How to recover lost photos from a memory card (CF) - linux

This post describes a straightforward way to recover lost or deleted files from hard drives or memory cards using photorec in linux (SuSE 11.2). Photorec is one of many programs that can be used for this purpose and is available for Linux, Windows or Mac. PhotoRec ignores the filesystem and goes after the underlying data, so it'll work even if your media's filesystem is severely damaged or formatted. Experienced users should just install the program and use it.
This post describes the recovery of photos from a compact flash card.

A photo easily salvaged from the CF card

The Problem

Before the holidays I bought two 16 GB compact flash cards: one Adata (533x), which worked flawlessly; and one takeMS (120x), which failed.

The problematic compact flash card

After some photos with a Canon Rebel XTi (Canon 400D), the camera displayed something like "CF card error" and suggested replacing the card. I removed and re-inserted the card, and turned the Canon back on. The result was the apparent disappearance of all the photos (the message "NO IMAGES"). To avoid losing data the card was no longer used. I later tried to mount it on a PC but no files were found. The camera continued working fine with other cards.

The Preparation

• Installing PhotoRec
  Use YaST -> software management to search for and install package "photorec".

 

• Making a disk image (optional)
  To be on the (very) safe side, an image of the card was made. With photorec you can, in principle, bypass this step since it will never attempt to write to the drive or memory support from which lost data is recovered.
  Make a copy of the whole drive and not of a partition. Check that enough space is available to save the image file (in this case 16GB) and note that the operation can take quite a long time, depending on your drive and system (increase bs for speed, e.g. bs=64k or bs=1M). Using command dd:

  user@linux:~> sudo dd if=/dev/sdc of=takeMS_cf.img bs=512
  29818656+0 records in 29818656+0 records out 15267151872 bytes (15 GB) copied, 13988.5 s, 1.1 MB/s

  In linux once a drive has been partitioned, the partitions will be represented as numbers at the end of the drive names. To determine which device name your drive or card has you might be able to use mount. In my case the output of mount included the following line:

  /dev/sdc1 on /media/EOS_DIGITAL type vfat (rw,nosuid,nodev,uid=1000,utf8,shortname=mixed,flush)

  So the card's device name would be /dev/sdc.
  An alternative using SuSE linux is to check the hardware information in YaST->Hardware Information, check the "CF reader" in the Disk section.

  

The Recovery (step by step)

To recover the lost files just run photorec on the image or mounted drive.

user@linux:~> /usr/sbin/photorec /log takeMS_cf.img

PhotoRec leads you through a number of screens that are straightforward as shown below (see here another example).

Select the image file as media
(run the command as superuser if you did not create an image)

Select the partition table type (INTEL here)

Select here what will be searched.

In my case, searching both the single partition or the whole disk resulted in exactly the same files being recovered.
You can also change options or disable identification of some file types in this screen (which you probably do not want to do: In this example cr2 files were correctly recovered even if the extension was not exactly the one in the list: crw).

Here you are asked how the files were originally stored.

Next PhotoRec asks for a location to save the recovered files. I had created a new folder named "recover".

Press Y to confirm the location and the search starts

Snapshot during the search (includes estimated time)

The final report

In the end PhotoRec tells you how many files of each of the recognised types were recovered (although it reports tiff for cr2 files). The original names are not recovered but PhotoRec correctly recovered the correct file extensions in my photos (cr2 and jpg). Thanks PhotoRec!