29
\$\begingroup\$

My technophobe mother returned from a European trip to discover she'd erased all but 15 images from a nearly full 2GB card. As I am the computer guy in the family, she posted the card to me and asked that I make something magical happen.

The photos were taken with and deleted by a Nikon Coolpix. (I don't know the model.)

I am a Linux guy, but there is a Windows Vista box at my disposal.

What is my best strategy to try to recover something?

Improve this question
\$\endgroup\$
4
  • \$\begingroup\$ I ought to have mentioned that I did have her push the write protect switch and that she did indeed take some photos after the great deleting. There are only 15 photos, but over 50% of the card's space is full, so some are obvious gone, but there's hope for some, too. Thanks for the answers. I'll be sure to come back for upvoting & accepting after I've tried some of the suggestions. \$\endgroup\$
    – vanden
    Commented Jul 22, 2010 at 22:35
  • 3
    \$\begingroup\$ This is actually a question about recovering deleted files, it doesn't really make any differene that they are images. Perhaps would fit better on superuser? \$\endgroup\$
    – Guffa
    Commented Jul 22, 2010 at 23:54
  • 7
    \$\begingroup\$ @Guffa There are tools specialised in recovering images, that can scan the file system for things that look like they might be photos etc. Agree it's borderline, but it's probably of interest here. \$\endgroup\$
    – Rowland Shaw
    Commented Jul 23, 2010 at 8:09
  • 2
    \$\begingroup\$ No matter what tool you try, run dd on the card so you have a safe backup first. Easy enough to dd this back onto another SD card if needed. \$\endgroup\$
    – AngerClown
    Commented Jan 21, 2011 at 4:29

8 Answers 8

Reset to default
21
\$\begingroup\$

I can't speak for Linux, but on Windows I've used the excellent "Recuva" product from Piriform to recover deleted files.

Recommend giving that a go to see if the content is still retrievable and as Reid said - if there were more photos taken afterward then she's almost certainly up the creek.

Improve this answer
\$\endgroup\$
4
  • \$\begingroup\$ +1 for Recuva too. I've restored pics and videos from hard drives that were deleted years ago. I wished there was a version for the Mac. \$\endgroup\$
    – cbmeeks
    Commented Mar 28, 2011 at 19:14
  • \$\begingroup\$ @cbmeeks - Have you tried Wine? I don't know how it will handle the low-level access stuff, but it might work. \$\endgroup\$
    – Fake Name
    Commented Jul 1, 2011 at 3:14
  • \$\begingroup\$ @cbmeeks - appdb.winehq.org/objectManager.php?sClass=version&iId=7786 - Apparently you can use it to recover files from NTFS/FAT16/32 partitions with some command line trickery. If you are comfortable with using CLI tools, it should be workable. \$\endgroup\$
    – Fake Name
    Commented Jul 1, 2011 at 3:18
  • \$\begingroup\$ When I've used Recuva it sees Canon .cr2 files as TIFFs which are not usable in that form with most raw image convertors/editors. Bulk renaming all of the file extensions to .cr2 makes them perfectly usable again, though. \$\endgroup\$
    – Michael C
    Commented Sep 1, 2022 at 16:11
20
\$\begingroup\$

Check out TestDisk or the associated PhotoRec tool from CGSecurity.

TestDisk will allow you to scan the file system and look for deleted files. (See How to Undelete files with TestDisk.) Provided the data hasn't been overwritten it should be possible to recover the files. You can also use TestDisk to take an copy of the underlying file system to stop any accidental overwrites of the data deleting it permanently.

PhotoRec offers similar functionality but specifically targets recovering photos/videos and will search the file systems data for info that can be re-built into images. (See PhotoRec step by step)

Both free, open source and run on Windows and Linux.

(You mention it's an SD card. It might be worth putting it into read-only mode before you plug it in just to be sure nothing gets written to the card while you are working with it)

Improve this answer
\$\endgroup\$
5
  • 4
    \$\begingroup\$ Yes, PhotoRec is very awesome, even when the file system is destroyed on the card, it can recover jpg's \$\endgroup\$
    – Davy Landman
    Commented Jul 23, 2010 at 8:46
  • \$\begingroup\$ +1 for PhotoRec. Easy, fast, and unerring. Made a lot of friends happy recovering their photos! \$\endgroup\$
    – Agos
    Commented Jul 23, 2010 at 11:33
  • 2
    \$\begingroup\$ +1 for PhotoRec: I was able to recover all the photos from a card that reported of not being formatted (destroyed file system). I wasn't able to access it in Windows at all (not to mention camera). All photos intact and great. Thanks to the maker of this program. Software is also very straight forward even though it asks a few computer-oriented questions (like platform and file system type etc). \$\endgroup\$
    – Robert Koritnik
    Commented Mar 29, 2011 at 9:43
  • \$\begingroup\$ Another upvote for TestDisk/PhotoRec: I have succesfully used it in the past to recover images. \$\endgroup\$
    – BioGeek
    Commented Apr 14, 2012 at 0:23
  • \$\begingroup\$ +1 Just made an account for this site to say that PhotoRec is amazing. I accidentally deleted all my Nintendo Switch screenshots (hint: never put your 'Save destination' on the SD card and then format it) and i got it all back thanks to PhotoRec. \$\endgroup\$
    – Husky
    Commented Nov 21, 2020 at 11:55
12
\$\begingroup\$

I successfully recovered all the files from a formatted card by copying it using dd and then using the sleuth kit under linux. Fortunately no pictures had been taken since the card was formatted.

I used the fls and icat commands as described in test image results from Sleuthkit Informer Issue #14 and the TSK Tool Overview

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ Similar approach has worked for me, but instead of sleuth kit I have simply 'grepped' the card image for JPEG headers. Since the pictures were stored sequentially, this actually extracted most of them. \$\endgroup\$
    – che
    Commented Jul 25, 2010 at 22:53
6
\$\begingroup\$

There are two apps I have tried that worked for me:

  • Ontrack EasyRecovery - Very good, comprehensive and reliable. Got me out of trouble more than once. Unfortunately a bit pricey. Windows only. The Lite version is good enough for you as it can recover up to 25 files.

  • Sandisk RescuePRO - Not as comprehensive as EasyRecovery but gets the job done and is optimized for pictures. Comes free with some (or maybe all) Sandiks memory cards. Available for Windows and Mac.

  • Piriform Recuva - A free solution that I never used but have heard good things about. Again Windows only.

Improve this answer
\$\endgroup\$
1
  • 2
    \$\begingroup\$ Yes, I've used Sandisk RescuePRO with success a couple of times. \$\endgroup\$
    – Marc
    Commented Jul 23, 2010 at 8:25
4
\$\begingroup\$

I like PhotoRescue because I can start by doing a backup image of my card (useful if the card is close to dying) and then I can recover from the backup (faster because its on your hard drive). It also can recover video which some others can't do and it's super cheap.

Improve this answer
\$\endgroup\$
0
2
\$\begingroup\$

First you'll want to clone the card's filesystem using dd. I believe the filesystems on those things are simple, FAT or something like that. Once you figure out what the FS is, you could then google for appropriate recovery tools. If you can, work on copies of the clone rather than the card itself.

If the files were erased and then nothing else happened, you can probably get them back. On the other hand, if she deleted and then took more photos, you are almost certainly SOL on at least some of the photos.

Good luck!

Improve this answer
\$\endgroup\$
2
\$\begingroup\$

When files are deleted, they are just left where they are, and the clusters are flagged as unused, so while the directory entries that contains the file name and start cluster are gone, most of the file data should be intact.

There are several different programs that can undelete files, you should make a web search on "undelete files" and the file system of the memory card.

Improve this answer
\$\endgroup\$
4
  • \$\begingroup\$ Why the downvote? If you don't explain what it is that you think is wrong, it can't improve the answer. \$\endgroup\$
    – Guffa
    Commented Jul 22, 2010 at 23:52
  • \$\begingroup\$ +1 but maybe a link to a good post on superuser to further talk about this and enlighten any user who comes here? \$\endgroup\$
    – Wayne
    Commented Jul 23, 2010 at 3:05
  • 1
    \$\begingroup\$ No downvote from me, but I'd guess it's because you didn't actually mention any specific tools, only a vague explanation of the fact that files can be undeleted followed by 'several different programs' and 'search the web' \$\endgroup\$
    – Mark
    Commented Jul 24, 2010 at 15:50
  • \$\begingroup\$ @Mark: Perhaps. However, he actually asked for a stragegy, not a tool... \$\endgroup\$
    – Guffa
    Commented Jul 24, 2010 at 17:44
2
\$\begingroup\$

Try Zero Assumption Recovery (ZAR) - I have used it to retrieve data from a hard drive with corrupt Master Boot Record and worked really well. The program is free to use on memory cards.

Improve this answer
\$\endgroup\$

Not the answer you're looking for? Browse other questions tagged or ask your own question.