Recover deleted photos

In March 2007, some missionaries called around with a sad tale - they'd accidentally deleted all the photos on their memory card, could I get them back?

I quickly knocked up this short perl script to do it.


#! /usr/bin/perl
# Quick hack by Sam Liddicott: <sam@liddicott.com> www.liddicott.com/~sam
# Try and look for jpeg images in a stacked file.
# Reads 512 blocks and when it finds one that starts with oxd8ff it starts a new file
# Invoke on a raw image of the card (maybe taken using rawread or rawrite) like this:
# perl recover.pl < IMAGE
# or
# perl recover.pl < /dev/sde

our $count=0;
our $file="/dev/null"; # use nul for dos/windows
our $buffer;

open STDOUT,'>',$file;

while (read(STDIN,$buffer,512)) {
  if ($buffer=~/^\377\330\377[^\333]/) {
    close(STDOUT);
    $count++;
    $file=sprintf("img_%03d.jpg",$count);
    print STDERR "$file\n";
    open STDOUT,'>',$file;
  }
  print STDOUT $buffer;
}

It did recover his photos.

Of course that \377\330\377 sequence was taken from /etc/magic - where else!?