One of the most frustrating things after file recovery is to discover your files are corrupt.
Corruption can be caused by a few different things, IF we assume the software didn’t make errors like guessing the wrong file system.
- Parts of the file were overwritten after deletion. Overwritten data can not be recovered.
- File occupied one or more bad sectors. Part of the data of the file is simply missing.
- File was fragmented. The software was unable to determine all the fragments for a file.
The first two you can do nothing about. However if a fragmented file was not recovered correctly there may be something you can do. This is specially true of you are trying to recover digital photos or video from memory cards!
A key factor on deciding which software to use is the file system (FAT or NTFS). As a rule of thumb you can assume that the file system on a Windows hard disk is NTFS. The file system on memory cards is a FAT file system (FAT32, exFAT).
What is a fragmented file?
A fragmented file is a file that is not stored as one contiguous block of clusters. This is normally not an issue as the file system keeps rack of which clusters are allocated to any specific file.
In this example the green file and the purple file are not stored in one piece.
Different file systems use different methods to track which clusters belong to which files. Dominant file systems for Windows systems are FAT and NTFS. By FAT I mean all variants of the file system like FAT32 and exFAT.
In general Windows will use NTFS for hard disks. For small media like memory cards FAT is used. Typical devices in which you find memory cards such as video and photo cameras, smart phones, Action cams like the GoPro and dash cams, ‘know’ and use the FAT file system.
It is very common that the file system on such memory cards is fragmented. On photo only cards it is estimated that in general 10-20% of the file is fragmented. On cards containing both photos and videos the degree of fragmentation will be considerably higher due to how videos are stored!
So if a large part of recovered files from a mixed memory card is corrupt after recovery, fragmentation is a very likely cause.
When it comes to recovery of fragmented files the file system is a key factor in picking the right software for the job:
- When a file is lost or deleted from NTFS, it is still possible to determine which clusters were allocated to a file, even if it’s not a contiguous file.
- As soon as a file is deleted from a FAT file system the information that keeps track of clusters for that file is zeroed.
Different software for different media
Recovering fragmented files from NTFS (hard disks)
Since we can track all clusters for a file even after it was deleted or lost due to formatting, the best approach for recovering files from a hard disk is using generic file recovery software like ReclaiMe.
Using the MFT entry for a file the software can determine the filename, file attributes, it’s parent (folder) and the run-lists that keep track of all clusters allocated to the file.
Recovery of fragmented files from memory cards (FAT32, exFAT)
As soon as files are lost due to deletion or formatting a memory card, all information regarding which clusters were allocated to what file is lost. This means that generic file recovery or undelete software is unable to recover non-contiguous files intact.
As the file system does not give the means to determine which clusters belong to specific files, we will need to be looking at the files themselves. For many file types it is possible to determine the start and end of a file using headers and footers. Example: JPEG files start with bytes ‘FF D8‘ while the last two bytes read ‘FF D9‘. So a simple way to recover a JPEG file without using the info available in the file system is, to copy those bytes and everything in between the header and footer and save that to ‘file0001.jpg’. And indeed this method will work for contiguous files, and it is how the bulk of photo recovery software works. It is called file carving.
But it still doesn’t help us recovering fragmented files. If we look at the example of the fragmented files, this is what we would recover using header/footer ‘carving’.
Recovering fragmented photos and videos requires a more advanced approach. The software should be able to ‘view’ files so to speak.
By ‘viewing’ or validating files the software can tell that a specific combination of clusters results in a corrupt file or not. By trying different combinations it can recover intact files. This is how JPEG Recovery LAB works.
The larger the drive, the larger the amount of possible combinations. So, this is why this best works on memory cards, but it will still take considerably longer than undelete type or header/footer carving type recovery.
However, if you’re facing corrupt files after trying to recover them using generic file recovery or simpler photo recovery software you may want to give JPEG Recovery LAB a go.
Using file validation, JPEG Recovery LAB can determine if a file is contiguous, fragmented or plain corrupt.
Conclusion
Due to file system properties and media file system are typically used on, the type of software used to recover fragmented files plays a vital role. In general, on NTFS formatted hard disks use generic file recovery software. Examples are ReclaiMe or Stellar Data Recovery.
For recovering photo and video from a memory card you can first try photo recovery software such as the software from Stellar. If the results aren’t satisfactory because a large portion of the files is corrupt, try a more advanced solution like JPEG Recovery LAB.