Ian (lovingboth) wrote,


L is back from New Zealand. She took about a thousand photos while there... and managed to accidentally delete one day's of them - could I get them back?

Yes, almost certainly. There was plenty of unused space on the memory card (about 24/32GB) and it's FAT32 format so the data probably hadn't been overwritten, and a variety of programs exist to find deleted pictures in particular.

So I make a copy of the memory card using dd, then unleash recoverjpeg on the image file.

Hmm, that's a bit annoying, it's not looking at the directory info at all, and is 'recovering' files that aren't lost: it's found 1002 of them, but 976 were happily undeleted in the directory already.

It saves the files as image00001.jpg etc - in a directory rather than in the image file / partition you're searching, obviously! - and 'obviously' they have the timestamp of their recovery rather than the original one (which can often be extracted from the FAT32 directory, it's that inefficient at deleting stuff). So how to tell which are the 'new' 26 ones among the 1002?

Well, amongst jhead's options is one to set the file's timestamp to be equal to the one in the jpeg's EXIF data... i.e. the time it was taken. Then you just need to copy the 976 files, do the same with them - just in case the timestamp isn't exactly equal to the time the photo was taken - and get rid of one of any two files that have the same timestamp. Easy!

Before I do that, let's use a file manager and sort by date modified... Oh, that's interesting. These first two have the same timestamp, but the never-deleted file is 4.5MB in size and the recovered one is 2.7MB. Has something gone missing?

I look at them both in a photo viewer and, no, they look identical to me. Oh, and that sort of thing is repeated throughout the list of files. Hmm. The very useful JPEGsnoop runs under WINE and that can't spot any difference... except that the never-deleted file has 1,837,477 bytes of data after its normal 'end of file'!

And, looking at the files with a hex viewer, it does: an awful lot of it is $FF bytes, along with a significant number with one or bits set to zero (so things like $DF or $77 or $FB etc) scattered through this long section, then there's another block of EXIF data.

I haven't looked at that properly yet, but I wonder what's is going on. That's a lot of data to tag onto the end - it's about enough to have one byte per pixel, for example. Is it storing the difference between the jpeg and the RAW data somehow?

The camera in question is a Maginon SZ 350 - L needed a camera in a hurry, having failed to replace the Sony one she had that broke or my spare compact that she lost, and this one was on 'reduced still further' offer at Aldi. As well as having a good optical zoom, it also had a three year warranty, with a sensible 'money back if not happy within n days' policy, so it seemed her worth getting.

What I haven't done is install their Windows-only software and see what it can do...

This entry was originally posted at http://lovingboth.dreamwidth.org/541370.html, because despite having a permanent account, I have had enough of LJ's current owners trying to be evil. Please comment there using OpenID - comment count unavailable have and if you have an LJ account, you can use it for your OpenID account. Or just join Dreamwidth! It only took a couple of minutes to copy all my entries here to there.

  • Post a new comment


    Anonymous comments are disabled in this journal

    default userpic

    Your reply will be screened