SLUG Mailing List Archives
Re: [SLUG] Recovering photos from an XD card
- To: Peter Chubb <peterc@xxxxxxxxxxxxxxxxxx>
- Subject: Re: [SLUG] Recovering photos from an XD card
- From: James Sadler <freshtonic@xxxxxxxxx>
- Date: Sun, 19 Apr 2009 21:07:50 +1000
- Cc: slug@xxxxxxxxxxx
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=PfpUpckjfH7yQszvCTbiRNcYdfYbf7cLkuk0VMX/bqk=; b=HnM50pfRBH3qu6r7aR/1HDuFGCBMiRjHUVZ4Q0kAR2iqlEAaV12hNF4ABTJL3xLcb0 9xOYisPyIMiXzbsYaUzUsP97lXOyxRuBh7Eo+MdRQkWuWplagppT4HcSisJa9jPScWGT HimkKKqOlxEfWhKLVhUBvHY67OaqbW9GBY6eQ=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=QHKxdgDUYGN5Hlql+gMZLdj3MU+U4jcMEbUm8VIHhseYy2D3bPDHarYJan8KRNv7El BUj19dBiBVGZsNx/TacQGJZ8hjUgzNCGh9yOhbWZcMiwPUupB1M3qOpcpMuX/3mwXWAC h0FAsPgnGn5Gjuiam8D2tZ660TOYFpuVC0M40=
2009/4/13 Peter Chubb <peterc@xxxxxxxxxxxxxxxxxx>:
>>>>>> "James" == James Sadler <freshtonic@xxxxxxxxx> writes:
> James> Hi all, I stupidly removed an XD card from my card reader under
> James> Linux without unmounting it first. When I put the card back in
> James> the machine, most of the pictures were missing. I'm guessing
> James> the filesystem is corrupt. In theory the photos themselves are
> James> still there. Does anyone know how I could restore these under
> James> linux? I am running Ubuntu Jaunty.
> Hmmm. Were you copying files *to* the card? If so they may never have
> got there (they'll still have been in Linux's filesystem cache).
I was trying to read the card in my card reader - the images were
already (supposedly) on the card.
> If you know the filenames fsck.vfat can recover the files.
I managed to get the list of filenames via the strings command,
however it seemed like there was a deep level of corruption as
fsck.vfat could not recover the files.
I downloaded the open source tool 'testdisk' and it was unable to find
any deleted files. Same problem with photorec[overy]. IMHO, this is
because they are relying on the filesystem keeping entries for deleted
files/directories in the file system metadata. I never deleted any
files, so that metadata would not be there. I really do think that
removal of the xD card from my machine while it was being read somehow
corrupted it and destroyed part of the allocation tables.
I knew that the JPG file contents should in theory be on the disk
somewhere, so I used dd to make a backup and ran the dump through a
tool called 'foremost' (downloaded from Sourceforge).
Foremost can scan arbitrary streams of bytes looking for files of
certain file types embedded in the stream using heuristics. It
scanned through my 2GB xD card dd dump, and successfully recovered all
of my images. Highly recommended!