I have a problem I want to find a solution to. I know it is clutching at straws, but I want to give it a try.
I am expecting a camera memory chip that is full but the owner is keen to get some previous photos. Obviously an overwritten sector is lost so my only glimmer of hope is to examine the slack space, and possibly a small amount of remaining unallocated space. If lucky I may beable to recover a few hunded fragments of old jpeg photos. The memory stick is 1GB (I haven't actually seen it yet) so I am expecting a cluster size of 16K and an average slack size of 8K. (32K and 16K would obviously be better).
This is small, and we are looking for a single face.
Being part of the same camera, I would hope all photos have the same dimensions but is anyone aware of anyway to view a small fragment of jpeg typcially from the middle of a file? I use Windows rather than linux.
Michael
Well in the end it depends if there's anything there. But I've used Guardian in the past to get old photos off of memory cards and it works rather well. It will also show you fragments of images but unfortunately most of the time you can't even make out what's there.
Tom
Memory cards are an odd sort. I have used DataLifter® and CardRecovery™ with good results.
My problem is not extracting data from the memory chip, it is how to view the fragment as a picture.
How do you know the "fragment" is a picture? In FTK, for example, the viewer shows what it interprets as the picture based on the header and footer. So you can see part of the picture and the remainder dissolves into digital muck. Most viewers can display a picture even if it is corrupt as long as there is a header and footer. I guess I am not understanding the question. ?
Greetings,
I've successfully reconstructed Windows media files by grafting known good headers from other files onto a fragment I knew to be from a corrupted WMA file. You might try a similar approach with data you believe to be part of a JPEG.
I also used ffmpeg and mplayer to work with the result as image viewers and media players that aren't fault tolerant may not handle your reconstructed file very well.
-David
Grafting may work but as digital camera picture can run to a few MB you are not going to get much from 16K of slack.
Your best bet might be to concentrate on looking for the embedded thumbnails within Jpegs (Canon EOS and others - have two embedded thumbnails) but as these are at the start of the jpeg the likelihood is that these are overwritten.
Depending on the value of the case it might be worth removing the memory chip from the device and seeing if you can read the raw data from the chip - this will contain spare sectors swapped out during the normal usage of the chip and you *may* find a thumbnail in on eof these sectors.
I am not expecting the luxury of headers, but will try the suggestion of prefixing with a known good header. Being from a camera, I hope they will be consistant.
I think the option of removing the chip is even less likely to help than just the slack space. I don't know how much gets remapped with a failure, if any, but if just a sector or two, then this is less than an area of slack space. I also do not have the necessary tools.
It is a Sony camera, and I was hoping for thumbnails, but the chances of a thumbnail being in a 15K slack area is limited - and then it has to be the correct 'face'
I will try and report back if anything works