Recoverd jpg have smaller size than original jpg

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
purplebox
Posts: 4
Joined: 10 Jun 2015, 22:30

Recoverd jpg have smaller size than original jpg

#1 Post by purplebox »

cgrenier, first I'd like to thank you for this great piece of software, it is about to help me with 2 HDDs from my NAS, which badly crashed.
I am just about to recover jpg from one of the HDDs. PhotoRec found already some hundred of them. The files seem to be ok with regard to the jpg format. A normal viewer like gwenview can open them.
However all of the recovered jpg are smaller than the original jpg - the former are between 50KB and 3MB - the later were around 15MB. I found three types of resolution: The recovered files have 640x480 px or 1920x1080 px or the 6016x4016 px. The original files all had 6016x4016px. And of course, the smaller the files the lesser the quality. Up till now I did not get a single file of full size + resolution + quality.
I could imagine that it was not possible to recover the full chain of file system blocks (ext4). But I would think that this would result in corrupt files.
The documentation says the files should be the same size or bit bigger than the original files. Otherwise they are omitted. But in my case this seems not to be true. Now I wonder if somewhere a recoding of the jpg happens instead of omitting them?
Could you please give me a hint whats going on?
Best regards.

purplebox
Posts: 4
Joined: 10 Jun 2015, 22:30

Re: Recoverd jpg have smaller size than original jpg

#2 Post by purplebox »

Well, yes they have smaller size. I would like to understand why they have. I would expect shortened files or broken files, or even files with a little bigger size due to slack space of the last file system sector. But I am very curious how the files changed size/quality and and some of them even resolution. Any idea welcome.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recoverd jpg have smaller size than original jpg

#3 Post by cgrenier »

I think that your camera stores the picture in 3 resolutions in each JPG file. By default, a jpg viewer only shows the full size.
Let's try something, run PhotoRec, in Options, set Paranoid mode to No, check the recovered files. How are the new recovered files ?

purplebox
Posts: 4
Joined: 10 Jun 2015, 22:30

Re: Recoverd jpg have smaller size than original jpg

#4 Post by purplebox »

I investigated also a bit, and found that there can be a full jpg as thumbnail in the exif part of the jpg. Usually this is much smaller size than the files I have recovered, but its a hint.
Having three different resolutions (one of them original resolution but lower quality) sounds nevertheless strange to me. Especially I did not recover one single full jpg out of 6000. But on the other hand, the full jpgs are big (15MB) and distributed over many sectors, so chance is that they are just gone - as all the RAW images (30MB).
I tried non-paranoid mode and received the same result as with paranoid mode. Interestingly enough I also did not get any broken images. Additionally I tried ddrescue. In fact same results with regard to the resolution/quality issue, but lots of images had corrupted parts. None of the PhotoRec ones had this :)
So the fact that ddrescue has the same properties wrt resolution/quality certainly backs your idea with the
embedded jpgs. Do you know any Linux tool which could show such embedded jpg? I could analyze an Image directly from the cam.

purplebox
Posts: 4
Joined: 10 Jun 2015, 22:30

Re: Recoverd jpg have smaller size than original jpg

#5 Post by purplebox »

[Solved]: I did not find a tool for full analysis of my cam's jpg file so I just had a look at the jpg specification and took a hex editor. Looking for markers FFD8 and FFD9 plus some intuition to patch the jpg header in the exif section(s!!!) I was able to extract three sub-jpgs with different resolution from the full jpg: 1620x1080, 640x424(?) and 160x120.
I am still puzzled that none(!) of the full size images where recovered, not even a single one by accident. But on the other hand they were big and spread over so many sectors which seems to decrease the probability of recovery drastically.
So Christophe's assumption was completely correct. Thanks for the hint.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recoverd jpg have smaller size than original jpg

#6 Post by cgrenier »

Can you send me an original unmodified jpg taken with your camera ? A file with the 3 resolutions inside.
I will check if I can reproduce the problem.

If each time you took a picture a raw file and a jpg file is created, maybe the two files are fragmented. If you want to test this hypothesis, use a small memory card, take picture, run TestDisk, Advanced, Image Creation and send me a link to download the image.dd file.

Locked