Canon cr2 Raw Image...
 
Notifications
Clear all

Canon cr2 Raw Image carver

olifer
(@olifer)
Member

I have a case where I believe that there are several deleted .cr2 Canon Raw Images on it. This is a 1TB HD NTFS formatted drive. The headers all appear to be consistent on the samples I've pulled from another device, but the footers seem to be very inconsistent.

Any direction on a possible enscript, or grep search that might be helpful would be most appreciated.

Thanks in advance for any and all information.

Quote
Topic starter Posted : 13/09/2012 8:50 pm
mscotgrove
(@mscotgrove)
Senior Member

CR2 files tend to be fairly large and so may be fragmented.

In carving, I think it is best to just concentrate on the header, and stop carving when another header is found.

For an NTFS drive, it should be possible to recover the file making use of any fragmentation

Again, for NTFS, make sure the area of the original file has not been overwritten by another file.

To view the files on Windows 7 there now a windows codec so that they can be viewed by normal Windows programs

ReplyQuote
Posted : 13/09/2012 9:58 pm
olifer
(@olifer)
Member

Thanks for your reply Michael. I'm testing some of those suggestions as we speak.

ReplyQuote
Topic starter Posted : 13/09/2012 10:10 pm
Share:
Share to...