Hello. I'm trying to figure out if it exists any software that might be a=
ble to recover fragmented images from flash memory cards / digital camera=
s if the card was quick-formatted (i.e. if the card has a zeroed out FAT)=
, or some details about the jpeg algorithm to figure out how difficult de=
velopment of such would be.
My main interest is for .jpg/.jpeg files.
In the situation when the FAT contains only zeroes, recovery of non-fragm=
ented image files seems to be easy for many (or maybe most?/all?) file / =
image /data recovery software products, but I haven't been able to find a=
ny that can recover anything more than the first fragment of the file if =
the file is fragmented.
I don't know the specifics of jpg encoding, but maybe someone here knows =
if the different parts of the image part of the jpg files are numbered in=
some way, or contains some patterns/fields that can be used to connect l=
ater fragments together with the first fragment? If not, maybe something =
like FFT/Fouier transformations/frequency analysis or something similar/e=
lse could be used to do a qualified guess about which fragments belong to=
each other and maybe present the user with some alternatives?
I guess that if image files are fragmented on a memory card, the chance i=
s pretty high that the files only has two fragments. At least this is my =
guess if the card was new or formatted before use, then used to take pict=
ures and erase some in between, and then quick-formatted afterwards. And =
if the directory entries are intact and most files are defragmented, I gu=
ess it could be possible also to do an educated guess about which cluster=
s are fragments belonging to other files. Also, comparing the starting cl=
usters from all files could indicate if the file is actually fragmented, =
if the difference between the starting cluster of file n and n+1 is less =
than the number of clusters necessary to store the file. And if the card =
was new, zero-filled or filled with a specific pattern before use, it sho=
uld be obvious if a specific cluster was in use or not before the quick-f=
ormatting. (Maybe a full formatting fills the cards with a specific patte=
rn? I haven't tried...)
Does anyone know of any software doing something like this or is anyone c=
onsidering making something like this? I'm to pressed for time to conside=
r developing something like this right now, but if someone else wants to =
look into this, I'd be more than happy to be involved in discussions arou=
nd the development if you want (though not very much since I don't have m=
uch time available). And if someone could comment on these issues, it wou=
ld be great if I or someone else should consider developing something lik=
e this.
Best regards
Tonny Iversen (tonnyi@[EMAIL PROTECTED]
)
|
