search

cgsecurity / testdisk

TestDisk & PhotoRec
https://www.cgsecurity.org/
GNU General Public License v2.0
1.55k stars 190 forks source link

PhotoRec: recovered RW2 files are broken #64

Open d4rkd3v1l opened 5 years ago

d4rkd3v1l commented 5 years ago

At first I want to thank you for that nice tool, it really saved my life by recovering a lot of photos and videos, I lost (due to my own stupidity -.-).

Unfortunately it seems like all my RW2 files are broken, despite others like CR2 or JPG just work perfectly.

Filenames are like "f15399472.rw2", so from the documentation, the "f" indicates that it's a recovered file (not "b" for broken or whatever), if I got this right.

The broken files all look something like the following screenshot, so you can basically see the photo, but just totally messed up. Screenshot 2019-05-25 at 10 28 25

According to the files list here, RW2 seems to be supported: https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

The Photos were taken with a Panasonic Lumix FZ-1000, and some with a G81 (similar to G80/85). Of course I can send/attach one or more RW2 files, if you like/need to investigate this any further. Unfortunately I could not use this tool to check the files, as they are around 20MB in size: https://www.cgsecurity.org/photorec/

Is there anything else I can do, to make this work or help you?

cgsecurity commented 5 years ago

Are you recovering your data from an harddisk or from the memory card ? What filesystem is used ? (FAT32, exFAT, NTFS, HFS+...) There is a "shift" in the image, it may be due to some extra data or missing data in the recovered file. If you disable jpg in FileOpt, do you get the same results ?

d4rkd3v1l commented 5 years ago

Actually I had a HFS+ formatted hard disk that I converted to APFS (but missed the small "data will be erased" text). I'll give the "disable jpg" option a try later, and let you know once I have results.

d4rkd3v1l commented 5 years ago

I just started a run with only "rw2" selected. Now the recovered rw2's don't look broken but take up from about 100mb to 1gb, the original files were around 20mb. Really weird.

I also tried some different tools, like Data Rescue 5, Disk Drill, these were also not able to recover those files correctly, so maybe it's just not possible?

Anyway, PhotoRec gave me the best results in recovery, so really big thanks for that!!

cgsecurity commented 5 years ago

With only cr2 selected, PhotoRec stops the recovery of a file when a new one is found. It's why you get very large file.