Gentoo Wiki




Who doesn't know the situation?

The digital camera is always present, conserving the most beautiful moments. And then the memory card fails. But even if you cannot mount it anymore, because the FAT is destroyed, you still can bring back most of your pictures.

In this HOWTO I want to describe a way to

Note: This Howto in its initial state is also available in German at

Programs we need

Creating a dump of the drive

At first we need to mount the device to read the medium (i.e. Compact Flash or Secure Digital reader). This usually happens at boot time if the necessary kernel parameters are set. Otherwise check the USB Mass Storage for details. In case it is mounted, we refer to the device as /dev/sda1 in the following text.

Also, we need to make sure that the medium itself is not mounted, by switching off all automounters as ivman and unmounting the drive itself.

root # /etc/init.d/ivman stop
root # umount /dev/sda1

To find out whether you can talk to the device correctly and what errors the disk has, you can try running dosfsck from the package sys-fs/dosfstools on it:

root # dosfsck -n /dev/sda1

Finally, we get it all running by backing up the drive (which had 64 MB for me):

root # dd if=/dev/sda1 of=/root/fotorettung/usbdisk.img bs=512

Extracting the files

Extraction using jpg-recover

The perl script jpg-recover can do a great deal of the job for us: It searches the volume backup for typical patterns a JPEG-File has (headers, etc.) and saves all the files it finds (including corrupt files) to your hard drive. To install and run, we do the following

root # wget -O
root # chmod u+x
root # mv usbdisk.img smcard.img
root # ./

And the tool gives us (for example):

Scanning 'smcard.img' looking for pictures...
Image #1: start found, dumping to lostpic001.jpg ...
Passing byte 102400 of smcard.img ...
Passing byte 204800 of smcard.img ...
Passing byte 307200 of smcard.img ...
Passing byte 409600 of smcard.img ...
Done -- wrote ~378381 bytes to lostpic001.jpg (JPEG end @ 432142)
Image #2: start found, dumping to lostpic002.jpg ...
Passing byte 512000 of smcard.img ...
Passing byte 614400 of smcard.img ...
Passing byte 716800 of smcard.img ...
Done -- wrote ~324797 bytes to lostpic002.jpg (JPEG end @ 771774)

If we are lucky, we now have all the files we needed back. Unfortunately, the whole run on 64 MB took more than half an hour. Additional information about the tool can be found at the page of Adam Glass.

Extraction using photorec

Another, much more comprehensive tool, which does the same job, is photorec from app-admin/testdisk. With it, you cannot only recover pictures, but also audio- and video files directly from the volume image. After it is installed, you can simply type

photorec usbdisk.img

By this call, you will see a menu where at the top, you have the option to scan the Disk usbdisk.img. If you do that, you will see the drives empty partition table. By pressing Enter now, the scan starts and the program goes through all of the drive and saves what it finds in an extra recovery directory.

What is enjoyable about this tool is that it only used less than a minute in contrast to jpg-recover. You can find more information about photorec at the homepage of its creator.


The tool jpg-recover extracted the defective pictures as well as the real ones. While that might be helpful to some people, saving a lot of time on the job, photorec seems to be the clear choice to recover pictures, as it also can find other formats. Furthermore, jpg-recover did not find all versions of jpg-files, since some do not use standard headers.

100% correct are neither of the results, as a check with files md5-hashed prior to recovery showed.

Retrieved from ""

Last modified: Sun, 07 Sep 2008 03:53:00 +0000 Hits: 13,368