Photo information recovery, JPG harm recovery case summary: storage medium: 4GSD card Canon digital camera
Fault description: A buddy introduced that the pictures are displayed generally around the camera, all photos could be previewed, but immediately after copying for the pc, some photos cannot be opened, as shown in Figure 1:
Figure 1. A picture named IMG_0683.JPG using a size of 3965K cannot be opened
So my mates copied back each of the images they copied, hoping to be in a position to reopen them. The consequences could be imagined, which additional expanded the damage on the photographs.
Recovery application: WinHex, FinalData
Recovery concept: Since the damaged picture is significant, the initial judgment is that the file header is damaged, along with the file header could be repaired manually.
Recovery process: Take the picture IMG_0683.JPG as an example to briefly describe the recovery approach.
1st, use Winhex as a disk image to prevent additional harm for the data.
Copy the broken files to the nearby, a total of 58 (normal files have already been cut to the neighborhood by good friends), as shown in Figure 2:
Figure two.58 damaged photos
Open IMG_0683.JPG with Winhex, as shown in Figure 3
Figure three. Winhex opens IMG_0683.JPG
When I opened it, I was shocked. Practically 1M on the information in the front are practically regular numbers. Definitely it has been tampered with. Recovery will not be as very simple as altering the header in the file as anticipated. I've tried N instances to copy the fantastic JPG file header for the broken file with various lengths, but no outcomes.
When I was practically desperate, I thought of FinalData, so I made use of FinalData to restore all of the files on the disk, and I identified some thing new!
By comparing recover data from deleted partition broken files within the recovered images, it was discovered that there are 12 offered files! So far, 12 images happen to be effectively recovered, and 46 images stay to become recovered.
The subsequent step may be the genuine recovery!
A .JPG folder appears under DeletedFiles, that are all the similar size. The .JPG file is named soon after the sector quantity exactly where it can be situated, as shown in Figure four:
Figure four. 355 1036K JPG files restored with FinalData
Carefully, I compared the damaged file with the file attributes below .JPG and identified that the size of your two photographs is equal to 4000X3000, and also the modification date of the photo in Figure 2 is actually 20. And there is a preview, but it can only be opened halfway, for example: IMG_0683.JPG in Figure 2 will be the same as # 69655.JPG in Figure 4.
Figure five. Image # 69655.JPG can only be opened halfway
So I boldly guessed: The 20 pictures with all the exact same date in Figure four are probably copied in the original image, plus the original picture is randomly filled with garbled characters. Would not it be excellent to overwrite the first half of IMG_0683.JPG together with the data of # 69655.JPG? Just do it, use Winhex to open # 69655.JPG and IMG_0683.JPG, as shown in Figure six:
Figure 6. Open with Winhex # 69655.JPG
Copy the hexadecimal data in # 69655.JPG, write (not paste) to IMG_0683.JPG, and save it. Then http://download.cnet.com IMG_0683.JPG as shown in Figure 7 below:
Figure 7. The recovered IMG_0683.JPG
Restored successfully!
Use this technique to restore one more 19 photographs.
A total of 32 photos have been recovered in the 58 photos so far, plus the rest cannot be restored for the reason that the data is overwritten.
Recovery practical experience: data loss isn't terrible, don't create back data, within this case, if buddies don't copy the damaged information for the card, maybe they will all be recovered
From: http://hi.baidu.com/xieyanjiang/blog/item/b7f94b63eea07b6e0d33fae6.html