Strategies for recovering JPEG files from a damaged filesystem
 

Hi all,

I've recently found myself with what appears to be a damaged ext3 filesystem residing on a logical volume with RAID5 underpinnings.

I have recently uploaded about 500 JPEG files to it from my camera (before the filesystem fell apart). When I examine the bytes residing on the volume, it appears the data is still there.

My question is: What strategies do I use to get these 2-3 megabyte files off of the volume?

I have tried 'foremost', 'photorec', 'magicrescue' and 'RecoverDataLinux' to try to get the files. I get the small files, thumbnails, etc, but cannot get any of the larger files.

What does one do to get any of the larger files?

Thanks for your insight!

--dave;

I've used foremost. It recovers jpg, avi, mpg files from hard disks, since these files have very consistent headers.

File carvers string together bits of files by looking for the start and end of file. The problem is that finding an end-of-file marker (or any adjacent start of file marker in case the sig doesn't have a footer) does not guarantee file integrity: it's kind of a brute force approach so the result may be missing pieces or stray data may have been trapped in it. IIRC Photorec can set a maximum recovered file size. If you oversize it it may yield more results but does not guarantee image consistency. To "cleanse" the images you may have to resort to stuff like this but that means lotsa work so it depends on the value of the images. And unless you executed all your carving with a readonly mounted system any writing can deteriorate what's there. Do make a copy and work on that if possible. You say you copied it off you cam. Would it be possible to carve images out of that as well?