Anatomy of a Hard Drive

Anatomy of a Hard Drive

Why did my Hard Drive Fail?

Why did my Hard Drive Fail?

A-Z of Data Recovery

A-Z of Data Recovery

Send Us a Drive

Send Us Your Drive

Data Recovery Guides

Data Recovery Guide

Data Recovery Guide Volumn 2

Data Recovery of Photos

The .JPEG photo format is the most widely adopted image compression standard in use today. It is the default format as used by most digital cameras and camera phones. It enjoys this popularity because it offers a good quality-to-compression ratio and only requires low processing power.

We perform data recovery of .JPEG photos as well as the following raw image formats:

  • RAW
  • CR2 (Canon)
  • 3FR (Hasselblad)
  • NEF (Nikon)
  • NRW (Nikon)
  • PEF (Pentax)
  • ORF (Olympus)
  • RAF (Fuji)
  • RWL (Leica)
  • RW2 (Panasonic / Lumix)
  • SR2 (Sony)
  • SRW (Samsung)
  • X3F (Sigma)

We perform photo recovery from 1.8", 2.5", 3.5" Hard Drives, External Drives, NAS drives, CF & SD cards, USB Memory Drives and directly from failed Laptops and Macbooks.

Mini Case Study - Recovery of Lost Wedding Photos and Round-the-World Trip Photos

We got a call from a client who had experienced drive failure of his LaCie 3.5" external hard drive. When using the drive he had noticed it was getting slower and slower to access. One day, he connected it to his computer and to his dismay his drive did not appear on his Windows operating system. This was his back-up drive, after all, and he held the belief that backup drives don't fail! He then connected it to another computer, but this time the operating system just froze. He brought it to a friend who works in the I.T. sector to have a look. His friend tried a few tricks but eventually proclaimed the drive was "dead". The client had recently been to a family members' wedding and being the keen photographer of the family had taken a substantial amount of photos. Also, stored on his backup drive were holiday photos going back nearly 7 years, including photos of a round-the-world trip.

On the recommendation of his friend, he brought the drive to us. We performed diagnostics on it. When the LaCie enclosure was opened, a 1TB Seagate Barracuda S-ATA drive was found. Our media tests revealed that heads number 0,1 and 2 had failed. We phoned the client with a price. Once he had given us the green light to proceed - we commenced work. Our first task was to find replica heads that matched his failed drive exactly. If you use non-matching drive heads for a recovery procedure you risk damaging the drive platters. We got these from a supplier in the Netherlands within 4 days. Our technicians then brought his drive to our Class-100 clean room to perform a head-stack replacement. This is an intricate job. The replacement head stack must be aligned in the exact position of the old one, otherwise the heads will be off kilter and the data will remain inaccessible. But with years of experience and using proprietary tools our technicians replaced the heads. Once fitted, the servo-adaptive data had to be adjusted so the heads would calibrate perfectly with the platters. The drive was powered up and spun back into life. The heads synched perfectly with the platters. But, our job was not over yet. Even with the head-stack replaced, nothing can be left to chance with a repaired hard drive. We then proceeded to image the drive. This means making a byte-for-byte copy of the drive so the logical repair (if any) and data extraction phase will complete successfully. The imaging process took approximately 22 hours to complete. In this case, there was very little logical repair needed on the drive. Once finished, data extraction could begin. The delighted customer was handed back his wedding and holiday photos on a brand new 1TB external drive. Photos he thought we would never see again.

Data Recovery - Strategies for Successful Recovery of .JPEG files.

The data recovery strategy used to recover your lost photos will be determined by the type of damage incurred to your storage medium. This damage can be physical (e.g. electronic issues with the PCB) or logical (e.g. a corrupted file system on a hard drive). In certain cases, the damage incurred will be both physical and logical. For example, a hard drive with bad sectors (physical) has a high probability of also having a corrupt file system (logical).

Physical Repair of Storage Device (e.g. hard drive, USB drive)

Some storage devices will have to be physically repaired before data recovery can begin. For example, a drive that is making a clicking sound is likely to have failed drive heads. These will have to be replaced before any photos can be recovered. A drive that has incurred power surge damage will probably also need physical repair to it's PCB as a precursory step to recover photos.

Likewise, a USB drive that is not being recognised by a computer will possibly need physical intervention as well. For example, if a USB drive controller fails, the NAND (memory) chip will have to be removed from the devices PCB (printed circuit board) and inserted into a specialised NAND programmer device for recovery.

Logical Repair of File System

The file system (such as NTFS, FAT, HFS) will sometimes need reconstruction before data recovery of photos can begin. For example, in an NTFS file system, the MFT records (which act like a table of contents for your drive) will have to be reconstructed or repaired. This enables the data recovery technician to find out which sectors on your drive contain clusters of .JPEG files.

The File Carving Process for .JPEG files

In certain cases, even after physical or logical repair, the file system will still be degraded to a level where the images or photos on the drive are still inaccessible. But even at this stage, the chances of a partial or full data recovery are not completely scuppered. A process known as file carving can be used. This is the process of reconstructing computer files from file fragments without using file system metadata.

In the context of data recovery of photos, all .JPEG files will start with FFD8 and end with FFD9.The data recovery technician will search the storage device for locations of these headers and footers. This can be performed manually using binary data editors or using specialised forensic software which employs file carving algorithms to search for .JPEG format files. This technique can be very successful in recovery .JPEG files that are not fragmented into many clusters and those clusters are not place far from each other. However, if the headers of .JPEG files are stored in non-contiguous patterns (i.e. the image files are heavily fragmented) across the drive, the chances of data recovery can be greatly diminished.

Figure i - a .Jpeg image suffering from severe fragmentation.

Figure ii - .Jpeg image restored to its original format.

Frequently Asked Questions about Recovery of Photos

I downloaded some NEF images from my Nikon camera using Nikon Transfer 1 . Now they appear to be corrupted. What can I do?

This is a known problem with the Nikon Image Transfer 1 application. Thankfully,

there is a fix for this specific problem available to download at:

http://owl.phy.queensu.ca/~phil/exiftool/fix_corrupted_nef.html

I have run a data recovery program on a hard drive that was accidentally deleted with a Windows OS installation DVD, I have got some of the files back but most of the photos appear to be corrupted?

This is because .JPEG files have a very high rate of fragmentation i.e. they tend to get spread out over the disk instead of all being clustered together. Most consumer-level data recovery programs usually cannot this process these fragments successfully. A lot of these programs work by searching for old file table records and corresponding files clusters. Recovery might still be possible but by using manual file carving or forensic-level tools.

I have used a program downloaded from the interest to recover my photos but they are all just appearing as corrupt?

DIY data recovery program are very limited in what they can achieve. For successful recovery, it is often necessary to manually reconstruct file systems on a storage device.

I downloaded a program from the internet to recovery my files but it does not even recognise my drive where all my photos are stored.

This can be a sign that there are electronic or other physical problems wrong with your drive. Most software recovery applications cannot fix electronic or physical problems.