Friday 7 September 2012

Recover deleted photos

In March 2007, some missionaries called around with a sad tale - they'd accidentally deleted all the photos on their memory card, could I get them back?

I quickly knocked up this short perl script to do it.

#! /usr/bin/perl
# Quick hack by Sam Liddicott: <>
# Try and look for jpeg images in a stacked file.
# Reads 512 blocks and when it finds one that starts with oxd8ff it starts a new file
# Invoke on a raw image of the card (maybe taken using rawread or rawrite) like this:
# perl < IMAGE

# or
# perl < /dev/sde

our $count=0;
our $file="/dev/null"; # use nul for dos/windows
our $buffer;

open STDOUT,'>',$file;

while (read(STDIN,$buffer,512)) {
  if ($buffer=~/^\377\330\377[^\333]/) {
    print STDERR "$file\n";
    open STDOUT,'>',$file;
  print STDOUT $buffer;

It did recover his photos.

Of course that \377\330\377 sequence was taken from /etc/magic - where else!?

No comments:

Post a Comment