Re: digital forensics - recovering images from a memory card with trashed file system
On Wed, 29 Oct 2008 00:07:44 +0100
Emanoil Kotsev <deloptes@yahoo.com> wrote:
> thveillon.debian wrote:
>
> > Micha a écrit :
> >> After my camera died on a recent trip I bought a new one (nikon s52 if it
> >> helps). Due to some bug and bad timing on button presses the camera
> >> trashed the file system somehow. Based on the number of images it can
> >> write to disk it seems that the images are still there, but what I see
> >> under the directory is some directories with trashed file names that
> >> can't be used and some files with a size of 1TB that are junk (on a 2GB
> >> card).
> >>
> >> I'm looking for a way to rescue the images (jpegs) if possible. I tried
> >> rstudio under windows but it only found some AVIs but not the images (at
> >> least using the basic settings).
> >>
> >> Are there any programs (linux, windows or mac) that may be able to
> >> recover the images, or any other way to do it?
> >>
> >> It was a new (and formated) card so that there is a chance that the
> >> images written in some order but I don't know enough about this hardware.
> >>
> >> The card is a 2GB transcend secure digital (sd)
> >>
> >> thanks
> >>
> >>
> > Hi,
> >
> > with Linux I guess Tesdisk and Photorec are your best bet, photorec did
> > a great job for me once. With windows and Mac I guess products from
> > diskinternals.com and prosofteng.com can do a similar job through a nice
> > gui, but they don't come for cheap.
> > If you want win/mac freeware just have a look on softpedia.com.
> >
> > Tom
> >
> >
>
> why don't try a card reader
>
I tried 3. I wouldn't be able to access the card at all without one ...
Like I said, it's not the card that's the problem it's the file system that is
ruined, and even that partially, it's the file inodes (or whatever they are
called under fat) or directory entries that were junked. I'm guessing that due
to some concurrent read/write without a mutex or something like that.
> regards
>
>
Reply to: