JPEG Recovery using Piriform Recuva

By | September 20, 2017

Recently I was offered a batch of corrupt JPEGs for repair that were recovered from a SD card using Piriform’s Recuva. The recovered files were not recognized by any image viewer as valid JPG files.

File system scan

By default Recuva performs a file system scan to discover deleted files. In most cases this means that Recuva will scan for FAT directory entries. Using the directory entry Recuva can determine the filename, the size and the start cluster for the file. To recover the file it creates a new file, it jumps to the start cluster, and will copy the number of bytes as indicated by file size to the new file. Apart from a simple check for a JPEG ‘magic number’ it has no way of determining whether the copied data is actually a valid JPEG file.

Recuva’s Deep scan

Alternatively you can have Recuva perform a RAW scan, In Recuva this is the ‘Deep Scan’. If you need to recover JPEGs that were deleted or lost due to accidental format, I suggest you use this Deep Scan option. Rather than scanning the SD card for file system structures, Recuva will scan for JPEG signatures or magic numbers to locate lost files.

Advantage is that it is more likely that recovered files will be recognized by image viewers as valid JPEG files. It will also detect files that aren’t pointed to by the file system at all.

You can enable Deep Scan using both the wizard and the advanced scan.

Enable deep scan in Recuva advanced mode

Click options > Actions > Enable Deep Scan

Enable recuva's Deep Scan

Enable recuva’s Deep Scan. Limit your search to ‘pictures’.

Have Recuva scan for pictures only

Using the non wizard mode you can also limit the scan to pictures

General limitations of JPEG file recovery

Regardless the method (file system scan or RAW scan), and regardless the file recovery utility you use, often fragmented files can not be recovered intact.

The first factor is the FAT based file system that is commonly used on SD cards. If a file was lost due to formatting or deletion, the cluster chain recorded in the file allocation table (FAT) is zeroed. A utility that performs a file system scan therefor has to assume the file was stored in a contiguous chain of clusters.

A RAW scanner always assumes a file consists of a contiguous chain of clusters.

If a utility is able to show a preview then in general it can also recover the file. However, some utilities may use the preview section of a JPEG to display a file. As this section only represents a small part of the actual file, the rest of the file may be corrupt.

The fact that it does not display a preview, does not mean by definition that the file can not be recovered. Also, it may be able to salvage enough data for the file to be repairable after recovery.

Leave a Reply

Your email address will not be published. Required fields are marked *