Recovering lost photos

Q I think my camera might have crashed and rebooted when I was trying to delete a photo. I can view the photos on the screen on the camera, but when I try to download I get I/O errors for some of them. I can copy an image off the card using:

dd if=/dev/sdc of=this-is-annoying.img

When I use this image to recreate the files on a partition on a hard drive I get the same I/O errors, so I figure that the files are still there and can be read but something is preventing them from being recognised properly when I try to open them.

A You did the right thing in creating an image of the card rather than trying to recover from it directly. When a filesystem is damaged like this, the worst thing you can do is write to it in any way. With some filesystems, even reading a file updates its metadata, causing a write. What about a solution? TestDisk is a useful suite that includes a program called PhotoRec, which can recover all sorts of lost files from many types of filesystems. TestDisk is available from www.cgsecurity.org/wiki/TestDisk, but check your distro's package manager first. When it's installed, run photorec from a root terminal.

If run with no arguments, it will search for any partitions containing filesystems it recognises and asks you to select one to scan. You've made a copy of the disks data with dd, so you can use this instead, although it's wise to keep a spare, untouched copy of this file. Your recovery attempts could affect the copy you work with and your memory card may be in too fragile a state to generate another. Start photorec with

photorec this-is-annoying.img

When asked for the partition type, select Intel/PC if you copied the whole disk (sdc) with dd or None if you copied only the filesystem (sdc1). This is the type of partition table, not the contents of the partitions on the disk, so anything usable on a PC is likely to be Intel/PC. The main exception to this is something that has no partitions, as opposed to a single partition filling the whole device, such as a floppy disk. You've copied the whole disk, so you'll have two options on the next screen: one for the partition (assuming it has a single partition) and one for the whole disk. Try the partition first; if this doesn't recover all your files, run PhotoRec over the whole disk. PhotoRec can generate a lot of files with meaningless names, so save its output in a separate directory when asked.

PhotoRec can take a while to scan the image file and even longer when run directly on a memory card, so leave it alone for a while. Then you'll find your recovery directory full of strangely named files. The file allocation table was messed up, so the names of the files are gone, but this isn't a big deal with digital camera files, because their names aren't that useful to start with and you'll still have the Exif data. You'll also find old files here, because deleting a file removes it from the index but leaves its contents on the disk and possibly quite a few duplicates.

Follow us on Identi.ca or Twitter

Username:   Password:
Create Account | About TuxRadar