recover deleted files from memory stick Post: 88525

Sponsored Content

Operating Systems Linux recover deleted files from memory stick Post 88525 by mr_manny on Saturday 5th of November 2005 12:22:20 PM

11-05-2005

Registered User

found these OLD notes on a process I successfully used ONCE.

hope it helps,
manny

Pretty much most of the answers have been for users of Win32 operating systems, so I'll post a little note here about howto recover corrupted JPEG files from compact flash here for Linux or UNIX users.

Step 1: load the CF card as a read-only filesystem. A number of options exist. Linux, for example, supports many cameras through the usb-storage.o driver. You simpy connect the USB cable from the workstation to the camera, turn on the camera, and then try to mount the CF card as a filesystem. The usb-storage.o driver will usually use SCSI emulation and present the drive as /dev/sda1 or some number. On Linux 2.4.x kernels, look in the /var/log/messages file for a line containing "kernel: sda: sda1" or something similar.

For laptop users, one may still connect using USB on newer laptops, but more commonly, one uses a PCMCIA adaptor card for CF. These are relatively cheap - around $14 in 2002 when I bought them. The CF card slides into the PCMCIA adapter and the whole unit pops into the laptop. If audio notifications on the PCMCIA driver were enabled, one should hear two positive "beeps". This means that the CF card should now be recognized as drive /dev/hde1 (again, see messages file for actual device name)

Step 2: Mount the filesystem read-only at first and just do a directory listing to see if Linux recognizes files that the camera or plain win32 won't see. This can be done by creating the mount point and mounting the filesystem:

# mkdir /mnt/cflash # mount -t vfab -o ro /dev/hde1 /mnt/cflash

Step 3: If the images are present and can be copied to disk, do so at this point and finish. Otherwise, we'll need to do a full filesystem dump of contents into a file and then run a jpeg extraction utility to parse and extract jpeg files for the flash image on disk. To do the dump on UNIX, use the 'dd' command.

# dd flash.img

This should produce a dump of the entire contents of the flash ram to disk file.

Step 4: The final step requires one to download a DOS utility called "jpegdump" found at http://www.goto.onlinehome.de/dsc/jpegdump.htm and then running it under the Linux Wine (Windoze Emulator) utility.

# wine -- jpegdump -recover flash.img

In the currect working directory, the jpegdump extracts out a large number of ordered JPG files. I hope this helps. And Linux rocks. The 'dd' utility combined with Wine running jpegdump in emulation works beautifully. I was able to recover all 32 MB of stored JPEGs

recovered with following:

wine -- jpegdump.exe -recover c:\dianesPICSdd.img

this created recoverred jpg files under the wine windows directory...

mr_manny

View Public Profile for mr_manny

Find all posts by mr_manny

7 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Recover deleted files

Is there a Unix tool, like in Novell, to recover accidentally deleted files?

2. AIX

recover deleted files

How to recover deleted files in AIX ?

3. Shell Programming and Scripting

Is there a way to recover files deleted using rm command???

Hi All, I just mistakingly deleted some files using rm command.Is there a way to get it back?i work on Solaris 10 Thanks, Kumar

4. UNIX for Dummies Questions & Answers

how to recover deleted files in unix

Hi Experts, by mistake i deleted some files that are very important to the project. is there any way that i can recover those files,there is no backup for that but the details of the file we know. This will be a great help. Thanks

5. Shell Programming and Scripting

Need to Recover Deleted Files

Hi, By mistake, executed the following command : rm -rf * and ALL files got deleted. But I need to get back these files as they are very very important. Please help me how to recover this file. Its Urgent for me please. Thanks in advance.

6. Red Hat

Recover deleted files from linux server machine..

Hi, I am working Linux server machine. Somebody by mistake(or may be knowingly) deleted few folders and files from the machine. How is this possible to recover those files and folders????:confused: I normally logged in through Putty and winscp only. And don't have any history for putty...

7. Linux

Recover deleted files on Linux server

Hi Guys, Greetings!. I have executed the cronjob that runs the shell script which is in directory.When the cronjob was executed , I found that the directory where the script resides has got deleted. Note: The directory was deleted with other use not root user. The...

LEARN ABOUT DEBIAN

reglookup-recover

reglookup(1)															      reglookup(1)

NAME

       reglookup-recover - Windows NT+ registry deleted data recovery tool

SYNOPSIS

       reglookup-recover [options] registry-file

DESCRIPTION

       reglookup-recover attempts to scour a Windows registry hive for deleted data structures and outputs those found in a CSV-like format.

OPTIONS

       reglookup-recover accepts the following parameters:

       -v     Verbose output.

       -h     Enables the printing of a column header row. (default)

       -H     Disables the printing of a column header row.

       -l     Display cells which could not be interpreted as valid registry structures at the end of the output.

       -L     Do not display cells which could not be interpreted as valid registry structures. This is the default behavior.

       -r     Display raw cell contents for cells which were interpreted as intact data structures. This additional output will appear on the same
	      line as the interpreted data.

       -R     Do not display raw cell contents for cells which were interpreted as intact data structures. This is the default behavior.

       registry-file
	      Required argument. Specifies the location of the registry file to read. The system registry files should be  found  under:  %System-
	      Root%/system32/config.

OUTPUT

       reglookup-recover  generates  a comma-separated values (CSV) like output and writes it to stdout. For more information on the syntax of the
       general format, see reglookup(1).

       This tool is new and the output format, particularly the included columns, may change in future	revisions.  When  this	format	stablizes,
       additional documentation will be included here.

EXAMPLES

       To dump the recoverable contents of a system registry hive:

	    reglookup-recover /mnt/win/c/WINDOWS/system32/config/system

       Extract all available unallocated data, including unparsable unallocated space and the raw data associated with parsed cells in a user-spe-
       cific registry:

	    reglookup-recover -r -l '/mnt/win/c/Documents and Settings/user/NTUSER.DAT'

BUGS

       This program has been smoke-tested against most current Windows target platforms, but a comprehensive test suite has not  yet  been  devel-
       oped.   (Please	report results to the development mailing list if you encounter any bugs. Sample registry files and/or patches are greatly
       appreciated.)

       This program is new as of RegLookup release 0.9.0 and should be considered unstable.

       For more information on registry format details	and  the  recovery  algorithm,	see:  http://sentinelchicken.com/research/registry_format/
       http://sentinelchicken.com/research/registry_recovery/

CREDITS

       This program was written by Timothy D. Morgan.

LICENSE

       Please see the file "LICENSE" included with this software distribution.

       This  program  is  distributed  in  the	hope  that  it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MER-
       CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License version 3 for more details.

SEE ALSO

       reglookup-timeline(1) reglookup-recover(1)

File Conversion Utilities					   8 March 2010 						      reglookup(1)