Fragmentation on FAT file systems and file recovery
Video that goes with this post can be viewed here: https://youtu.be/9uGbQ6Buoac
Most memory cards in camera’s are formatted with a flavor of the FAT file system (FAT32, exFAT). A property of FAT file system is that after deletion or formatting the card, non contiguous or fragmented files can not be recovered in one piece. This is due to the file system meta data pointing to individual clusters of a file is zeroed.
Typical symptoms are that such files are half grey or a combination of different images. If this combination of images are images with a different resolution, recovered files may look something like this:
JpegDigger can try to ‘defrag’ such files automatically but this is rather complicated so it may get it wrong:
- It correctly needs to identify the exact point where the initial fragment ends.
- It correctly needs to pick the missing piece(s).
To have JpegDigger try this, in advanced options enable the ‘Gap carving’ option.
Manually finding the missing links step by step
In case JpegDigger gets it wrong you can manually try to puzzle fragments belonging to one file together. To do so:
- DISABLE the ‘Gap carving‘ option.
- Enable the ‘Attempt file repair‘ option.
- From the file list select the file you want to reconstruct and double click the preview.
- Clusters assigned to the file are already ‘ticked’. If the bottom of the file looks ‘weird’, or corrupt remove bottom clusters until the non showing part of the image is a solid black block (see example below).
- Now it’s a matter of trial and error. Select a few clusters and click ‘Test’.
- Do additionally selected clusters look like a part of the file? If not, deselect them and try a next batch of clusters.
- If fragment looks like it belongs to the file add clusters above and below the clusters you’re testing until the picture looks complete.
- Once complete click ‘Save‘.
The number of clusters you can try is limited to the ‘scan window’ JpegDigger moves over the drive from start to end. Normally the initial fragment is close to the start of this window. The scan window is larger than the actual file, so from within this window, or area you can select clusters.
There is no guarantee the missing clusters are within the window or that they even exist. Clusters originally allocated to the file may have been overwritten since deletion for example. However experience (and even scientific research) suggests that IF additional fragments still exist that they are often close to the initial fragment.