Ethan Miller

Unless otherwise noted, all work licensed under : Creative Commons License

Lost Images Recovered

Feb 25 2009, 2:13PM

This lifehacker post about a DiskDigger reminded me that I wanted to document a recent close call with a bunch of photos we took on vacation.

I was running Ubuntu with xfce, and when the SD card on our camera filled up, I wanted to transfer the photos off. Well it turns out that thunar (at least my version) doesn't show a progress bar when copying files. I foolishly erased the SD card before the transfer had finished and, uh, I did it with $ rm *.JPG :(

This tip on how to Recover from rm got me thinking on the right track (I guess). I ran 

$ cat /dev/mmcblk0/ > recover.db

resulting in a 2GB file (it was a 2GB SD card) that I spent the next day and a half tinkering with.

I had some of the images from that card on hand, and using the octal dump command: 

$ od -x IMG_4415.JPG | head

I could tell that the beginning of each image looked like this (in hexadecimal): d8ff e1ff fe35 7845 6669 0000 4949 002a

I messed around with csplit for a while, but I had no idea how to split on non-ascii patterns.

Eventually I found a perl script written by someone who had a similar problem. I can't seem to find that page again, although I know I hit this metafilter thread along the way. The script I ended up with was:


# d8ff e1ff fe35 7845 6669 0000 4949 002a
$sep = "\xff\xd8\xff\xe1";
print "opening\n";
open(F, "recover.db");
@original = <F>;
close(F);
print "opened\n";
$x = join "", @original;
print "splitting\n";
@new = split $sep, $x;
print "splitted\n";
$count = 1;

foreach(@new){
        print "$count\n";
        open(F, "> recovered$count.jpg");
        print F $sep;
        print F $_;
        close(F);
        $count++;
}
I got all the photos back! My route may have been circuitous, but it was an interesting ride. If you know of a more direct route please let me know...

Tags : code hack linux memory


blog comments powered by Disqus