Recovering Lost Photos From A Flash Card

Twice now, I’ve helped friends recover lost photos from flash cards. Bothfriends are technical people who generally know what they’re doing … butthey both got bitten by bugs in commercial software that left them withouttheir photos for one reason or another.

The loss of photos is a very upsetting event to a photographer. Fortunately,if you stop using the card the instant you discover the problem, more thanlikely, your photos can be recovered. If you never use the on-camera delete toremove anything but the most recently taken photo(s), you’re in even bettershape, since no fragmentation will have happened!

So how do you recover photos when there’s NO filesystem information left?Turns out its pretty easy for some file formats and tools that ignore trailingjunk in files. The approach is simple: snapshot the raw card contents and thenlook for the start-of-file signature for your specific type of photo files—but most importantly, look for it aligned at the start of 512-byte boundaries—the typical “block” size.

To determine your file’s start signature, you’ll need a few sample files fromyour camera. If you have a Canon Rebel XTi and shoot in mode, you’ll begetting files. These files have a nice long signature at the start, makingdetection and recovery a breeze.

To determine if there’s a good unique signature, you can do something like this:

If there were 6 files in the directory, and you only get 2 lines of output,you’ve found yourself a reliable 16-byte signature. More than enough to detectthe start of files in most cases, especially when aligned to the start of a512-byte block.

The above signature is what’s needed for a file.

To obtain the necessary image of the flash card (I don’t recommend everworking directly on the flash card when doing recovery—so we read it onceand save it for future processing).

So how do you grab the contents of the flash for safe processing? Under Linux,FreeBSD and (and other unix platforms), you use dd. We do this because wedon’t want any extra headers… just the raw bytes. This ensures the diskremains aligned at 512-byte boundaries. Some disk image containers mighthappen to keep things aligned to the block boundaries. I’ve never checked.

The specific instructions for are as follows:

1. Using a card reader, mount the flash card (like usual: just insert it)
2. Start Terminal.app and run df to find the device name of the newly mounted flash card. We’re specifically interested in the /dev/diskNsN device name, since we’re going to need to directly access it. Here’s an example:
3. Next, we need to unmount the disk without causing the device to be removed. We can either use unmount /dev/disk4s1 or go to Disk Utility, select the right volume, then use the “Unmount” toolbar icon to unmount it without ejecting it.
4. Finally, we create the image we’re going to work with using dd. Depending on the size, speed of the card, your card reader, and interface, this could take a long time. If you need to know how far it’s gotten, open a new Terminal window and run “du -h

   Once the copy of the image has been made, we’ll want to run a quick recovery script. This script relies on the fact that Canon Raw conversion utilities tend to ignore trailing junk. If yours don’t, grab (available via Ports”) and convert the files to a format you can use (like ).

   Here’s the recovery script I hacked together to recover missing files for my friend:

   The end result should be a whole bunch of .CR2 files named from found0001.CR2 through the final number.

   PS – The above should work for files, but headers aren’t asbig/consistent. The above technique has been proven to work for a Pentax *istwith a fully erase card (unerase couldn’t be performed) before any files werewritten and a Canon Rebel XTi where 1/2 the card had been filled back up withnew photos. Some files might be corrupt due to fragmentation. Basically, whatI’m saying is: the only two cameras I know of so far that write their files ina sane manner without fragmentation (unless holes are created by erasing fileson the camera) are the above two cameras.