Re: [Sheflug] Lost files from a VFAT disk (Finagle's Law: theProof!)

[James Wallbank <james [at] xxxxxxxxxxx>]

Hello Again All,

I've successfully recovered my lost pictures - but in a very inelegant
way. I used a hex editor to cut and paste from the beginning of each
JPEG (5 bytes before EExif) to just before the beginning of the next
JPEG.

This was tedious, but I recovered 87 of the 90 missing files - not a bad
hit rate, though I do say so myself.

However, I still have the question of a less boring way to recover
files. I was lucky because the camera simply wrote the JPEGs end-to-end,
and didn't fragment them across many disk sectors. Also I was lucky
because the recovered JPEGs still worked despite the fact that they had
arbitrary data tacked on to the end of them (i.e. Noise between the end
of the file and the start of the next JPEG).

Surely there is a handy utility that would have helped me achieve this
(excellent!) result in less than the hour or two it took me. Could I
have automated the cutting and writing out process with 'sed' or 'grep'?

Any tips to prepare me for future data recovery tasks would be most
appreciated. (Yes, I know, back up...)

Thanks,

James
=====

On Wed, 2004-05-19 at 16:47, James Wallbank wrote:
> Hello All,
> 
> Very annoyingly, I've just deleted 32 Megabytes of images from a Compact
> Flash disk. How could this happen? Surely you make backups, James?!
> 
> Yes, indeed. I copied the files from the CF media (using cp -a) and
> saved them safely on the fileserver. Oh - I duplicated the files on my
> laptop local drive, too - can't be too careful!
> 
> Then I removed the files from the CF disk.
> 
> rm -rf /mnt/removable_disk/*
> 
> I took two more photos on the now empty, but un-reformatted disk, then I
> went to look at my lovely pictures.
> 
> Argh! All the pictures were correctly named, but were exactly 4096 bytes
> long, filled with ^@ characters! (is that a null?) My second-generation
> backup was equally uninformative.
> 
> Two questions:
> 
> (1) Any idea how the problem may have occurred in the first place? (I've
> used cp -a over and over again to pull files off a supermounted vfat
> device with no problems.)
> 
> (2) How can I recover the data? I have a complete image of the CF disk:
> 
> dd if=/dev/sda1 of=cf_disk_image bs=0124
> 
> I've tried the following:
> 
> losetup /dev/loop0 cf_disk_image
> for i in seq(0 90); \
> do dosfsck -u /DCIM/100NIKON/DSCN$(printf %04i $i).JPG /dev/loop0; \
> done;
> 
> ...but for each file I get the annoying message:
> 
> "Reclaimed 1 unused cluster (4096 bytes) \ Warning: did not undelete
> file DSCN00NN.JPG \ Leaving file system unchanged."
> 
> Interestingly, if I accidentally spell the path name wrong (my favorite
> is 100NIKO/) then I get the same error message - which leads me to
> believe I may be completely mis-understanding the path name parameter.
> 
> As you'll now realise, the files I am hoping to recover were all in the
> CF Disk inside a directory called DCIM/100NIKON/, and they were named
> DSCN0001.JPG to DSCN0090.JPG. Unfortunately, when I took more pictures,
> a new directory was created by the camera with the same name. I don't
> know whether this makes recovery impossible or harder.
> 
> My one hope is that I misunderstand the syntax for dosfsck. Have you any
> advice? Alternatively, can you suggest another methodology that might
> help?
> 
> Oh, one more thing...
> 
> hexdump -C cf_disk_image | grep -a EExif
> 
> ... gives cause for hope. EExif is part of the start of each JPEG file,
> and exactly 90 of them turn up!
> 
> Thanks in advance for your help.
> 
> James
> =====
> -- 
> James Wallbank
> Access Space - 1 Sidney Street - Sheffield S1 4RG
> T: +44 (0)114 2495522
> F: +44 (0)114 2495533
> W: http://access.lowtech.org
> ___________________________________________________________________
> 
> Sheffield Linux User's Group -
> http://www.sheflug.co.uk/mailfaq.html
> 
>   GNU the choice of a complete generation.
-- 
James Wallbank
Access Space - 1 Sidney Street - Sheffield S1 4RG
T: +44 (0)114 2495522
F: +44 (0)114 2495533
W: http://access.lowtech.org
___________________________________________________________________

Sheffield Linux User's Group -
http://www.sheflug.co.uk/mailfaq.html

  GNU the choice of a complete generation.