Hello,
I'm trying to recover from a CF card a photo that has been deleted and PARTIALLY OVERWRITTEN.
I've just run photorec, that's what I can see in the report.xml:
<fileobject>
<filename>f0999659.jpg</filename>
<filesize>2002259</filesize>
<byte_runs><byte_run offset="0" img_offset="511857664" len="2015232"/></byte_runs>
</fileobject>
<fileobject>
<filename>f1010219.ctg</filename>
<filesize>16384</filesize>
<byte_runs><byte_run offset="0" img_offset="517264384" len="16384"/></byte_runs>
</fileobject><fileobject>
511857664 + 2015232 = 513872896
Remembering the exact time in which my photo has been taken, I'm pretty sure that fragments of that file can be found from 513872896 and 517264384. Without header, of course (file has been partially overwritten).
Is there any way to have a raw copy of that data?
Thanks a lot.
Fragments recovery (raw disk copy)
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5436
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Fragments recovery (raw disk copy)
In Options, enable the expert mode, enable keep corrupted copy, start a recovery, use a blocksize of 512 when asked, use the default options otherwise. Do you recover your pictures or picture fragments this way ?