How to fix and open recovered photos?

Unfortunately it is a common problem that you are unable to open recovered photos after using file recovery, undelete or photo recovery software on a SD card. In this post I will make some assumptions:

• Photos are on a memory card and therefor:
• File system is a variation of FAT  (FAT32, exFAT)
• File type is JPEG or,
• a proprietary RAW format, such as CR2, ARW, NEF, etc..
• and up to date codecs are present on PC.

Possible causes recovered photos being corrupt

Memory cards in digital cameras use some variant of the FAT file system. FAT stands for file allocation table. This file allocation table keeps track of clusters allocated to specific files. If a file is deleted or the card is formatted this table is zeroed. However, in most cases filenames remain intact as well as the actual file contents. Filenames are no longer visible though, unless special software is used.

Recovery software that relies on file system meta data can locate the filenames, size and start position of the lost files. Carvers rely on file contents to recover files (magic bytes). An example of file recovery software that (mainly) relies on file system meta data is ReclaiMe File Recovery. PhotoRec is a free though excellent carver.

Recovered file was partially overwritten

One explanation for files being corrupt after you have recovered them is they may be (partially) overwritten. Data that is written over can not be recovered. If the file is partially okay then reconstruction and repair can be attempted using photo repair software and a photo editor.

File fragmentation

Due to the fact that the FAT is zeroed after file deletion or formatting of the memory card, nor file recovery or undelete, nor photo scavengers can determine where the different fragments for a non contiguous file are located. Such fragmented files may be simply incomplete, corrupt or mixed with other photos.

File system corruption

File recovery software that relies on detecting file system structures will not help of those structures are corrupt. I have seen many examples of corrupt recovered photos because the file recovery software relied on a corrupt file allocation table. Try a so called ‘carver’ instead.

Solutions

Better photo recovery methods

So, if files are incorrectly recovered the obvious solution is trying to recover them again, only this time right. So a likely cause for file corruption after file recovery is fragmentation. Piecing back the different fragments of a photo is easier said than done though. To do so using software, this software needs to be able to:

• Verify or validate if it has a valid photo or not
• And if not, it has to scavenge the card for matching pieces of the puzzle
• For this to be successful it needs methods to recognize if a possible match is detected. If not, the number of possible combinations would be ‘endless’.

DiskTuna offers JpegDigger and JPEG Recovery LAB for such adventures. To use JPEG Recovery LAB you need a Windows 64 bit PC with at least 8 GB of RAM. JpegDigger is much easier on the system. JPEG Recovery LAB is more powerful and advanced than JpegDigger.

They’re both ‘carvers’ which means they don’t rely on file system structures to recover photos.

File repair

If the original data is no longer available then repair can be attempted as a last resort. As I explained it remains to be seen if the the original data is available within the corrupted file(s). Due to this fact there is not just one repair strategy. Techniques I have developed can be found back in the JPEG-Repair Toolkit.

For example, if a file does not open then normally you’d attempt t repair the file header. But such an exercise will prove to be fruitless if the original image data is absent. So, experiments will have to show what works:

• Extract: I have had success with this quite often. With corrupt RAW photos it is the only thing to try as I know of no software that can actually repair RAW photo formats.Also with regards to JPEG, as file recovery software sometimes appears to dump arbitrary clusters into JPEG files, if you’re lucky it put a JPEG in there somewhere. For example, I was asked to repair this 3456 x 2304 image:
  
  I assumed that either the image contained invalid data in the JPEG bitstream (the image data) or data of the 2nd half of the image was simply missing. Indeed the 2nd half was invalid: Because it simply contained another 3456 x 2304 JPEG:
  
• Repair header (using reference file). If the recovered photo does not open at all you can first try to repair the header. If that fails but entropy is somewhere between 7.60 <> 7.98 bits/byte then I have had success by simply patching a header onto data in the corrupted file and then weeding out obvious corruption (see example. 1.jpg is original file, 4.jpg final file).
  

  Although it seems hopeless, this recovered photo was repaired (and so were multiple others using the same technique)