[TAG] Photo recovery from a formatted flash memory card

[Neil Youngman]

Recently I've needed to recover photos from 2 compact flash cards, one of 
which was accidentally formatted and one of which was faulty. Subsequently I 
have used the "expertise" acquired to recover photos from a formatted SD card 
as a favour to a random stranger on the internet.

The first thing I did was backup the card, using a simple dd if=/dev/sdX1 
of=/path/to/data

The first time I did this, I was in a hurry. I had seen a lot of 
recommendations for a Windows tool called Recuva and I didn't want to spend 
much time on research, so I just grabbed a copy of that. It seemed to work 
just fine "recovering" 1045 files, but on closer inspection, none of them 
were complete. They should have been 3-5 MB jpegs, but they were all about 
1.5MB and only the thumbnails were viewable. I messed about with the 
settings, to no effect and looked at a couple of other Windows tools, before 
I saw a recommendation for photorec, which is part of Christophe Grenier's 
testdisk suite. http://www.cgsecurity.org/wiki/PhotoRec

Photorec looked like a Unix native tool, so I downloaded the appropriate 
tarball, unpacked it and ran it. It took the file name of my backup as an 
argument, so I didn't even need to have the card handy. I walked  through a 
few simple menu options and it recovered just over 1000 photos. This time 
they all appeared to complete, full resolution photos. As far as I could tell 
there was nothing missing.

Reading through the instructions, I found that there was probably junk data at 
the end of the photos, which could be removed by running convert (from the 
ImageMagick suite) on the jpeg.

The sequence of commands below is how I recovered the photos from the SD card.

$ dd if=/dev/sdd1 of=/tmp/sdcard.bin
$  ~/testdisk-6.11.3/linux/photorec_static /tmp/sdcard.bin 
$ mkdir /tmp/recovered
$ for file in /tmp/recup_dir.1/*.jpg; do 
convert "$file" "/tmp/recovered/$(basename $file)"; done

The first command is just a binary copy of the raw data from the SD card to a 
file.

The next command obviously runs photorec itself. In the menus, just accepting 
the defaults is usually sufficient, but you have to select a directory in 
which to store the results. Photorec actually creates subdirectories under 
that directory, called recup_dir.N. In this case I selected /tmp/ to store 
the recovered photos in.

Having recovered the photos, I created the directory /tmp/recovered and ran a 
loop, calling convert on the files, as explained above. That directory, 
containing the final results was then burned to a CD, which was sent to the 
owner of the photos. 

As you can see photorec is a very simple tool to use and as far as I could, it 
recovered all the files that we expected to find on the various flash cards. 
I would recommend it to anyone who has a need to recover photos from a 
corrupt, defective or formatted flash card.

Neil Youngman