Recovering Photos from a Corrupt Memory Card with PhotoRec
Almost Lost Brilliant Orange at the Nanzenji Temple, Kyoto Japan -- Copyright 2008 Jeffrey Friedl, http://regex.info/blog/
Nikon D700 + Nikkor 85mm f/1.4 — 1/6400 sec, f/2.2, ISO 200 — map & image datanearby photos
Almost Lost
Brilliant Orange at the Nanzenji Temple, Kyoto Japan

I accepted an invite the other day from my friend Shimada-san to visit the Nanzen'in temple/gardens located in a sequestered back corner of the large Nanzenji temple complex. It was my first visit to that sub-temple, and I'll post more about it later, but suffice to say that it was spectacular. I took a bazillion pictures, which I found totally missing when I got home and tried to load them onto my PC. The card was corrupt and Windows hung trying to read it. Yikes!

Enjoying the Nanzen'in Gardens at the Nanzenji Temple, Kyoto Japan -- Nanzen'in (within Nanzenji) -- Copyright 2008 Jeffrey Friedl, http://regex.info/blog/
Nikon D700 + Nikkor 24-70mm f/2.8 @ 55 mm — 1/200 sec, f/6.3, ISO 2500 — map & image datanearby photos
Enjoying the Nanzen'in Gardens
at the Nanzenji Temple, Kyoto Japan

It's the first time I've had a problem like this in the 10+ years I've been shooting digital, so I finally had to pay attention to the image-recovery talk that often comes up in online photography forums.

I recovered all the photos... the pictures on this post are from among them.

In the hope that it might prove useful to someone, I'll recount how I did it. Having run into the problem on my Windows XP box, I decided to try the recovery on my Mac.

I used the most-excellent PhotoRec software to recover the files. It's a command-line program that can run on many different operating systems (DOS, Windows, Linux, Mac OS X, FreeBSD...), so I did the recovery within a Mac Terminal window.

First, I mounted the damaged card, and used the df command to see its raw device name:


% df
Filesystem              512-blocks      Used   Avail Capacity  Mounted on
/dev/disk0s2             155367520 148986336 5869184    96%    /
devfs                          208       208       0   100%    /dev
<volfs>                       1024      1024       0   100%    /.vol
/dev/disk1s1               7536512       704 7535808     0%    /Volumes/NIKON D700

The details of what you see would be different on your system, but the important thing here is to be able to identify the line with the memory card (in my example, the last line), and to then identify the “raw device name” at the start of that line. The raw device name will always start with “/dev/” and in my example, it's “/dev/disk1s1”.

(If there's a way to connect a memory card without OSX mounting it, I'd like to know, because that would be safer.)

You then need to tell OS X to pretend that the memory card is no longer mounted while actually leaving it physically connected to the computer. Thus, without disconnecting it, run the following (using the raw device name you find in the first step):


% sudo umount /dev/disk1s1

You'll have to be an administrator, and will have to enter your password.

Now, run photorec. The Mac version is in the “darwin” subfolder of the download folder, so after changing directories to the download folder, here's what I ran (again, you'll want to change the raw device name to whatever you found):


% darwin/photorec /dev/disk1s1
PhotoRec 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

PhotoRec is free software, and comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
Disk /dev/disk1s1 - 8152 MB / 7775 MiB (RO)

[Proceed ]  [  Quit  ]

Note: Some disks won't appear unless you're root user.
Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.

I made sure that the raw device name was highlighted, then pressed enter. It'll progress through a few more screens where you tell it that the card has an Intel/PC partition-table type, that you want to do the “whole disk”, that the filesystem is “Other”, and where you want to save whatever files it can recover. (I had just created a “found” folder on my Desktop, and used that.)

Make sure, of course, that you have at least enough free space on the disk as the size of the card.

PhotoRec took about two hours to process My Transcend 8GB “300×” compact-flash card, and recovered all the pictures from the day, and hundreds of random other shots going back more than a month. I reformat the card each time I go out, but that just marks the disk's table of contents as empty, without actually clearing out any data, so the data for random old pictures remained on the card for PhotoRec to find.

Nanzenji -- Kyoto, Japan -- Copyright 2008 Jeffrey Friedl, http://regex.info/blog/
Nikon D700 + Nikkor 24-70mm f/2.8 @ 70 mm — 1/200 sec, f/6.3, ISO 220 — map & image datanearby photos

PhotoRec does not recover the original filename with a recovered file, so whatever images it finds have names filled with apparently random numbers, like “f1535616.jpg”. If your digital-photo workflow involves renaming images based on, say, the image-capture date and time, you don't care what the in-camera filename was, but my workflow keeps the in-camera filename, so i wanted to rename the files to what they would have been.

I used this magic incantation, which requires exiftool:


exiftool -q -p 'mv ${filename} JF7_00${filenumber}.NEF;'  *.nef  | sh

I don't know about other kinds of cameras, but Nikon SLRs include in the image file a “FileNumber” bit of metadata that tells what number was used in the in-camera filename. I use exiftool to reference that number, insert it into the pattern for the kind of filename I want, then combine that with a file-rename command.

Spiffy.

It's probably overkill, but I then used the built-in Mac “Disk Utility” to zero-fill the entire memory card, then re-formatted it in my camera. Good as new.

Nanzenji -- Kyoto, Japan -- Copyright 2008 Jeffrey Friedl, http://regex.info/blog/
Nikon D700 + Nikkor 24-70mm f/2.8 @ 70 mm — 1/250 sec, f/6.3, ISO 200 — map & image datanearby photos

The pictures I recovered are nice, but it's not like I couldn't have just walked down there again today to take most of them. I'm happy to have recovered them, but I'm most happy about having this experience under my belt, so that these techniques will be at my disposal should I ever be faced with the loss of important pictures.

In thanks for making this experience possible, I sent €25 to the guy who wrote PhotoRec, Christophe Grenier. Thanks, Christophe!


All 8 comments so far, oldest first...

I’ve used PhotoRec in the past and its a good bit of kit. I wonder with cards getting bigger and bigger how many more images could be lost when one fails.

Kevin

Although cards are getting bigger, the answer to how many can be lost remains the same: all —Jeffrey

— comment by Kevin Mullins Photography on December 4th, 2008 at 7:28am JST (9 years ago) comment permalink

Cards are cheap. Trash the one that gave your trouble… it is NOT as good as new. Something caused it to fail, and since you didn’t see the camera do anything suspicious, you have no idea what caused the problem. It’s like when a removable hard drive acts up… unless you can trace the problem to something you did (like the utterly retarded “must eject before unplugging” requirement on Macs because they don’t realize a device is removable in the first place), trust in that device becomes very limited. You can probably get a replacement card from the manufacturer just for the price of postage… but don’t trust that card anymore.

I think Windows did it. We’ll see. By the way, “removable” doesn’t necessarily mean “can yank out at any time without ill effects”. Windows takes a tact that lowers efficiency but reduces the window for corruption if the media is disconnected while in use. OSX takes the position that you’re smart enough to know when you’re going to remove it, and so reduces the chance for corruption to zero if you can follow the simple “eject before disconnect” instructions, and as a byproduct, write efficiency is greatly enhanced. With Windows, too, you’re supposed to tell it that you’re about ready to disconnect the media, but few people do. If you don’t, there’s a chance of corruption, but Windows won’t tell you or warn you or encourage safe behavior. OSX does. That seems prudent, not retarded, to me. —Jeffrey

— comment by Unbound on December 4th, 2008 at 12:59pm JST (9 years ago) comment permalink

I recently bought five Transcend 8MB SD cards, and one of them conked out on me after taking four pictures. I’m happy it did it so soon, rather than waiting until I had something important on it. I’ve been so busy that I have yet to get in touch with Transcend about having it replaced.

Anyway, I have to say there are problems with how Windows handles ejecting. My computer has a built in card reader, and if I use the eject command with anything plugged into it the whole thing is ejected, forcing me to reboot if I want to use it again. Obviously this is no use at all, because I often have more than one card to check.

But I have to agree with Unbound about the memory card. Regardless of how or why it went wrong, trust in that particular card has taken a hit. For me, that is unacceptable, and I wouldn’t want to take pictures using that card, even if I still mostly trusted it. It comes down to this: cards are cheap, and easily replaced; pictures are often priceless, and irreplaceable.

— comment by Thorf on December 5th, 2008 at 11:50am JST (9 years ago) comment permalink

Zero filling a “flash” type device really doesn’t do much but shorten the lifespan of every block of the device by one write which is why generally, the cameras only overwrite the allocation table on the disk. Add to that fact that some less intelligent flash drivers are continually updating the allocation table with every write to the device and you could potentially be shortening the lifespan of the device by a great deal. It’s important to note here that flash devices are usually “erased” in blocks. When erased, the whole block is set to 1. For this reason, the raw data on a erased flash device will read 0xFFFFFFFF.

More often than not, the block on the device that holds the allocation table is the block(s) to go bad as it’s constantly written and re-written. Especially since the whole block(s) that hold the table must be read, erased and then completely re-written. Therefore, good flash drivers will make all the changes they need to the data section of the disk, then re-write the allocation table once. This is why pulling a card out of the Windows machine when it’s not “ejected” can have problems. The data has been written, but the allocation table hasn’t been updated completely. To be fair, the Mac does this too but they at least warn you about it.

At the end of the day, most flash devices have a >100,000 write count lifespan per block, so unless you plan to use the device for years, you’re probably never going to have a problem.

You’re comments on card life are helpful, but you’re missing the point of zero-filling: it’s truly erasing whatever data might have been on the card. Out of curiosity, I ran photorec on all my cards, and found images well over a year old (on a card that sees 20,000 images a year). I zerofilled them all just to feel tidy, but in my case it was probably a waste of time and resources, but if you ever take “sensitive” pictures and want them truly removed from the card, you’d do well to zerofill the card, or perhaps blend it. —Jeffrey

— comment by Mark on December 11th, 2008 at 3:09am JST (8 years, 11 months ago) comment permalink

I was thinking of trying Photorec, as I accidently deleted and trashed my photos on my laptop after dragging to my external harddrvie. And yes, they deleted and trashed from my ext. harddrive as well. What are the chances of me recovering what I lost?
This software doesnt look to easy to do. Looks like its DOS. I lost probably 1,000 pics. Needless to say, I was not happy.
Appreciate your input. I have been still using my laptop, not knowing it would overwrite things.
Thank-you, Linda

It’s not “DOS”, it’s “command line”, which perhaps feels the same, but in any case, it works very well if you can figure it out. The PhotoRec site has links to step-by-step instructions and such. Well worth giving it a try. —Jeffrey

— comment by Linda on December 30th, 2008 at 11:00pm JST (8 years, 11 months ago) comment permalink

this worked like an absolute charm. cheers mate.

— comment by Critter on May 17th, 2009 at 9:42am JST (8 years, 6 months ago) comment permalink

Hello, I am a PC user and although I have looked at the programs website, I still don’t understand how you do this if your card isn’t recognized by your computer or camera, as you said yours wasn’t. My card died while takig pix at my sisters high school graduation, so I can’t just take them again. I got an error in the middle of graduation so put in another card and was going to deal with it later. It’s now been a few days of searching high and low with no results. I stumbled across your blog and it seems promising, but my card is not showing up in my USB reader nor the built in reader. I am desparate – these are irreplaceable. Any info would be greatly appreciated! Thanks!!!

You should probably send a note to the PhotoRec guy, but in my case the card was recognized by my system… I it was just corrupt, so I couldn’t access it further (via the normal methods). There are plenty of things you can try (such as working out a deal to send the card to someone with more experience), but if you’ve completely run out of options, you could simply do a QUICK format in the computer, then mount it on your system, then run PhotoRec or the like. A QUICK format does not touch most of the data on the card, only the table of contents (so to speak). You might also look (first) into buying a new card that comes with photo-recovery software. Some of the upper-end cards used to. Good luck! —Jeffrey

— comment by Rachelle on May 31st, 2010 at 3:58am JST (7 years, 6 months ago) comment permalink

feeling so much happy after recovering my pictures thanks dear for sharing this information God bless you…………………….

— comment by Bugs Buny on September 2nd, 2013 at 5:25am JST (4 years, 3 months ago) comment permalink
Leave a comment...


All comments are invisible to others until Jeffrey approves them.

Please mention what part of the world you're writing from, if you don't mind. It's always interesting to see where people are visiting from.


You can use basic HTML; be sure to close tags properly.

Subscribe without commenting