An often heard complaint after using digital image recovery software, is that it shows intact previews, but recovers corrupt photos. How does this happen?
The preview is not the actual image data
To understand how this can happen we need to have closer look at the internal structures of popular image formats. The most common image formats used by digital cameras and smart-phones are RAW image files and JPEG. These two have in common that their file specifications allow for a downsized copy of the actual image data to be embedded.
This smaller copy of the image file allows software to quickly render image previews. For example, this is what typically happens when for example Windows File Explorer needs to display loads of thumbnail previews. Rather than having to process several MB of image data for each file, the small embedded preview is rendered. Even for corrupt photos an intact preview can be generated this way.
The same goes for photo recovery software
It depends on the recovery or undelete software if it renders previews from actual image data, or the low resolution preview data. For example, our undelete tool DiskTuna DFR renders JPG previews from actual image data. Thus, if it shows an intact image file, the file is really intact.
Due to the structure of for example a JPEG file, it is very well possible that a corrupt image file will render an intact preview if the embedded thumbnail is used.
 Bad sector |
 Fragmentation |
Bad sector.
In this example a sector of data was unrecoverable because the memory card containing the photo returns a read error (bad sector) at the location of the red line. As a result an image preview using the preview thumbnail shows an intact image while the actual image data is corrupt.
Only partial recovery or file fragmentation
Another common issue for corrupt image after recovery of photos is file fragmentation.
Many tools marketed a digital image or photo recovery software are so called RAW scanners or simple file carving tools. Simply put:
- they scan the memory card
- they detect the start of an image (1)
- they either detect the start of the next image or the end of an image (2).
- all data in between (1) and (2) is copied into the recovered file.
So, most photo recovery software employs the RAW file recovery method, also called file carving. A major drawback of this method is that it assumes that file data is in consecutive clusters. We’re involved in developing software that can recover those fragmented files as well.
Other reasons
But we also see this if for whatever reason only part of the file was saved or copied. This type of damage can occur when the file is initially stored or when later transferred from the camera to for example a PC.
Again, in these cases it is often possible to render an intact preview using the preview thumbnail data at the start of the digital image. Again, the previews are okay, the photos are not.
The actual thumbnail is detected
As the thumbnail that is a part of the original photo is in fact a valid JPEG file itself, the photo recovery software may detect it as a separate image.
Image file repair.
Incomplete files whether the cause is file fragmentation or other reasons leading to a premature ending of image data are often beyond repair.
If the file is corrupt due to file fragmentation it may be possible to manually glue different clusters together to get a consistent image file. To do so the you’d need the original memory card or an image file (clone) of the memory card.
To a certain extent bad sector damage is less fatal. It all depends on how much data was lost due to the bad sectors. Below are visual representations of binary data of JPEG files with various degrees of damage due to bad sectors. Typically bad data is repaired by either guessing the data based on adjacent information or by filling in the binary data by trial and error. The third image is simply too damaged for that.
 intact JPEG file |
 One bad sector |
 Multiple bad areas |