5A BD 5C C2 B2 84 55 D3 Z½\²„UÓ
002698C8: D8 FF D9 00 00 00 00 00 ØÿÙ.....
002698D0: 00 00 00 00 00 00 00 00 ........
.
(all zeros)
.
00269FF0: 00 00 00 00 00 00 00 00 ........
00269FF8: 00 00 00 00 00 00 00 00 ........
0026A000: 84 EE 03 07 EE 83 9C 1C „î...
0026A008: 67 3C D5 C3 71 70 E4 ED g<ÕÃqpäí
0026A010: C8 61 D3 AE 16 BD 4A 4A ÈaÓ®.½JJ
0026A018: F2 3C EA B6 E6 E5 2F C7 ò<ê¶æå/Ç
0026A020: 66 D7 2E B2 60 10 C0 64 f×.²`.Àd
0026A028: 2F 1C E4 73 C0 35 78 DB /.äsÀ5xÛ
0026A030: C8 36 C4 55 99 63 03 93 È6ÄU™c.“
0026A038: C1 1F D6 AE A4 92 D5 1C Á.Ö®¤’Õ.
.
(data)
.
0036EE40: B9 D7 65 17 A9 A3 0D F2 ¹×e.©£.ò
0036EE48: 19 32 3E E1 18 DC B9 03 .2>á.ܹ.
0036EE50: FC F5 AE 9E DB 52 85 üõ®žÛR…
(end of file)

Does this make any sense to you? And is there anyway to change anything in the file to make it display more of the file?

My understanding of JPEG format is limited and I haven't delved into the nitty gritty of each block to see what they mean. I can see the creation date & time information and the start and end markers and start of scan and not much more after that!

Just wondering if there is a way to rescue these type of files . . .

F.S.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Corrupted JPEG files after recovery

#4 Post by cgrenier »

Honestly try again PhotoRec with Paranoid set to yes (default value).

felixsark
Posts: 3
Joined: 30 Dec 2013, 01:09

Re: Corrupted JPEG files after recovery

#5 Post by felixsark »

Thank you. I was thinking the same. I'll let you know the outcome.
-FS

Locked