Summer Start

by VonSchnauzer

submit your photo


Hall of Fame
View past winners from this year

Please participate in Meta
and help us grow.

Take the 2-minute tour ×
Photography Stack Exchange is a question and answer site for professional, enthusiast and amateur photographers. It's 100% free, no registration required.

My technophobe mother returned from a European trip to discover she'd erased all but 15 images from a nearly full 2GB card. As I am the computer guy in the family, she posted the card to me and asked that I make something magical happen.

The photos were taken with and deleted by a Nikon Coolpix. (I don't know the model.)

I am a Linux guy, but there is a Windows Vista box at my disposal.

What is my best strategy to try to recover something?

share|improve this question
    
I ought to have mentioned that I did have her push the write protect switch and that she did indeed take some photos after the great deleting. There are only 15 photos, but over 50% of the card's space is full, so some are obvious gone, but there's hope for some, too. Thanks for the answers. I'll be sure to come back for upvoting & accepting after I've tried some of the suggestions. –  vanden Jul 22 '10 at 22:35
3  
This is actually a question about recovering deleted files, it doesn't really make any differene that they are images. Perhaps would fit better on superuser? –  Guffa Jul 22 '10 at 23:54
5  
@Guffa There are tools specialised in recovering images, that can scan the file system for things that look like they might be photos etc. Agree it's borderline, but it's probably of interest here. –  Rowland Shaw Jul 23 '10 at 8:09
1  
No matter what tool you try, run dd on the card so you have a safe backup first. Easy enough to dd this back onto another SD card if needed. –  AngerClown Jan 21 '11 at 4:29

8 Answers 8

I can't speak for Linux, but on Windows I've used the excellent "Recuva" product from Piriform to recover deleted files.

Recommend giving that a go to see if the content is still retrievable and as Reid said - if there were more photos taken afterward then she's almost certainly up the creek.

share|improve this answer
2  
+1 for Recuva (and it's free, too) –  Matt Bishop Jul 22 '10 at 22:18
    
+1 for Recuva too. I've restored pics and videos from hard drives that were deleted years ago. I wished there was a version for the Mac. –  cbmeeks Mar 28 '11 at 19:14
    
+1 too. Used more times and always successful. –  Juhele Jun 30 '11 at 13:37
    
@cbmeeks - Have you tried Wine? I don't know how it will handle the low-level access stuff, but it might work. –  Fake Name Jul 1 '11 at 3:14
    
@cbmeeks - appdb.winehq.org/objectManager.php?sClass=version&iId=7786 - Apparently you can use it to recover files from NTFS/FAT16/32 partitions with some command line trickery. If you are comfortable with using CLI tools, it should be workable. –  Fake Name Jul 1 '11 at 3:18

Check out TestDisk or the associated PhotoRec tool from CGSecurity.

TestDisk will allow you to scan the file system and look for deleted files. (See How to Undelete files with TestDisk.) Provided the data hasn't been overwritten it should be possible to recover the files. You can also use TestDisk to take an copy of the underlying file system to stop any accidental overwrites of the data deleting it permanently.

PhotoRec offers similar functionality but specifically targets recovering photos/videos and will search the file systems data for info that can be re-built into images. (See PhotoRec step by step)

Both free, open source and run on Windows and Linux.

(You mention it's an SD card. It might be worth putting it into read-only mode before you plug it in just to be sure nothing gets written to the card while you are working with it)

share|improve this answer
3  
Yes, PhotoRec is very awesome, even when the file system is destroyed on the card, it can recover jpg's –  Davy Landman Jul 23 '10 at 8:46
    
+1 for PhotoRec. Easy, fast, and unerring. Made a lot of friends happy recovering their photos! –  Agos Jul 23 '10 at 11:33
2  
+1 for PhotoRec: I was able to recover all the photos from a card that reported of not being formatted (destroyed file system). I wasn't able to access it in Windows at all (not to mention camera). All photos intact and great. Thanks to the maker of this program. Software is also very straight forward even though it asks a few computer-oriented questions (like platform and file system type etc). –  Robert Koritnik Mar 29 '11 at 9:43
    
Another upvote for TestDisk/PhotoRec: I have succesfully used it in the past to recover images. –  BioGeek Apr 14 '12 at 0:23

I successfully recovered all the files from a formatted card by copying it using dd and then using the sleuth kit under linux. Fortunately no pictures had been taken since the card was formatted.

I used the fls and icat commands as described in test image results from Sleuthkit Informer Issue #14 and the TSK Tool Overview

share|improve this answer
3  
+1 for actually giving a linux tool –  Mark Jul 24 '10 at 15:51
    
Similar approach has worked for me, but instead of sleuth kit I have simply 'grepped' the card image for JPEG headers. Since the pictures were stored sequentially, this actually extracted most of them. –  che Jul 25 '10 at 22:53

There are two apps I have tried that worked for me:

  • Ontrack EasyRecovery - Very good, comprehensive and reliable. Got me out of trouble more than once. Unfortunately a bit pricey. Windows only. The Lite version is good enough for you as it can recover up to 25 files.

  • Sandisk RescuePRO - Not as comprehensive as EasyRecovery but gets the job done and is optimized for pictures. Comes free with some (or maybe all) Sandiks memory cards. Available for Windows and Mac.

  • Piriform Recuva - A free solution that I never used but have heard good things about. Again Windows only.

share|improve this answer
2  
Yes, I've used Sandisk RescuePRO with success a couple of times. –  Marc Jul 23 '10 at 8:25

I like PhotoRescue because I can start by doing a backup image of my card (useful if the card is close to dying) and then I can recover from the backup (faster because its on your hard drive). It also can recover video which some others can't do and it's super cheap.

share|improve this answer
    
+1 - PhotoRescue has saved me once or twice. –  Fredrik Mörk Jul 22 '10 at 23:07

When files are deleted, they are just left where they are, and the clusters are flagged as unused, so while the directory entries that contains the file name and start cluster are gone, most of the file data should be intact.

There are several different programs that can undelete files, you should make a web search on "undelete files" and the file system of the memory card.

share|improve this answer
    
Why the downvote? If you don't explain what it is that you think is wrong, it can't improve the answer. –  Guffa Jul 22 '10 at 23:52
    
+1 but maybe a link to a good post on superuser to further talk about this and enlighten any user who comes here? –  Wayne Jul 23 '10 at 3:05
1  
No downvote from me, but I'd guess it's because you didn't actually mention any specific tools, only a vague explanation of the fact that files can be undeleted followed by 'several different programs' and 'search the web' –  Mark Jul 24 '10 at 15:50
    
@Mark: Perhaps. However, he actually asked for a stragegy, not a tool... –  Guffa Jul 24 '10 at 17:44

Try Zero Assumption Recovery (ZAR) - I have used it to retrieve data from a hard drive with corrupt Master Boot Record and worked really well. The program is free to use on memory cards.

share|improve this answer

First you'll want to clone the card's filesystem using dd. I believe the filesystems on those things are simple, FAT or something like that. Once you figure out what the FS is, you could then google for appropriate recovery tools. If you can, work on copies of the clone rather than the card itself.

If the files were erased and then nothing else happened, you can probably get them back. On the other hand, if she deleted and then took more photos, you are almost certainly SOL on at least some of the photos.

Good luck!

share|improve this answer

protected by mattdm Aug 30 '11 at 4:45

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.