Manual recovery of the unrecognized files

Using PhotoRec to recover lost data
Post Reply
Message
Author
jimklimov
Posts: 1
Joined: 11 May 2015, 22:38

Manual recovery of the unrecognized files

#1 Post by jimklimov » 11 May 2015, 23:10

Hello all, I stumbled upon PhotoRec while repairing my camera's flash card contents - it went south for the second time in five years while moving files off it (gotta stick to copy+verify+delete instead), losing the MBR, FAT and some contents as well.

PhotoRec did a great job recovering from a DD'ed image of the flash card most of my JPG contents perfectly (sans filenames - f1234567.jpg patterns instead... good enough). After a quick pass on default settings that found 360 "f*" files, I set it to churn on a server for a few days in paranoid mode, with minimal 512b sectors since I was uncertain of older format settings, and all data types enabled (ok, that was an overkill - took greater part of the week to complete) and now it found some 368 "f*" files reliably.

After looking through them I found that I expected yet more files to be there unless the card utterly destroyed them (which it could), and that some 52 files in the found set happen to overlap in contents (as in - identical size and content) which might make sense if they were copied around the flash card, but I doubted the camera would do that. Well, maybe that's some artefact of the flash firmware hiccup...

Indeed, PhotoRec found also tons of b1234567.jpg pieces of photos (undersized bits) or "confetti" with shifted blocks of the image, and a hefty 320Mb (of the 2Gb card) as unrecognized data. It also recognized none of the several videos I've made during that filming session. Overall, it found about 1200 Mb worth of files (as a sum of the recup_dir sizes) and this chunk, which is 500Mb short of the flash-card size. But maybe the zero-blocks were skipped...

Those shifted-block "confettis" make me uneasy because it seems that many of those images are attempts to recombine the jigsaw puzzle of the same blocks used already in the successfuly recovered image. Or it may mean that the card returned same data on many logical offsets, while it was dd'ed over to recovery box.

So, after so much preamble, a couple of questions:

1) what is the suggested way to try and dig out some data from the "unrecognized" pile?

2) any ideas why PhotoRec found no videos? Maybe my recovery system misses some libraries (likely does - it's not desktop-oriented, and I had to install quite a few packages just to get PhotoRec compiled)?

3) is there (planned?) an interactive graphical mode to try and manually recombine the yet-unassigned sectors to some files (so one can visually see in real time whether the selected and ordered puzzle-like bits of JPEG-represented data fit together to form the same image in proper order) so that I can on one hand be more certain that everything possible was recovered, and on the other hand some of those "b*" scraps are put to good use to revive a few more actual files correctly?

Thanks in advance, and thanks a lot for the already reat piece of work,
Jim Klimov

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3555
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Manual recovery of the unrecognized files

#2 Post by cgrenier » 17 May 2015, 18:17

Do you have an unmodified short video taken with your camera ? Please send me (grenier@cgsecurity.org) a link to download it. I will try to find why PhotoRec hasn't been able to recover your videos.

b* files are broken files, they are only saved if you enable the option "Keep Corrupted Files".
Unfortunately there is no reliable way to patch together raw blocks of jpeg data, sometimes the bruteforce mode will merge blocks from different pictures, the resulting file will be a valid jpeg but only a human can say if the photo is ok or not. It's something that may be added to qphotorec in the futur.

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest