I use Linux for handling my pictures. I lost a disk that contains a lot of Pentax PEF files and JPEG files. I was able to recover the JPEG files with the tool foremost. It can be configured to recover the PEF files too but for that I need the header for the PEF files (One header for JPEG it seems to be \xff\xd8\xff\xe0\x00\x10).
Has anybody an idea what I should add for PEF? Is \x4d\x4d\x00\x2a enough?
Is there another tool that I could use?
Photorec is a similar sort of program which can handle the recovery of PEF files according to their list of supported file formats
testdisk but I was unaware of it.
– Marco
Nov 28 '16 at 19:16
I checked with PEF files from my K20D, K-5 and K-3. The former two's files begin with 4D 4D 00 2A ("MM.*"), but the K-3's begin with 49 49 2A 00 ("II*.").
Maybe older or newer models use even different codes. I suggest you look or ask for specific PEF files matching your own models first, then use those 4 bytes for header detection. Since they're all using a 00 byte, and only occur at the start of a file when looked up by file recovery software, this should be a safe procedure, avoiding random occurances of those patterns. At worst, you'll get some false positives, which you can then later sort out. For instance, running the exiftool program over each file afterwards may help identify valid PEF files, and sort out by bad ones.
