6

Recently I stupidly deleted some photos I shouldn't have. I used a program to recover the photos, some of them came back in a corrupted condition like below with grey areas.

Any idea on how to fix this? The information is clearly there in some form, as when I view the photos with Windows Photo Viewer, the complete image is briefly shown for a fraction of a second while windows is generating the preview.

corrupted image

2 Answers 2

6

Some large images contain a smaller thumbnail which is a low-resolution version of the entire image.

This smaller image-inside-image is used by some programs, such as Windows Explorer when displaying the image in Icon View. Otherwise, to display the image's icon would require reading the entire image and converting it to icon-size, which would unacceptably slow down the display of the folder.

I'm guessing that Windows Photo Viewer is displaying this thumbnail in a user-friendly manner, while reading the larger image. However, that larger image is damaged, and only the thumbnail has survived as intact.

Recuva is a good photo-recovery program, so I guess that the damage is caused by your having over-written that part of the image. You should never write data to a volume that you wish to recover.

If, however, that volume is still reasonably intact, you can also try another very good file recovery product:
PC INSPECTOR File Recovery
but remember to copy the recovered images to some other volume, otherwise when recovering one image you may be destroying another.

For repairing damaged JPEG images see this thread : Corrupt jpegs, thumbnail extracted....
It recommends quite a few such tools, as well as thumbnail extraction tools.
ExifTool looks especially good.

3
  • Thanks harry, useful info. You know if there is anyway of getting at this smaller 'image-inside-image'? Would be nice to recover that if nothing else works.
    – Dan
    Sep 25, 2010 at 18:10
  • Dan: See the addition at the end.
    – harrymc
    Sep 25, 2010 at 19:56
  • Thanks mike very helpful. I used JpegSnoop in the end (also mentioned in your link), amazing what it brought back. Thanks for your time, managed to resort some precious photos, you have made me very happy.
    – Dan
    Sep 27, 2010 at 11:04
0

Disclosure: A few years ago I was asked if it was possible to repair such a file and I decided to investigate. As a result of that I was able to work out how I could repair the file and this eventually led me to write some (non-free) tools which I will mention in this post. Whenever possible I will point to free alternatives.

Disclaimer: With JPEGs, a lot of math is involved. I am no trained or schooled expert on the matter and a lot of what I explain I discovered by tinkering and finding 'what works'. So, do not expect all this information to be scientifically correct.

It depends. If we see an image like that 3 things can be wrong:

  1. Only part of file is recovered or present (if not recovered by some tool). To determine if this is the case compare file size with similar files, taken with same camera and settings.
  2. If file size is good, part of the file may not contain correct data. This is easiest to check with a hex editor (HxD for example, free). Often you will find large portion of file is filled with zeros or some repeating byte pattern (FF FF FF FF etc.).
  3. If previous issues are checked, file size is good, and high entropy data throughout file then even minor corruption in encoded and compressed image data can upset a decoder (that's built into your image viewer).

Since scenario 3 is the only that can potentially be repaired, let's dive into it. There are specific byte combinations have meaning to JPEG decoders: FF xx is interpreted by JPEG decoders as so called JPEG marker (see.). These markers are used to divide a JPEG into 'sections' all with different purposes. If the decoder encounters an FF xx byte pair inside the actual image data that is not valid (not FF Dn (where n = 0 to 7) and not FF 00), most decoders will simply stop decoding. This can be result of a single 'bit flip' where FE becomes FF. Since part of image data is not decoded this will manifest as grey block. Removing the offending byte pair is only part of the solution as we do not know original values but I have been able to repair images using nothing but a hex editor and image viewer. Using JpegSnoop it is easy to determine the byte address of such offending byte combinations. However, due to the way a JPEG is encoded/decoded this issue affects all image data that follows (simply put, luminance and chrominance data is stored as delta, e.g. difference relative to previous block). To repair the damage you may want to use a special editor (in this YouTube video I use my own and and a free editor to see if and how a partially grey JPEG can be repaired.). Only very few times you may be lucky enough that simply overwriting offending bytes with zeros results in a satisfactory result:

repair JPEG using nothing but hex editor

For scenario 2 there's no solution. Scenario/problem 1 may be caused by incorrect recovery:

  1. File system aware recovery tool: Simply put, such tools rely on finding pieces of file system data to locate lost data. If we assume some FAT based file system, as these are dominant on memory cards used in digital cameras, the tool locates a directory entry from which it can decode filename, file size, file attributes and first cluster. It then examines the file allocation table to get rest of clusters and finally reassembles the file. In case FAT chain is corrupt / incomplete for whatever reason only part of the file may be reassembled. This type of corruption is not uncommon in FAT based file systems (FAT, FAT32 and to some degree exFAT). Recovery is often still possible using a so called carver, but these bring their own unique set of problems.

  2. The other category of file recovery tools are so called 'carvers'. Rather than relying on file system, they scan the drive for 'magic bytes' that may indicate presence of a certain file type. If we assume JPEG we could scan the drive for FF D8 FF at cluster or sector boundaries as JPEGs always start with that specific byte combination. Now we know where the file starts.

Problems with this method: Many tools are quite simplistic and will assume they reached the end of the JPEG if the encounter FF D9 which is JPEG 'end of image marker' of if they encounter some magic bytes that may indicate start of the next file. Many of these so called scanners scan for multiple file types and by sheer accident may encounter a combination of bytes that matches some other file type. For example 49 44 33 is perfectly valid JPEG data but also happen to be the magic bytes for an MP3 file. Simplistic approach is now to draw conclusion we reached the end of the file and start recovering the MP3 file. Second problem is file fragmentation where before the end of the file is reached a valid byte combination is found for next JPEG. Many carvers will close the JPEG they were recovering and start with next one. There is no easy solutions to this although tools exist that either allow you to manually attempt to reassemble such files or even try to work it out themselves.

manual reassembly of fragmented JPEG

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .