Recovered photos are corrupt

By | March 8, 2019

One of the common issues I deal with or get questions about is that recovered photos are corrupt after using file recovery or undelete software. To understand how or why this is happening we first need to address how undelete and photo recovery software works.

TL;DR: If recovered photos are corrupt you have two options:

  1. Try to repair them: This often does not work as the recovered files does not in fact contain image data. Unfortunately this is often not the case. The article explains how you can determine that using JPG-Repair. Other JPEG or photo repair software is Stellar Repair for Photo and Hetman File Repair.
  2. Try to recover them again: File fragmentation is a common cause for photos being corrupted after recovery. File and photo recovery software simply can not handle fragmentation on memory cards (FAT32 or exFAT formatted media). Solution is to recover the files again using software such as JPEG Recovery LAB that can reconstruct intact photos from separate fragments.

How file and photo recovery software works

There are two strategies for recovering deleted and lost files (and photos are just files):

  1. Recover files based on file system structures. We’ll take the FAT32 file system as example because it is used on many memory cards as used in digital cameras. File recovery software will scan for directory entries. If the directory entry for the lost or deleted photo is found, the software can determine the filename + the start cluster + file size + and some other file attributes such as creation data etc.. This method works for any file type (so also ZIP, DOC, HTML etc.). To correctly recover a file it is assumed the file is stored in contiguous clusters and the start of the volume + clusters size is known (to calculate actual cluster location of file contents)
  2. Recover files based on ‘magic bytes’ or signature. This also called a RAW scan. Photo recovery software often works like this, but also generic file recovery software often includes a ‘deep scan’ which will scan for magic bytes. Many file types have some identifiable bytes close to the start of the file. By looking for those file recovery software can determine the start location of (possible) files. For example JPEG file can be identified by searching the the byte sequence ‘FF D8 FF’ at sector or cluster boundaries. Also, last two bytes of a JPEG are ‘FF D9’. By saving everything from FF D8 FF – FF D9 we can theoretically recover a JPEG file. Other method to determine the end of a file are, start signature for new file is encountered or user has to set an arbitrary maximum file size.

The problems:

  1. File recovery software employing either of the two methods have no definitive way of telling that what they are recovering are in fact valid files. In general you will always end up with a number of recovered files that can not be opened.
  2. If file recovery software employing method 1 gets any of the file system parameters (such as cluster size) wrong it will be unable to recover intact files.
  3. Files that were not stored in continuous blocks of clusters/sectors (fragmented files) will be corrupt due to being only partially recovered or part of the recovered file’s content has nothing to do with JPEG data.
  4. File signatures are not exclusive to specific files. Software that detected a FF D8 FF signature and starts recovering a JPEG file, may run into a FF D9 byte pair that just happens to be there by random chance. It will assume it reached the end of the JPEG file, while in reality it hasn’t.

This list is not complete, but is meant to illustrate that there are many reasons that can explain why recovered photos are corrupt.

Symptoms if recovered photos are corrupt.

There are basically two sets of symptoms that tell you a recovered photo is corrupted or damaged.

  1. Photos refuse to open in any photo viewer you try.
  2. Photos can be opened but don’t look okay.

If photos don’t open at all (the photo viewer of choice reports a problem with the file, or displays an error message) then it is safe to assume at least the header of the file is corrupt.

If you can open the photo, incorrectly recovered files may simply be missing part of the image, display a gray block as place holder for non existing data, may be a combination of different images, or it looks distorted with corrupt colors and shift.

It is note worthy that even though the photo is corrupted, the preview (in Windows File Explorer for example) may look okay! This can be explained by the fact that a photo may contain an embedded small version of the photo that can be used by software to display a small preview (thumbnail) without having to decode the entire photo.

A corrupted recovered photo may still show an intact preview or thumbnail

A corrupted recovered photo may still show an intact preview or thumbnail

Recovered photos are corrupt, what are my options?

In my experience many people will start searching the internet for options to repair corrupted files. If you however look at the reasons for this corruption you’ll understand this is the wrong approach. File repair or photo repair software more specifically will never be able to repair what is not there. It can not repair a JPEG photo only based on the simple fact that a file is called ‘MY-AWESOME-PHOTO.JPG’ if the file in fact does not contain your awesome photo due to it being incorrectly recovered.

So, since you were probably searching for JPEG or photo repair software, let’s explore that option first.

Repair of photos damaged after recovery using JPEG or photo repair software

For the sake of completeness I will point to alternative photo repair software, but for the examples below I will be using my own JPG-Repair Toolkit. Links are downloads, tested & safe.

  • Stellar Repair for Photo (previously Stellar JPEG Repair) is very easy to use. To repair photos, simply ‘import’ them end click repair. It will try to repair the photos and extract thumbnails. If it can not repair the image it will offer advanced repair using a sample file. A sample file is an intact photo shot with the same camera and settings.
  • Hetman File Repair is another popular photo repair software that is re-branded and available under many different names (RS File repair being one).
  • There are more options (PixRecovery, Picture Doctor), but I have never been able to repair a single file with those so I will not include them here.

I will use JPG-Repair Toolkit as it offers some tools that will help you determine if the data inside the recovered file is actually JPEG data. Because if this is not the case, repair attempts are doomed to be fruitless.

To repair header corruption JPG-Repair Toolkit needs a sample file: A photo shot with the same camera + settings (resolution, quality settings). However, for diagnosing the files we can do without the sample if we simply select ‘extraction’. Extraction mode is useful anyway, I have been able to recover intact photos from photos that were corrupted after recovery. Run JPG-Repair > Select extract mode > select the file you want to examine > click repair.

The most important thing to look for is the value for entropy. If it is displayed in red the file probably has little to do with JPEG data. In a normal JPEG file, all byte values are valid and used, so the byte histogram should show bytes in the value from 0 – 255 (00-FF in hex).​

JPEG: good entropy Not JPEG: bad entropy
recovered photos are corrupt: good entropy, may be repaired recovered photos are corrupt: bad entropy, beyond repair

If a file can actually be opened but does not look right (cut off, half grey, distorted color, image shift at some point) entropy may, or may not be off:

  • Combined photos: entropy will look right, probably a result of fragmented photos.
  • Photo looks like original for the most part but there are errors in color and image shift introduced at point of corruption, entropy will be okay.
  • If image is cut-off at some point or turns into grey or solid block: entropy okay then file can probably be repaired, entropy too low then part of file is simply missing and can not be repaired.

Recovery of corrupted photos

If photos can be opened but:

  • Image is cut-off / half grey with low entropy
  • Image entropy is good but appears to be several photos combined

Then it may pay off to try recovering the files again using photo recovery software that is able to handle file fragmentation. The method used is called advanced carving and only works for formats the software knows inside-out. In other words, the software has the ability to evaluate the contents of a file, determine if it is intact and combine different fragments into one coherent image and save that as a file.

File fragmentation is a very common issue on memory cards as used in digital cameras and thus reason that recovered photos are corrupt.

JPEG Recovery LAB is an advanced carver. It must be noted that it needs a beefy PC (Windows 64 bit) with at least 8 GB RAM.

 

 

 

Leave a Reply

Your email address will not be published. Required fields are marked *