Paypal

07/06/2006 à 23h25 : PhotoRec, the magic tool

This week-end, one computer at home almost died.
It had a disk with a huge FAT32 partition, storing many data such as holidays photos and videos.
For an unknown reason it was not possible to access many folders and files, while we were still able to view most of the directory structures.
As during my previous crash, I installed this disk on my Linux box, and started building an image of this disk in case it goes worse.
dd if=/dev/hdd3 of=big.img conv=noerror,notrunc,sync bs=512
First good news, the hardware was safe, the crash was not due to a broken disk, but just some data was corrupted on it.
Since the first computer is running Windows, this is not a big surprise ;)
I could guess the hardware was ok because the copy was very quick and did not raise any input/output error.
First I tried the fsck.vfat tool, but the tool kept looping in a broken directory, finding thousands of files with stranges names which never existed...
Then I tried TestDisk without success too : the partitions were not broken.
So we have a disk which still works (hardware) but with a broken fat table and many files not accessible on it.
Here comes PhotoRec, this tool is awesome.
The basic idea is : the data is somewhere on the disk, and since files are usually not fragmented, it is going to scan the whole disk (sector by sector) and recognize "known headers" to recover files.
So you end up with unamed folders filled with unamed files, but at least unlike "scandisk" or "fsck" recovered files, you have an extension (.jpg, .avi, etc).
Now the big work has to begin, sort all this files (most of them were photos).
Here another tool was very helpfull : exiftags.
Since all photos were taken with digital cameras storing date/time of the picture, it was easy to rename the files and sort them by date.
I wrote the following ugly script, but it worked:
find photorec | egrep jpg$ | while read i
do
  date=`exiftags $i 2> /dev/null | fgrep 'Image Created' | cut -f3
- -d' ' | sed s/':'//g | sed s/' '/-/g`
  file=`echo $i | cut -f3 -d/`
  mv -v "$i" sorted/"$date-$file"
done
I suppose there are already command line tools for mass renaming based on exif tags...
So before you have anonymous names like this:
f35806.jpg
f35807.jpg
f35808.jpg
f8612.jpg
f8613.jpg
And after you have something nicer:
20031207-141309-f35806.jpg
20031207-141314-f35807.jpg
20031207-141320-f35808.jpg
20040608-194705-f8612.jpg
20040608-194732-f8613.jpg
This tool (PhotoRec) saved our data, and this is great :)

Commentaires

Pseudo :
Site : (facultatif)
Email : (facultatif, pour votre avatar)
Message :
(pas de HTML)
: (recopiez le texte)
Se souvenir de mes informations