Fragmentation on FAT file systems and file recovery
Most memory cards in camera’s are formatted with a flavor of the FAT file system (FAT32, exFAT). A property of FAT file system is that after deletion or formatting the card, non contiguous or fragmented files can not be recovered in one piece. This is due to the file system meta data pointing to individual clusters of a file is zeroed.
Typical symptoms are that such files are half grey or a combination of different images. If this combination of images are images with a different resolution, recovered files may look something like this:
JpegDigger can try to ‘defrag’ such files automatically but this is rather complicated so it may get it wrong:
- It correctly needs to identify the exact point where the initial fragment ends.
- It correctly needs to pick the missing piece(s).
To have JpegDigger try this, in advanced options enable the ‘Gap carving’ option.
Manually finding the missing links step by step
In case JpegDigger gets it wrong you can manually try to puzzle fragments belonging to one file together. To do so:
- DISABLE the ‘Gap carving‘ option.
- Enable the ‘Attempt file repair‘ option.
- From the file list select the file you want to reconstruct and double click the preview.
- Clusters assigned to the file are already ‘ticked’. If the bottom of the file looks ‘weird’, or corrupt remove bottom clusters until the non showing part of the image is a solid black block (see example below).
- Now it’s a matter of trial and error. Select a few clusters and click ‘Test’.
- Do additionally selected clusters look like a part of the file? If not, deselect them and try a next batch of clusters.
- If fragment looks like it belongs to the file add clusters above and below the clusters you’re testing until the picture looks complete.
- Once complete click ‘Save‘.
The number of clusters you can try is limited to the ‘scan window’ JpegDigger moves over the drive from start to end. Normally the initial fragment is close to the start of this window. The scan window is larger than the actual file, so from within this window, or area you can select clusters.
You can only select clusters within the scan window, first virtual cluster is numbered 1. So the remainder of the non contiguous file has to be within reach of the scan window. Virtual clusters are aligned to actual block size.
There is no guarantee the missing clusters are within the window or that they even exist. Clusters originally allocated to the file may have been overwritten since deletion for example. However experience (and even scientific research) suggests that IF additional fragments still exist that they are often close to the initial fragment.
Let’s see what reconstructing a fragmented file looks like:
First remove clusters from bottom of first fragment until you have a nice ‘clean cut’.
With the bottom cluster of the fragment un-ticked we get a solid black block. Garbage has been removed from the first fragment. Some times you will need to remove more than one cluster.
Now skip some clusters and then tick a few, click Test. Evaluate if clusters are part of the photo. if not, un-tick and move on. Skip 10 or 20 clusters and repeat.
This looks like a part of our photo! Now ‘grow’ the block of clusters top and bottom. At the top until it’s attached to the first fragment.
In this case I only needed to grow the top by one cluster. In other cases you may need to add more. Then move on to bottom and grow the file until the photo looks complete.
Once the file looks complete click Save to keep the file. As soon as you close the virtual cluster list and move on to the next file, JpegDigger will forget about it.