Photo Recovery
Encyclopedia
Photo recovery is the process of salvaging digital photographs from damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. Photo Recovery can be considered a subset of
the overall Data Recovery
field.
Photo loss or deletion failures may be due to both hardware or software failures.
. Typically, if your
drive or card is so badly damaged that your computer can not recognize that a drive/card has been connected, you
will need to consult a data recovery service provider.
.
There are many different file carving techniques that are used to recover photos. Most of these techniques
fail in the presence of file system fragmentation
. Simson Garfinkel showed that on average 17% of JPEG
s are fragmented, which
means on average 17% of jpegs are recovered partially or appear corrupt when recovered using techniques that
can't handle fragmented photos. Programs like Adroit Photo Recovery and
CnW Recovery that claim to recover fragmented photos are listed in the photo recovery software list.
signature of the photo format. To take an example, all JPEG
s always begin with the hex sequence "FFD8" and they must
end with the hex sequence "FFD9". Header-Footer Carving cannot be used to recover fragmented photos, and fragmented
photos will appear to be partially recovered or corrupt if incorrect data is added. Header-Footer Carving along
with Header-Size Carving are by far the most common techniques for photo recovery. One of the first non-gui/console
based programs to use this technique is PhotoRec
.
the photo format, along with the size of the photo that is either derived or explicitly stated in the photo format.
To take an example all 24-bit Windows Bitmaps (*.bmp), begin with the letters "BM", and store the size of the file in
the header. Header-Footer Carving cannot be used to recover fragmented photos, and fragmented photos will appear to be
partially recovered or corrupt if incorrect data is added.
structure rules of the photo format. This will enable a recovery program to identify when a photo is not complete or
fragmented, but more needs to be done to see if a fragmented photo can be recovered. This technique is rarely
used by most photo recovery programs.
carving occur when each part of the recovered photo is compared against the rest of the photo to see if it "fits"
visually. Validated carving is superb at detecting photos that are either fragmented or have parts over-written or
missing. Validated carving alone cannot be used to recover fragmented photos.
to recover a deleted photo. For example, occasionally NTFS will store in the logs the exact location of where the
file was located prior to its deletion. A program using Log Carving will be able to then recover the photo. To be
sure about the quality of recovery, Validated Carving or File-Structure based carving should also be used to
validate the recovered photo.
between the header and footer are validated to determine which combination results in the correct recovery of the
photo. This technique will only work if the file is fragmented into two parts.
is the best visual match for the photo being recovered. This is done in parallel for all blocks that are not part
of a recovered file.
It is important to note that for logical damage or loss, good photo recovery software can recover your photos.
the overall Data Recovery
Data recovery
Data recovery is the process of salvaging data from damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. Often the data are being salvaged from storage media such as internal or external hard disk drives, solid-state drives , USB flash drive,...
field.
Photo loss or deletion failures may be due to both hardware or software failures.
Recovering data after hardware failure
An excellent explanation of hardware failures is provided in the section for data recoveryData recovery
Data recovery is the process of salvaging data from damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. Often the data are being salvaged from storage media such as internal or external hard disk drives, solid-state drives , USB flash drive,...
. Typically, if your
drive or card is so badly damaged that your computer can not recognize that a drive/card has been connected, you
will need to consult a data recovery service provider.
Recovering data after logical failure
Logical Damage or the inability to view photos can occur due to many reasons. The most common reasons are:- Deletion of photos.
- Corruption of boot sector of media.
- Corruption of file systemFile systemA file system is a means to organize data expected to be retained after a program terminates by providing procedures to store, retrieve and update data, as well as manage the available space on the device which contain it. A file system organizes data in an efficient manner and is tuned to the...
. - Disk formattingDisk formattingDisk formatting is the process of preparing a hard disk drive or flexible disk medium for data storage. In some cases, the formatting operation may also create one or more new file systems...
. - Move or Copy errors.
Photo Recovery Using File Carving
The majority of photo recovery programs work by using a technique called file carving (data carving)File carving
File carving is the process of reassembling computer files from fragments in the absence offilesystem metadata. The carving process makes use of knowledge of common file structures, information contained in files, and heuristics regarding how filesystems fragment data...
.
There are many different file carving techniques that are used to recover photos. Most of these techniques
fail in the presence of file system fragmentation
File system fragmentation
In computing, file system fragmentation, sometimes called file system aging, is the inability of a file system to lay out related data sequentially , an inherent phenomenon in storage-backed file systems that allow in-place modification of their contents. It is a special case of data fragmentation...
. Simson Garfinkel showed that on average 17% of JPEG
JPEG
In computing, JPEG . The degree of compression can be adjusted, allowing a selectable tradeoff between storage size and image quality. JPEG typically achieves 10:1 compression with little perceptible loss in image quality....
s are fragmented, which
means on average 17% of jpegs are recovered partially or appear corrupt when recovered using techniques that
can't handle fragmented photos. Programs like Adroit Photo Recovery and
CnW Recovery that claim to recover fragmented photos are listed in the photo recovery software list.
Header-Footer Carving
In Header-Footer Carving, a recovery program attempts to recover photos based on the standard starting and ending bytesignature of the photo format. To take an example, all JPEG
JPEG
In computing, JPEG . The degree of compression can be adjusted, allowing a selectable tradeoff between storage size and image quality. JPEG typically achieves 10:1 compression with little perceptible loss in image quality....
s always begin with the hex sequence "FFD8" and they must
end with the hex sequence "FFD9". Header-Footer Carving cannot be used to recover fragmented photos, and fragmented
photos will appear to be partially recovered or corrupt if incorrect data is added. Header-Footer Carving along
with Header-Size Carving are by far the most common techniques for photo recovery. One of the first non-gui/console
based programs to use this technique is PhotoRec
PhotoRec
PhotoRec is a file carver data recovery software tool designed to recover lost files from digital camera memory , hard disks and CD-ROMs...
.
Header-Size Carving
In Header-Size Carving, a recovery program attempts to recover photos based on the standard starting byte signature ofthe photo format, along with the size of the photo that is either derived or explicitly stated in the photo format.
To take an example all 24-bit Windows Bitmaps (*.bmp), begin with the letters "BM", and store the size of the file in
the header. Header-Footer Carving cannot be used to recover fragmented photos, and fragmented photos will appear to be
partially recovered or corrupt if incorrect data is added.
File-Structure Based Carving
A more advanced form of carving, a recovery program attempts to recover photos based on detailed knowledge of thestructure rules of the photo format. This will enable a recovery program to identify when a photo is not complete or
fragmented, but more needs to be done to see if a fragmented photo can be recovered. This technique is rarely
used by most photo recovery programs.
Validated Carving
In validated carving, a decoder is used to detect any errors in recovery of a photo. More advanced forms of validatedcarving occur when each part of the recovered photo is compared against the rest of the photo to see if it "fits"
visually. Validated carving is superb at detecting photos that are either fragmented or have parts over-written or
missing. Validated carving alone cannot be used to recover fragmented photos.
Log Carving
Log Carving occurs when a recovery program uses information left over in either file system structures or the logto recover a deleted photo. For example, occasionally NTFS will store in the logs the exact location of where the
file was located prior to its deletion. A program using Log Carving will be able to then recover the photo. To be
sure about the quality of recovery, Validated Carving or File-Structure based carving should also be used to
validate the recovered photo.
Bi-Fragment Gap Carving
A fragmented photo recovery technique where a header and footer are identified and then all combinations of blocksbetween the header and footer are validated to determine which combination results in the correct recovery of the
photo. This technique will only work if the file is fragmented into two parts.
SmartCarving
A process by which fragmented photos are recovered by looking at blocks on the disk and determining which blockis the best visual match for the photo being recovered. This is done in parallel for all blocks that are not part
of a recovered file.
Photo Recovery Tips
- Do not write/save to the drive that you wish to recover from. Every potential write operation may over-write the blocks that you wish to recover from.
- If you suspect your drive is dying, create a disk imageDisk imageA disk image is a single file or storage device containing the complete contents and structure representing a data storage medium or device, such as a hard drive, tape drive, floppy disk, CD/DVD/BD, or USB flash drive, although an image of an optical disc may be referred to as an optical disc image...
of your drive and choose photo recovery software that can read disk images. - Save any recovered photos to a drive different from the recovered drive.
- BackupBackupIn information technology, a backup or the process of backing up is making copies of data which may be used to restore the original after a data loss event. The verb form is back up in two words, whereas the noun is backup....
so that you don't have to worry about recovery software again.
It is important to note that for logical damage or loss, good photo recovery software can recover your photos.
Further reading
- Tanenbaum, A. & Woodhull, A. S. (1997). Operating Systems: Design And Implementation, 2nd ed. New York: Prentice Hall.
- What To Do When Windows Vista Crashes: Little-Known Recovery Strategies, from Information Week