Advanced carving for digital photos and video

<- Back to JPEG Recovery LAB

Advanced carving

Using a technique called advanced carving JPEG Recovery LAB is able to recover fragmented JPG, NEF, CR2, MP4, MOV, AVI photos and video files from memory cards. Where other software recovers corrupt files, JPEG Recovery LAB produces intact files.

Advanced carving allows for recovery of fragmented digital image files or photos and video. Basically 99% of the tools available for photo/video recovery fall into 2 categories:

  • Conventional undelete software
  • Header / Footer carving also known as RAW Recovery

Conventional undelete software

Undelete software scans for ‘pointers’ in the file system. Memory cards used by digital camera’s and phones typically use a FAT (file allocation table) based file system, eg. FAT32, exFAT. When a file is lost due to deletion or formatting part of the pointers for any specific file are wiped. Although the undelete software can still determine the file name, size and start location for such a file the complete list of clusters is lost. To recover a file the undelete software combines the info it has on the start position of a file and it’s size: Assume a file being 4 MB, the software will copy 4 MB worth of data, starting from the start position into a new file. If the file was contiguous (not fragmented), the recovered file is okay assuming it’s contents are not written over.

RAW Recovery

File carvers will scan the media for headers and footers. For example, all JPEG files start and end with certain hex values: ‘FF D8’ marks the start of a JPEG file, ‘FF D9’ the end. FF D8 is typically found at a sector and/or cluster boundary. FF D9 can be anywhere in a cluster/sector. By simply copying anything from the start marker to the end marker into a new file, a file can be recovered. Again, if the file was contiguous (not fragmented), the recovered file is okay assuming it’s contents are not written over.

JPEG structures

Advanced carving vs header/footer carving

JPEG Recovery LAB’s advanced carver also starts by scanning the media for headers. Once it finds an end marker, it will actually render the image in memory using the built in JPEG, CR2, NEF decoders. By doing so it is able to determine if an image file is valid or not (validation). If it is not able to render the image, the puzzling starts: it will scan the media and start combining the partial image with other image data until it is able to render a valid image. JPEG Recovery LAB applies similar techniques for video recovery.

Let’s visualize a memory card with out fragmentation:

 

 

 

 

Using simple header/footer carving (S — E) intact digital images can be recovered:

 

 

 

 

 

 

 

Now again, a memory card on which some files are fragmented:

 

 

 

 

The simple carver scans for a start marker and will dump everything from that point into a file until it encounters an end marker. As a result 4 files will be corrupt after recovery in this example.

 

 

 

 

 

 

 

Now let’s look at the results accomplished by advanced carving as used by JPEG Recovery LAB It is able to recover 5 intact files rather than two. Only one file remains corrupt as it is simply not complete:

photo and video recovery using advanced carving