Free Picture Recovery

Fien hit by accident “remove all” on our canon. I was able to recover all the pictures without buying some (expensive) recovery tool. Here is how you recover Jpeg pictures from a deleted drive.

If you have a canon, save yourself three hours of work and use a card reader instead of connecting your digital to your computer. Then, make a dump of the entire disk. (My SD card is 1Gb, so the count x block size should be 1Gb). Do not use the mounted directory, but use the /dev/… directly. Do not use a Mac (as dd seems to act differently)

dd if=/dev/sdc1 of=canon.file count=1005696 bs=1024

Now you have all the raw bits in one file. The following script dumps picture by picture in a new file:


#!/bin/bash
prev_position=0
for i in `hexdump canon.file |grep " d8ff e1ff" | sed -u "s/ d8ff e1ff.*//"`
do
  j=$(echo $i | tr '[a-z]' '[A-Z]')
  position=$(echo 'ibase=16;obase=A;'$j |bc)
  if [ "$prev_position" = "0" ]
  then
    prev_position=$position
    continue
  fi
  the_count=$(echo $position'-'$prev_position |bc)
  dd if=canon.file of=test$i.jpg bs=1 skip=$prev_position count=$the_count
  prev_position=$position
done


This simple script will do the trick. Of course, some modification might be needed (like you might have a different version of hexdump, so the easiest way ot know if the magic number is right is to do a hexdump of an old picture you have taken with that camera)