Tonny Iversen wrote:
> In the situation when the FAT contains only zeroes, recovery of
> non-fragmented image files seems to be easy for many (or maybe
> most?/all?) file / image /data recovery software products, but I
> haven't been able to find any that can recover anything more than the
> first fragment of the file if the file is fragmented.
First you'll have to find out the cluster size, then the directories,
which give you the starting cluster, name and size of all the files.
With fragmented files you'll have to combine every starting cluster with
every other (not yet assigned) cluster on the medium, a very time
consuming process. Also consider erased files, which can look like valid
files, up to the point where a cluster was overwritten later. If you
miss to detect the file as deleted, you'll spend much time in trying to
find the no longer existing continuation clusters.
> I don't know the specifics of jpg encoding, but maybe someone here
> knows if the different parts of the image part of the jpg files are
> numbered in some way, or contains some patterns/fields that can be
> used to connect later fragments together with the first fragment? If
> not, maybe something like FFT/Fouier transformations/frequency
> analysis or something similar/else could be used to do a qualified
> guess about which fragments belong to each other and maybe present
> the user with some alternatives?
This requires a "map" of all clusters, containing the characteristic
information of each cluster. I made such a map already myself, for
restoring segmented text files by manually pairing the ends and begins
of the clusters. But with image data? At least you'll need an file
checker, that can determine whether a chain of clusters *might* be a
valid jpeg file.
> I guess that if image files are fragmented on a memory card, the
> chance is pretty high that the files only has two fragments. At least
> this is my guess if the card was new or formatted before use, then
> used to take pictures and erase some in between, and then
> quick-formatted afterwards. And if the directory entries are intact
> and most files are defragmented, I guess it could be possible also to
> do an educated guess about which clusters are fragments belonging to
> other files.
FAT32 allocates files strictly sequentially, until the medium is full.
You can assume that no overlapped writes occured, to multiple files at
the same time. In this case a recovery will work quite well. When files
have been erased, and the clusters have been reused later, you'll have
much more problems.
DoDi
|
