Cannot open .jpg fi...
 
Notifications
Clear all

Cannot open .jpg file

9 Posts
5 Users
1 Reactions
2,472 Views
(@p38cyq)
Trusted Member
Joined: 14 years ago
Posts: 44
Topic starter  

Recovered a series of .jpg files, previously deleted from a HDD, where they were in a Dropbox folder. They all are +/- 5 Mb.

However, they can not be opened via normal ways as XnView, Irfanview, or any Windows program (Paint, Photos etc.)

Properties show the file size and the date/time these pictures were stored (12/2016) and modified (11/2016 ?) on the original pc. No EXIF or other data.   

Changed the extension to .avi, .mpg, .pdf etc. to no avail.

Any suggestions on how to open them properly?


   
Quote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

First, how did you recover them?  Indirectly, that's also a question about the reliability of the method or tool you used to not recover deleted files, sectors of which have subsequently been overwritten.

Secondly, how did you verify that the files recovered are correctly formatted .jpg file? To my mind, the failure of the tools you mention to read them suggests that the recovered files may not be completely recovered, or may include non-JPG data.

Third, if your tool does not guarantee to not return false positives (i.e. files that have been overwritten), how do you identify or otherwise cope with situations when it does return such files?

I suspect that you have 'recovered' deleted files based on some assumption by the recovery program, that that assumption was not valid, and the 'recovery' thus, is wholly or partially incorrect. More details about the exact steps you used, and software or other methods you used would help.

 


   
p38cyq reacted
ReplyQuote
(@p38cyq)
Trusted Member
Joined: 14 years ago
Posts: 44
Topic starter  

Thanks @athulin, I will try to give some more info.

It concerns data recovery on a standard 1Tb HDD which was formatted (quick, not full)

The used program is R-Studio (from R-Tools, Disk Recovery Software and Hard Drive Recovery tool for Windows, Mac, and Linux (r-studio.com)

This program works very well and is in use here since several years, has all the updates.

After recovery one can sort the results by root, extension, RAW and so on.

Example : Root -> ...... ->Holidays -> Spain2016 -> IMG_12345.jpg. It is this kind of files, indeed "probably" jpg's that can not be opened although they do contain data (3...5 Mb each) and Windows "recognizes" them as pictures.

Neither can I extract a thumbnail.

Eventually I could find out (with a HEX viewer) the start/stop hexadecimals to check if the files are pictures indeed (markers header/end: FF D8 FF etc.)? 

 

 

 


   
ReplyQuote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 
Posted by: @p38cyq

The used program is R-Studio (from R-Tools, Disk Recovery Software and Hard Drive Recovery tool for Windows, Mac, and Linux (r-studio.com)

This program works very well and is in use here since several years, has all the updates.

After recovery one can sort the results by root, extension, RAW and so on.

Example : Root -> ...... ->Holidays -> Spain2016 -> IMG_12345.jpg. It is this kind of files, indeed "probably" jpg's that can not be opened although they do contain data (3...5 Mb each) and Windows "recognizes" them as pictures.

Neither can I extract a thumbnail.

Eventually I could find out (with a HEX viewer) the start/stop hexadecimals to check if the files are pictures

R-Studio -- Not familiar with it, I'm afraid, so I can't say how that behaves in tricky situations. You may have to refer to R-Studio themselves for that. (I wish there was a test file system to feed to those programs to test how well they really work. That would help a lot in these situations to decide if it may provide false recoveries without any warnings.)

Windows -- Windows will 'identify' anything with the right file extension as an image file, so I doubt that is worth anything.  I don't know of any 'real' JPEG file format verifier, and there seems to be nothing new in that line at jpeg.org, but the identify program, included with ImageMagick sometimes give useful info.

If you are trying to figure out if the data may be any other file format, use Unix/Linux file(1).

This seems as if it may be one of those cases where it may be possible to tease out some extra image information (though not necessary all) if you work really hard, but it usually becomes a question of economy if such an attempt should be made.  I don't know JPEG to that level of detail, unfortunately.  

 


   
ReplyQuote
(@jadams951)
Eminent Member
Joined: 7 years ago
Posts: 37
 

Did you check the header and footer to see if they are that of a .jpg?


   
ReplyQuote
minime2k9
(@minime2k9)
Honorable Member
Joined: 14 years ago
Posts: 481
 

These images may not have actually been synced to the device. This can be common with files in Dropbox/Onedrive folders. It will even display the correct file size but size on disk will be 0bytes.


   
ReplyQuote
(@p38cyq)
Trusted Member
Joined: 14 years ago
Posts: 44
Topic starter  

A HEX-editor does not show ANY recovered .jpg file starting with FF D8 FF.

The same files are also found in non-Dropbox folders and show the same result.

Will try now a jpg recovery program, which replaces the uncorrect markers with the correct ones coming from a good picture from the same camera. 


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

One approach I would try in this situation is to run data carving on the disk drive.  If the files exist, this will find them outside of any file system.  You can then work out recovery fails.  Carving will not produce file names - and it assumes that data is sequential.  Many jpegs of this size will be sequential

If carving does not find ANY files, then a recovery program will not either.

You said you did not find 0xff 0xd8 0xff etc.  Did you find a different string on multiple 'jpeg' files?

Can you recover any different types of file


   
ReplyQuote
(@p38cyq)
Trusted Member
Joined: 14 years ago
Posts: 44
Topic starter  

Tried out a program which replaces the bogus jpg markers by correct ones, based on an original  example from the same camera, and some files were correctly recovered, albeit partially.

Another program promises to do better, as it has all the correct markers (imported) from a variety of camera manufacturers and the "recovered" jpg's are certainly made by different camera's.

Carving is now running since yesterday: 1.2% completed - this is a very time consuming job.

All the multiple 'jpeg' files show different and incorrect headers.

And yes, a series of other files could be recovered correctly (.db, .rar, .odt, .wmv, .mp4 etc., in fact the most common extensions.)  

 


   
ReplyQuote
Share: