I have a case where I believe that there are several deleted .cr2 Canon Raw Images on it. This is a 1TB HD NTFS formatted drive. The headers all appear to be consistent on the samples I've pulled from another device, but the footers seem to be very inconsistent.
Any direction on a possible enscript, or grep search that might be helpful would be most appreciated.
Thanks in advance for any and all information.
CR2 files tend to be fairly large and so may be fragmented.
In carving, I think it is best to just concentrate on the header, and stop carving when another header is found.
For an NTFS drive, it should be possible to recover the file making use of any fragmentation
Again, for NTFS, make sure the area of the original file has not been overwritten by another file.
To view the files on Windows 7 there now a windows codec so that they can be viewed by normal Windows programs
Thanks for your reply Michael. I'm testing some of those suggestions as we speak.