LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Recover deleted images with standard Linux tools from the command line (https://www.linuxquestions.org/questions/linux-newbie-8/recover-deleted-images-with-standard-linux-tools-from-the-command-line-4175559572/)

gunetel 12-01-2015 02:43 AM

Quote:

Originally Posted by phantomfreak (Post 5457504)
With a simple google search there are ways to do so. You'll need to read each link and see which is more doable for you. Some links will use windows based tools or linux based tools. Also, some instructions will be specific to internal, external or both.

Thanks for the suggestion. Seems there are a lot of scammer sites when searching on Google, lol

suicidaleggroll 12-01-2015 08:24 AM

Quote:

Originally Posted by gunetel (Post 5457265)
does this work the same to Android phone? I need to recover a few photos on my Galaxy S6

You should open a new thread. The arbitrary restrictions placed on the "exercise" in this thread (can't install any recovery tools, can't boot any recovery tools, and the filesystem is in RAM...who stores files they care about on a RAM filesystem?) are so far removed from reality that none of the suggestions posted here will help you or anybody else trying to actually do any file recovery.

phantomfreak 12-01-2015 02:06 PM

Quote:

Originally Posted by suicidaleggroll (Post 5457882)
You should open a new thread. The arbitrary restrictions placed on the "exercise" in this thread (can't install any recovery tools, can't boot any recovery tools, and the filesystem is in RAM...who stores files they care about on a RAM filesystem?) are so far removed from reality that none of the suggestions posted here will help you or anybody else trying to actually do any file recovery.

I would have to question the course the OP is taking for such an odd assignment. That's way in post #28, I downloaded siltaz to prove my point that a live system from RAM is not permanent unless it is on 24/7. And everything that was done or saved is lost on the next reboot.

I suggest the OP download the latest siltaz and install it on a virtual disk in a VM or as a dual boot option on the system.

D-kikin 12-12-2015 05:27 PM

Resolved
 
Thanks to all that tried to help out. It is great to know that I am not on my own on this journey learning this new and awesome OS. Here is how I was able to solve my problem:

Apparently when you save pics to a folder in Linux/Windows the file system creates a hidden thumbnails.db file in that folder. After finding the thumbnails.db file I used vinetto to recover the pics. It was pretty straightforward once I found out about the thumbnails.db.

lioncocoz 03-22-2017 06:19 AM

Used Fedora to recover deleted photos from my SD card. but nothing found after a full scan. What would be the problem? thanks

Shadow_7 04-05-2017 09:57 PM

photorec from testdisk might be able to find something. Although normally it handles corrupt filesystems. There was undel for dos bitd, although not seeing anything like it for dosemu.

jefro 04-06-2017 03:51 PM

This is getting to be a beat up old thread. Might be time to close it??

Gcwerty 05-27-2017 03:41 AM

Quote:

Originally Posted by lioncocoz (Post 5686708)
Used Fedora to recover deleted photos from my SD card. but nothing found after a full scan. What would be the problem? thanks

Maybe you can try scanning your memory card ,

AwesomeMachine 05-27-2017 10:34 AM

You could use something like this:
Code:

$ dd if=file_system | hexdump -C | grep 'ff\ d8\ ff\ e0'
which will give you the offsets of the beginning of the deleted jpg files. Then, save that section of disk:
Code:

$ dd if=file_system skip=certain_number_of_sectors count=certain_number_of_sectors of=file.file
Then search file.file with a hex editor, for the header of the first deleted jpg as above. Then search for the footer, and save that chunk to a jpg file. Then do the next one. It might be explained better in this post: http://www.linuxquestions.org/questi...ommand-362506/


All times are GMT -5. The time now is 12:20 PM.