Recover deleted images with standard Linux tools from the command line

gunetel · 12-01-2015, 02:43 AM

Quote:

Originally Posted by phantomfreak

With a simple google search there are ways to do so. You'll need to read each link and see which is more doable for you. Some links will use windows based tools or linux based tools. Also, some instructions will be specific to internal, external or both.

Thanks for the suggestion. Seems there are a lot of scammer sites when searching on Google, lol

suicidaleggroll · 12-01-2015, 08:24 AM

Quote:

Originally Posted by gunetel

does this work the same to Android phone? I need to recover a few photos on my Galaxy S6

You should open a new thread. The arbitrary restrictions placed on the "exercise" in this thread (can't install any recovery tools, can't boot any recovery tools, and the filesystem is in RAM...who stores files they care about on a RAM filesystem?) are so far removed from reality that none of the suggestions posted here will help you or anybody else trying to actually do any file recovery.

phantomfreak · 12-01-2015, 02:06 PM

Quote:

Originally Posted by suicidaleggroll

You should open a new thread. The arbitrary restrictions placed on the "exercise" in this thread (can't install any recovery tools, can't boot any recovery tools, and the filesystem is in RAM...who stores files they care about on a RAM filesystem?) are so far removed from reality that none of the suggestions posted here will help you or anybody else trying to actually do any file recovery.

I would have to question the course the OP is taking for such an odd assignment. That's way in post #28, I downloaded siltaz to prove my point that a live system from RAM is not permanent unless it is on 24/7. And everything that was done or saved is lost on the next reboot.

I suggest the OP download the latest siltaz and install it on a virtual disk in a VM or as a dual boot option on the system.

D-kikin · 12-12-2015, 05:27 PM

Thanks to all that tried to help out. It is great to know that I am not on my own on this journey learning this new and awesome OS. Here is how I was able to solve my problem:

Apparently when you save pics to a folder in Linux/Windows the file system creates a hidden thumbnails.db file in that folder. After finding the thumbnails.db file I used vinetto to recover the pics. It was pretty straightforward once I found out about the thumbnails.db.

lioncocoz · 03-22-2017, 06:19 AM

Used Fedora to recover deleted photos from my SD card. but nothing found after a full scan. What would be the problem? thanks

Shadow_7 · 04-05-2017, 09:57 PM

photorec from testdisk might be able to find something. Although normally it handles corrupt filesystems. There was undel for dos bitd, although not seeing anything like it for dosemu.

jefro · 04-06-2017, 03:51 PM

This is getting to be a beat up old thread. Might be time to close it??

Gcwerty · 05-27-2017, 03:41 AM

Quote:

Originally Posted by lioncocoz

Used Fedora to recover deleted photos from my SD card. but nothing found after a full scan. What would be the problem? thanks

Maybe you can try scanning your memory card ,

AwesomeMachine · 05-27-2017, 10:34 AM

You could use something like this:

Code:

$ dd if=file_system | hexdump -C | grep 'ff\ d8\ ff\ e0'

which will give you the offsets of the beginning of the deleted jpg files. Then, save that section of disk:

Code:

$ dd if=file_system skip=certain_number_of_sectors count=certain_number_of_sectors of=file.file

Then search file.file with a hex editor, for the header of the first deleted jpg as above. Then search for the footer, and save that chunk to a jpg file. Then do the next one. It might be explained better in this post: http://www.linuxquestions.org/questi...ommand-362506/