[H-GEN] file recovery tools

[Peter Arnold]

Peter Arnold wrote:
> [ Humbug *General* list - semi-serious discussions about Humbug and     ]
> [ Unix-related topics. Posts from non-subscribed addresses will vanish. ]
> 
> Hello all,
> I need some assistance recovering files from a corrupt compact flash card.
> 
> A little back ground: I have a compact flash card in my newly acquired 
> digital camera aand after taking lots of photos over several days I 
> found the camera saying "Memory card error", "Unidentified Image" and 
> "Corrupt data". Now after some googling I believe this sort of problem 
> occurs if you turn the camera off before it has finished saving to the 
> card. Being a digital camera newbie this is quite likely what I have 
> done... so as a warning to others... give your camera some time after 
> taking a photo before turning it off.
> 
> Anyway, more googling tells me recovery is a *simple* process of:
> 1. get an image of your CF card
> 2. snuffle through the image and find jpeg start and end markers
> 3. save them to file
> 
> OK, I've achieved 1 by using a compact flash card reader and dd(ing) to 
> a file ala dd if=/dev/sda1 of=cflash.image.
> 
> 2 and 3 are posing a problem. What do you use to "snuffle" through a 
> image file and subsequently save chunks with?
> 
> Where can I find what start and end markers are for jpeg, would that be 
> in /etc/file?
> 
> Thanks
> 

For those interested I've had a *reasonably* successful recovery of most of the files. I'm sure I could have done this better somehow and I'd be interested in poeples comments on how they'd do some of the steps but for now I've managed.

Basicly the steps are as follows

I placed the compact flash card in a CF reader and attached it to my linux laptop
>From there I could dd the contents of the CF card using "dd if=/dev/sda1 of=cflash.image"
I used ghex to look through the file and a known working jpeg to confirm start and end hex strings as FFD8 and FFD9 repectively
	Actually the Canon files seem to start with FFD8FFE1 which was a better start string to search for as FFD8 was also in the content. Also, 5 chars from the begining of a file was ascii "Exif"
I used "strings -t d" to find the position in decimal of every "Exif" in the dd'd file.
	I'm not entirely sure why but some the returned figures were off by a few chars. I confirmed pos using ghex and fixed as req.
I then wrote a script that:
	read in the Exif position from the strings output
	used "bc" to subtract the offset of 5 chars which gave me the beginning of the jpeg
	used bc to calculate the number of 1 char blocks to the next jpeg start
	used dd to read the file from start of each jpeg to start of next jpeg and output to a file

Two recomended windows programs seggested in NG's BSODed XP trying to read the CF card in a CF reader. Linux had trouble reading the card but at least it could do a dd. One was photorescue v2.0, the other one's name eludes me right now.

The whole thing was rather time consuming but once the script was running I could just leave it do it's thing for an hour or so. Greg was right, it wasn't hard, just tedious.

CF cards on canon store as Fat 16. I'm not sure if that is peculiar to canon or standard.

Some of the files restored were actually deleted by me on the camera and some of these were partially overwritten. I'm not sure how this sits with the sequential saving of files but I know I didn't delete any after a known OK state and the subsequent addition/corruption of files.

I'm not sure why turning off the camera before it had finished saving corrupted other files that *were* ok. Comments?

Thanks
Peter Arnold





-- 
Peter Arnold
+-----------------------------------+-----------------+
| mailto:arnoldpj at optushome.com.au  | To err is human |
| Brisbane, Qld, Australia          | To moo bovine.  |
+-----------------------------------+-----------------+