Photo recovery software: Intact previews, but corrupt photos

By | March 8, 2017

An often heard complaint after using photo recovery software, is that it shows intact previews, but recovers corrupt photos. How does this happen?

The preview is not the actual image data

To understand how this can happen we need to have closer look at the internal structures of popular image formats. The most common image formats used by digital cameras and smart-phones are RAW image files and JPEG. These two have in common that their file specifications allow for a downsized copy of the actual image data to be embedded.

This smaller copy of the image file allows software to quickly render image previews. For example, this is what typically happens when for example Windows File Explorer needs to  display loads of thumbnail previews. Rather than having to process several MB of image data for each file, the small embedded preview is rendered.

The same goes for photo recovery software

It depends on the recovery or undelete software if it renders previews from actual image data, or the low resolution preview data. For example, our undelete tool DiskTuna DFR renders JPG previews from actual image data. Thus, if it shows an intact image file, the file is really intact.

Due to the structure of for example a JPEG file, it is very well possible that a corrupt image file will render an intact preview if the embedded thumbnail is used.

Bad sectors, Intact previews, but corrupt photos

Bad sector

Fragmentation, Intact previews, but corrupt photos

Fragmentation

Bad sector.

In this example a sector of data was unrecoverable because the memory card containing the photo returns a read error (bad sector) at the location of the red line. As a result an image preview using the preview thumbnail shows an intact image while the actual image data is corrupt.

Only partial recovery or file fragmentation

Another common issue for corrupt image after recovery of photos is file fragmentation. Most photo recovery software employs the RAW file recovery method, also called file carving. A major drawback of this method is that it assumes that file data is in consecutive clusters.

But we also see this if for whatever reason only part of the file was saved or copied. This type of damage can occur when the file is initially stored or when later transferred from the camera to for example a PC.

Again, in these cases it is often possible to render an intact preview using the preview thumbnail data at the start of the digital image. Again, the previews are okay, the photos are not.

The actual thumbnail is detected

As the thumbnail that is a part of the original photo is in fact a valid JPEG file itself, the photo recovery software may detect it as a separate image.

 

Image file repair.

Incomplete files whether the cause is file fragmentation or other reasons leading to a premature ending of image data are often beyond repair.

If the file is corrupt due to file fragmentation it may be possible to manually glue different clusters together to get a consistent image file. To do so the you’d need the original memory card or an image file (clone) of the memory card.

To a certain extend bad sector damage is less fatal. It all depends on how much data was lost due to the bad sectors. Below are visual representations of binary data of JPEG files with various degrees of damage due to bad sectors. Typically bad data is repaired by either guessing the data based on adjacent information or by filling in the binary data by trial and error. The third image is simply too damaged for that.

representation binary data of intact JPEG

intact JPEG file

representation binary data of intact JPEG with ONE bad sector

One bad sector

representation binary data of intact JPEG with large parts missing due to bad sectors

Multiple bad areas

 

 

 

 

Leave a Reply

Your email address will not be published. Required fields are marked *