Re: digital forensics - recovering images from a memory card with trashed file system

On Wed, 29 Oct 2008 00:07:44 +0100
Emanoil Kotsev <deloptes@xxxxxxxxx> wrote:

thveillon.debian wrote:

Micha a écrit :
After my camera died on a recent trip I bought a new one (nikon s52 if it
helps). Due to some bug and bad timing on button presses the camera
trashed the file system somehow. Based on the number of images it can
write to disk it seems that the images are still there, but what I see
under the directory is some directories with trashed file names that
can't be used and some files with a size of 1TB that are junk (on a 2GB
card).

I'm looking for a way to rescue the images (jpegs) if possible. I tried
rstudio under windows but it only found some AVIs but not the images (at
least using the basic settings).

Are there any programs (linux, windows or mac) that may be able to
recover the images, or any other way to do it?

It was a new (and formated) card so that there is a chance that the
images written in some order but I don't know enough about this hardware.

The card is a 2GB transcend secure digital (sd)

thanks


Hi,

with Linux I guess Tesdisk and Photorec are your best bet, photorec did
a great job for me once. With windows and Mac I guess products from
diskinternals.com and prosofteng.com can do a similar job through a nice
gui, but they don't come for cheap.
If you want win/mac freeware just have a look on softpedia.com.

Tom



why don't try a card reader


I tried 3. I wouldn't be able to access the card at all without one ...
Like I said, it's not the card that's the problem it's the file system that is
ruined, and even that partially, it's the file inodes (or whatever they are
called under fat) or directory entries that were junked. I'm guessing that due
to some concurrent read/write without a mutex or something like that.


regards




--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx
with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx