2

I use Linux for handling my pictures. I lost a disk that contains a lot of Pentax PEF files and JPEG files. I was able to recover the JPEG files with the tool foremost. It can be configured to recover the PEF files too but for that I need the header for the PEF files (One header for JPEG it seems to be \xff\xd8\xff\xe0\x00\x10).

Has anybody an idea what I should add for PEF? Is \x4d\x4d\x00\x2a enough? Is there another tool that I could use?

|improve this question
6

Photorec is a similar sort of program which can handle the recovery of PEF files according to their list of supported file formats

|improve this answer
  • At this moment I am getting my files back. It was already installed together with testdisk but I was unaware of it. – Marco Nov 28 '16 at 19:16
3

I checked with PEF files from my K20D, K-5 and K-3. The former two's files begin with 4D 4D 00 2A ("MM.*"), but the K-3's begin with 49 49 2A 00 ("II*.").

Maybe older or newer models use even different codes. I suggest you look or ask for specific PEF files matching your own models first, then use those 4 bytes for header detection. Since they're all using a 00 byte, and only occur at the start of a file when looked up by file recovery software, this should be a safe procedure, avoiding random occurances of those patterns. At worst, you'll get some false positives, which you can then later sort out. For instance, running the exiftool program over each file afterwards may help identify valid PEF files, and sort out by bad ones.

|improve this answer
  • 3
    You've discovered the TIFF header, which has two variations to allow different byte orders. PEF files are based on TIFF, as are most other raw formats. – Mark Ransom Nov 28 '16 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.