Re: [SLUG] Recovering photos from an XD card

[James Sadler <freshtonic@xxxxxxxxx>]

2009/4/13 Peter Chubb <peterc@xxxxxxxxxxxxxxxxxx>:
>>>>>> "James" == James Sadler <freshtonic@xxxxxxxxx> writes:
>
> James> Hi all, I stupidly removed an XD card from my card reader under
> James> Linux without unmounting it first.  When I put the card back in
> James> the machine, most of the pictures were missing.  I'm guessing
> James> the filesystem is corrupt.  In theory the photos themselves are
> James> still there.  Does anyone know how I could restore these under
> James> linux?  I am running Ubuntu Jaunty.
>
> Hmmm.  Were you copying files *to* the card? If so they may never have
> got there (they'll still have been in Linux's filesystem cache).

I was trying to read the card in my card reader - the images were
already (supposedly) on the card.

> If you know the filenames fsck.vfat can recover the files.

I managed to get the list of filenames via the strings command,
however it seemed like there was a deep level of corruption as
fsck.vfat could not recover the files.

I downloaded the open source tool 'testdisk' and it was unable to find
any deleted files.  Same problem with photorec[overy].  IMHO, this is
because they are relying on the filesystem keeping entries for deleted
files/directories in the file system metadata.  I never deleted any
files, so that metadata would not be there.  I really do think that
removal of the xD card from my machine while it was being read somehow
corrupted it and destroyed part of the allocation tables.

I knew that the JPG file contents should in theory be on the disk
somewhere, so I used dd to make a backup and ran the dump through a
tool called 'foremost' (downloaded from Sourceforge).

Foremost can scan arbitrary streams of bytes looking for files of
certain file types embedded in the stream using heuristics.  It
scanned through my 2GB xD card dd dump, and successfully recovered all
of my images.  Highly recommended!


-- 
James