Recovering deleted photos with Linux using 'foremost'
Posted: Wed Apr 01, 2009 3:06 pm
[PROBLEM]
Recently, I've cut (instead of copied) images from an SD card to my harddisk, but the adapter caused data corruption and so the files arrived broken on my HDD and were erased from the SD card. yeah. great.
[SOLUTION]
An SD card is (usually) formatted with the vfat (FAT32) or fat (FAT16) filesystem.
(note: the same procedure works for USB sticks, etc, too)
Here's what I did to recover the lost fotos:
a) Take a binary image of the partition on the SD card to work with:
b) install and run "foremost" on this image.
("foremost" is a forensic tool which comes in the default repositories of major )distributions (e.g. Ubuntu).
Now foremost will work on that image and try to find patterns of files on that partition, which it will recover and output by their filetype, in a folder called "output_CURRENT_DATE"
Note: From what I've seen so far, foremost does not preserve folder structures or filenames and only recovers the file data itself.
Recently, I've cut (instead of copied) images from an SD card to my harddisk, but the adapter caused data corruption and so the files arrived broken on my HDD and were erased from the SD card. yeah. great.
[SOLUTION]
An SD card is (usually) formatted with the vfat (FAT32) or fat (FAT16) filesystem.
(note: the same procedure works for USB sticks, etc, too)
Here's what I did to recover the lost fotos:
a) Take a binary image of the partition on the SD card to work with:
Code: Select all
dd if=/dev/sda1 of=/path/to/image/of/sdcard.bin("foremost" is a forensic tool which comes in the default repositories of major )distributions (e.g. Ubuntu).
Code: Select all
apt-get install foremost
foremost -i sdcard.bin -T tempNote: From what I've seen so far, foremost does not preserve folder structures or filenames and only recovers the file data itself.