3

My portable 2.5 hard drive just stopped being recognized by Windows. It was still visible as RAW, so I used a recovery software.

It recovered a lot of files (I had a lot of pictures on it), but I can't open the images. They have more than 3/4 MB, so the data is still there.

Any idea how I still can open them or some trick to get them to work?

3

good answer found here

It depends upon what part is broken. If it's a broken header, you can usually fix it by simply opening the file in a hex editor and fixing the header. I do this all the time during forensic investigations. If it's broken data inside the file, then there is not much you can do. I normally use EnCase or similar tools for recovering deleted files. What filesystem was the file on? If it was NTFS and it wasn't overwritten, then you should have gotten a complete file. Unfortunately, most file recovery software tools don't recognize an overwritten file and just recover all the sectors associated with the file from the $BITMAP whether they have been reallocated for another file or not.

Autopsy is an opensource forensic software that is analogous to EnCase.

| improve this answer | |
  • It was HFS and was always running on a mac. I will try to use autopsy. Can you fix headers with that or is it different ? – MichaelAngelo Oct 16 '15 at 14:26
  • should work just fine. – sonofapharmacist Oct 16 '15 at 14:27
  • it just recovered 12 pictures. The damaged pictures are nowhere to be seen... – MichaelAngelo Oct 16 '15 at 15:57
0

For future reference:

A while back I was asked to repair some JPEG photos. I was able to do this using a hex editor and some reading on JPEG file format:

Using HxD: Use Search > Find, search for FF DA using HEX data type. If not found the file is beyond repair.

Find the last instance if FF DA using HxD

It is possible multiple instances of FF DA are found, you need the LAST one. There may be a few if the JPEG included a thumbnail and preview.

Note: If you find many FF DA byte combinations then you’re probably not looking at JPEG data but random binary data. The file then is probably beyond repair.

Write down the address (Using View > Offset base you can switch to decimal numbers if you like). Now search for FF D9. Or, go to end of the file which is where you’d normally find FF D9.

Once found, select the entire block including the last FF DA upto and including FF D9 > right click > copy.

Open a new file > Paste Insert > Save as ‘image.jpg’. You have now copied the image data to a new file.

Open a known good file that was shot with the same camera, using same resolution and orientation (portrait/landscape).

Use Search > Find, search for FF DA using HEX data type.

Search, set data type to Hex-values

It is possible multiple instances of FF DA are found, you need the LAST one.

Select the block preceding the FF DA bytes all the way to the start of the file (FF D8)

Switch to your image.jpg file TAB containing the image data, make sure you’re at offset 0 (zero) > Paste Insert > Save the file.

I was then asked by some one else, and then again. I then wrote a small tool that would do this automatically. I think that's a year ago. Since then the tool has developed into something that I think can handle any JPEG issue, assuming the JPEG data is still present. The current status of the tool is shareware.

It's called JPEG Repair Toolkit.

| improve this answer | |
-1

Data Recovery Software uses an algorithm to salvage into Hard Disk and recover files regardless of whether they are healthy or not; that means you can recover Healthy Files and Corrupted ones. Some Data Recovery Software has the option to Recover Selecting files or Recover all. There is not special Tricks but they are different Techniques to recover data based in the problem of you are facing on.

My suggestion – You should always follow The Four Phases of Data Recovery.

  • Repair Hard Disk: In some cases and if you or some technician have the skills and the tools to do a physical repair, and it could help you to fix your problem before to do a Logical Recovery.

  • Backup Drive into Image: If the hardware allow you, always the second step is Backup the complete Drive using a Clone or Full Image Backup software, so when you start the Logical Recovery step and your files will keep safe.

  • Logical Recovery: Logical recovery process involve to use specific recovery software to try to recover files, there are a lot of software, I could suggest to you some, but personally I think that information is easy to get using your favourite search engine.

  • Repair Damaged Files: This step is in very specific case when your files are damaged or corrupted, in older times edit a file using a hex editor tool, was pretty easy because the files were smaller than today, now personally this step is justified in forensic labs, because it spend a lot of time.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.