Probably Android phones are the most common devices to take photos with nowadays often stored on a Micro SD Card. Consequentially many lost photos will be on Android devices. Photos can be on:
- Internal memory
- (Micro) SD Card
Although many want you to believe it is easy to recover the lost or deleted photos and success is guaranteed, it often isn’t. In this post we’ll look into what’s possible and what’s not. We’ll describe how you can use JpegDigger to attempt photo recovery. JpegDigger offers some features not found in other software like:
- On the fly file repair
- Attempts to put together non contiguous JPEGs
- Entropy map which allows you tell if media contains data and data encryption.
Recovering photos from internal memory
Using a Windows PC
You can only do this from Windows and using JpegDigger if the phone can present itself as a ‘mass storage device’. Unfortunately this mode is longer available in modern Android versions. If you have an older Android version (pre 4.2) find the option to enable ‘USB Mass Storage Device’ mode. A dialog will pop up when you connect the phone to a PC using a USB cable allowing you to select this mode.
Option does not appear:
- Go to Settings -> About Phone/Tablet.
- Go to “Build Number” at the end of the Scroll list.
- Tap on “Build Number” 7 times (seven!)
- Now Developer Options will be visible in settings list where you can enable USB debugging > OK. Done.
On even older Android versions try: Menu > Setting > Applications > Development > USB debugging. Or, Settings > More > USB utilities > Connect Storage to PC.
So, idea is to get the Phone a drive letter assigned in Windows Explorer.
- Alternatively use software that is able to access the Android device in MPT mode. AFAIK the phone needs to be ‘rooted’ for this to work.
- Use Android software that runs from the device itself. For example DiskDigger (Can be found in Google Play Store). Drawback of the method is that the software will be stored on the same memory you want to recover from and may potentially overwrite the deleted data. Also, full recovery may only be achieved if the Android device it ‘rooted’.
Recover photos from a Micro SD Card
To recover data from the SD or Micro SD card, remove the card from the phone and insert in a card reader connected to a PC. Now you can now proceed as if you were scanning any drive using JpegDigger:
- Select the drive letter
- Select a maximum file size and minimum resolution, normally defaults are okay
- If you want to scan for deleted files only, check the ‘Only free space’ option.
- Click Scan
Android phones can encrypt files on the memory card!
Encryption can be per volume or individual files. These encrypted files can not be recovered. A common issue people encounter is photo recovery or generic undelete tools either put up a message stating no files are detected (entire volume is encrypted) -or- files can actually be recovered however it is impossible to view them (file content encrypted). I very often receive such files for my JPEG Repair Service, nothing I can do to repair those.
Card may be entirely empty depending on what happened to the data.
Depending on the specific smart phone there are circumstances that may wipe all data from the SD memory card. Typically photo recovery software will report ‘no files found’ or ‘no data found’.
JpegDigger calculates an entropy value for the data on the SD Card. Using this value it is possible to differentiate between absence of any data, possible photo data and encrypted data.
To Scan the (Micro) SD Card using JpegDigger and try to recover your photos:
- Download JpegDigger
- Open the archive (ZIP) and extract to a location of your choice (no setup)
- Double click JpegDigger.exe
- Select the card’s drive letter
- To automatically save files check the autosave option
- Click Scan
JpegDigger translates entropy values to a color and displays this in the form of the entropy map. Using the entropy map you can determine:
- The card contains no data or a repeating byte pattern. It means all data was erased and is beyond recovery
- The memory card (mainly) contains encrypted data which can not be recovered without the decryption key
- Bright green indicates the card contains high entropy data. JPEGs mainly consist of compressed data which results in high entropy
In case JpegDigger displays high entropy data yet no files like in the above example: Cancel the scan > Click ‘Override’ > click ‘Help me determine values > OK to accept values > Scan the card again.