[H-GEN] file recovery tools

[Greg Black]

On 2003-12-29, Peter Arnold wrote:

> Anyway, more googling tells me recovery is a *simple* process of:
> 1. get an image of your CF card
> 2. snuffle through the image and find jpeg start and end markers
> 3. save them to file
> 
> OK, I've achieved 1 by using a compact flash card reader and dd(ing) to a 
> file ala dd if=/dev/sda1 of=cflash.image.
> 
> 2 and 3 are posing a problem. What do you use to "snuffle" through a image 
> file and subsequently save chunks with?
> 
> Where can I find what start and end markers are for jpeg, would that be in 
> /etc/file?

A few seconds with google reveals some FAQs at

    http://www.faqs.org/faqs/jpeg-faq/

Starting there, you should be able to answer (3) pretty easily.

As for (2), it depends.  If the image you have represents files
stored sequentially, the task is simple; if the Cf card stores
files like disks do and if you've added/deleted files, it could
be impossible unless you know how to decode the file storage
format -- I've never studied CF cards, so I don't know about
this.

Assuming that it is a simple sequential file, a simple bit of C
or Perl or Python will do the trick.  If the data is stored in
random blocks and you need to decode a directory, you'll have
quite a bit of work.

It's not hard work, just tedious.

Cheers, Greg