Whilst working away this morning, I received a very pitiful look. It’s that look that we all know. The “I did something terribly wrong” kind of look. This look came with the hands of a digital camera, a small compact point and shoot. A story followed the look, as the camera was handed over to me…
You’ve done it before, I know you have… I don’t know what happened, if it was me, or my daughter, but all my pictures are gone. We went to this event, and I had a lot of pictures, and now they’re all gone. Can you save them…?
Fortunately for me, I know the operation for files deletes1.
Anatomy of a File Delete Operation
What a lot of people seem to believe is when a file is deleted, the actual data is erased from the disk. This isn’t actually true in most cases. Really what happens behind the scene is the pointer that tells your operating system where the file is, is removed, or marked as “available”. Essentially the index, that tells your computer where the file is, is removed. Imagine taking whiteout to the index page in a reference book and removing information from there. Now if you were to read every page in the reference book, you’d still find the data, but there is no “quick find” to get there.
How The Day was saved
First… Have a backup, you should have backups2, but in this case, the pictures hadn’t even been taken off the camera, so chances of the person making a backup was slim, even though I knew it was likely to be slim even after it was off the camera3.
That’s my backup rant out the way (again), now onto the fix-it. Fortunately the camera used a storage card, so I popped it out, and put it into my card reader4. I then downloaded a copy of Recuva. This is freeware, but it’s not the only one, there are quite literally hundreds of different applications5. Not only is it not the only one, but most of the big name flash card manufacturers have their own software6. Once Recuva was opened, you point it to the flash card, tell it to scan, and in about 2 seconds, it’d finished reading the data on the card. Unlike normal file access, this actually reads the bites on the card, rather than relying on the storage card to tell us about. Once finished, you select the files you want recovered, and click the recovery button… Tada, all saved! 300+ pictures in fact, several dating back to Christmas.
How it works…
The JPG format is fairly easy to scan for. There are certain markers in the file that define the start of the image, various bits of data about it (known as the EXIF data, which includes things like date taken, camera used etc), the actual image data, and an end of image marker7. When the file recovery applications scan, they look for these markers, and based on the markers they find, they should be able to identify if they can recover the image or not. When it does the recovery steps, it reads all the bytes, from start to end, and writes to a new location. This lets the operating system handle all the usual fun stuff like those indexes/references, and you have your file back.
Caveats
Now there are caveats to this whole process.
First, it assumes you didn’t use a special delete program to remove the file, like Eraser, which does more than deletes the links, it goes back and writes random “stuff” over where the data actually was.
Second, it assumes the system writing to the disk/memory/flash prefers completely blank space, over the space that just had data. Most platforms prefer this because it causes less file fragmentation.
Lastly, this should always be considered your last resort. It’s easy for parts of the file to become overwritten because of other writes on the disk/memory/flash. So as soon as you’ve realized you deleted it, get to work recovering it, don’t wait until next week.
And really, finally… Backup, backup, backup. Did I remember to tell you to backup? No? Okay, go backup. Think it’s too hard? Go read my post on Home Backups, and spend $50/year and get somebody else to do it. I’m sure those memories of little Timmy’s first steps are worth it, or that winning hit at the Texas Rangers game that gets published in the news is worth it.
-
At least how it stands on most file systems. ↩
-
I’m always telling people to make backups of their home machines. ↩
-
No, I don’t consider you uploading your pictures to Facebook a backup. ↩
-
Good thing too, because this Sony camera had one funky connector that I didn’t have a cable for. ↩
-
Don’t believe me? Google for ‘freeware file recovery’. ↩
-
Check their website for details, they usually have it buried somewhere on there ↩
-
If you want to learn more about JPEGs, you should read this article. ↩