Re: photo memory card file recovery

On Mon, 18 Dec 2006 17:14:01 -0800, ericchang wrote:

Hi. I have an SD memory card which contains about 200 photos.
Suddenly, it became inaccessible. The photo directory now shows up as
a .jpg file with nothing in it.

This is the kind of problem that seems to be easy to solve on a Windows
box. Someone downloaded a trial version of a memory card recovery
system, and it shows all the pictures that it can recover. Paying the
licensing fee will allow those files to be saved to disk, otherwise,
they just can be viewed through the demo program.

I would like to find a Linux program, preferably a free one, which will
do this. My desktop machine only boots Linux (Redhat 7.3 or FC4, no
DOS or Windows). Yahoo and Google are not very good at finding such
programs for Linux, since many of the Windows file recovery program
vendors "seed" their www pages with the keyword "Linux". It must be
invisible on the screen, since it is difficult to find the keyword
"Linux" on any of their pages.

So far, here are the links that the search engines have found (that are
not fake):

1) PhotoRec by cgsecurity
2) flash memory card wikipedia listing the Heuristic method, which
points to some simple C code (which by the way does not compile on
FC4).
3) foremost.sourceforge.net, which is a government sponsored forensic
program

1) looks good, but it doesn't work. The program runs for quite a
while, and does not find any valid headers or any jpg files. They
obviously are there. The Windows program shows them on the screen; it
just does not save them.

2) looks easy to try. It can be compiled with some tweaking. It runs
for a long time and produces one huge jpeg file which is invalid.

3) compiles just fine, and throws the machine into a dead loop. dead
loops are fatal to Linux and the system becomes unresponsive. The
system must be shut down or reset, possibly causing further damage to
the flash card. There is probably a subtle memory leak in the program.
The code is non-trivial, and, for example, uses a Boyer-Moore string
search, which requires memory allocation. Simple O(N*M) search
algorithms would be a lot safer, and, although they run much more
slowly, they are not the bottleneck. Memory card filesystems are far
slower, if the CPU is any decent pentium class.

There is a clue why 1) and 2) do not work. They both expect the jpeg
header (0xff 0xd8 0xff 0xe1 for Exif files) to be at 512 byte
boundaries for FAT type filesystems. In the disk image that I am
working with, this assumption is not valid. Rewriting 2) to do a
position insensitive search for the jpeg header shows at least 100 jpeg
headers. Unfortunately, the resulting saved files are not valid files,
due to unrecognized markers or bogus Huffman tables. Random sampling
shows a couple of interesting facts. First, the distribution of
offsets from 512 byte boundaries are effectively random, and second,
about 90% of the headers that are identified are correct (in other
words, they also contain the keywords "Exif" and "Canon Powershot" in
the header.

Is there something that I am missing? Could there be some funny twist
to the filesystem that is causing the headers to appear at random
locations? How does the commercial software handle this (it seems to
find valid data, when the Linux offerings cannot)? Is there a better
program for doing photo card recovery for Linux?

Thanks,
Eric

FWIW - I have recovered linux partitions from failing hard drives by using
dd to copy the partition to a file. At this point you can fsck the file
and loop mount to recover data. I'm assuming this is probably fat32, so
probably won't apply.

.

Relevant Pages
Loading