Kitz Forum
Computer Software => General software => Topic started by: renluop on June 29, 2011, 07:37:34 PM
-
I recovered several jpegs with Recuva, but the headers have been corrupted; the headers do not commence with the usual hex
FF D8 FF E0. This is evident when I view the file headers within Recuva.
I want to edit the header information. Although I can view in Recuva, I can see no way to edit. When I save the recovered file, the hex does not seem viewable let alone editable.
Can anyone point me, lead by the hand :D, to a solution? Please!
-
What you need is a hex editor. I don't use Windows so I can't recommend a particular one, but there are plenty of free ones available.
-
One I've used some time ago and it is still available at http://frhed.sourceforge.net/en/
Tony
-
Yes, that looks exactly the right thing.
-
I have found that both signature strings and end strings are missing/incomplete. At start I need insert
"FF D8 FF E1 00 00 45 78 69 66 00" and end "FF D9". Reading Help does not (for me that is ::)) make it clear how I do it.
-
I'm not familiar with that particular editor, but with most editors you press the Insert key once to go into insert mode, and press it a second time to return to overwrite mode.
-
In order to add additional bytes at the beginning of the file:
1/ Start Frhed.
2/ Add the header bytes immediately into the empty screen. e.g. FF D8 FF E0
The cursor should be just after these characters.
3/ File > Insert file.
Select the .jpg file. It will be appended to the data you entered in 1/. (It appears in yellow).
4/ Do any other edits needed. You can append data to the end of the file.
5/ File > Save as > select your new .jpg file.
Cheers,
Peter
PS - I'm not sure your approach will work. See - http://www.fastgraph.com/help/jpeg_header_format.html
[attachment deleted by admin]
-
renluop
It's a long time since I've used it and I'm not sure I ever attempted to insert anything just replace a faulty bit of hex code. However I have found a work around since Eric's suggestion wouldn't work for me. If you go to the end of the file you want to edit it is quite simple to type in the additional code you want to tag on. Just make sure you are not in Read Only mode (about half way down in the Edit Menu tab). Follow this with the FF D9 bytes you want to add, high-lite them with the mouse (turns yellow), cut and paste. When you select cut a box pops up, just select OK. Position the cursor at the beginning of your file and select paste . Another box pops up and select insert and OK.
Tony
Edit. Posted anyway but I see Geep beat me to it. His method is neater than mine but both will work. (for the edit, not sure if it will fix your jpeg!)
-
Haven't done much more about it all yet, but have found I have two files called DSCF1322 of identical size and Modified dates
Created Modified Accessed
14/11/09 02/07/08 05/07/11
28/03/10 02/07/08 14/11/09.
Very strange thing is that all the hex info in each is completely different. I just do not understand how that can happen.
Ideas, explanations? Gentle Kitzfolk. :)
-
Maybe I missed another thread when you explained how these jpegs got lost. However when I have had to recover files (not just photos) it is important to get to them before anything else is written to the disk/card. Normally when files are deleted it is the directory only which gets updated so long as you dont write any other files to the disk/card. If some files are written then some of the originally deleted files will be overwritten but not necessarily all of the files so when you recover them you may get only part of the original and part of the new file. My experience is that if any of the files are corrupt then it is more than likely that it will be totally unuseable, in the case of jpegs even if you re-write the header it is likely some or all of the rest will be garbage - you may get lucky but it is in the lap of the gods.
Stuart
-
Haven't done much more about it all yet, but have found I have two files called DSCF1322 of identical size and Modified dates
Created Modified Accessed
14/11/09 02/07/08 05/07/11
28/03/10 02/07/08 14/11/09.
Very strange thing is that all the hex info in each is completely different. I just do not understand how that can happen.
Ideas, explanations? Gentle Kitzfolk. :)
Have you checked what their file extensions are? they may not be the same.
-
@broadstairs. It was a case of Seniormomentitis Maxima. I thought I'd saved them to external medium before a factory reset. let's leave it there. ;). OK, "lap of the God's", so is there one for photography? :-\. No matter what the outcome, to attempt is to educate. :D
@roseway. Properties show both as jpgs: first thing I thought of. :)
Yet if file were of different types would size be the same?
-
>> Yet if file were of different types would size be the same?
I was thinking that maybe one file was xxx.jpg and the other was xxx.jpeg or something like that. Both JPEGs but slightly different file extensions.
-
I think the accessed date may be a clue, cameras can and do wrap or reset file numbers and so with a 2009 date it is possible that this is an old file at least part of which did not get overwritten, unusual but not impossible.
Stuart
-
It may be corrupted metadata rather than a hex error.
We need to know from where was the data recovered......was it the HDD or something like a flash card?
-
HDD/HDDs
Incidentally Recuva has not unearthed some of my earlier pics, some taken with the Finepix and some with an old Olympus. All were sorted in to subject group folders. Is REcuva the best freeware app to use?
-
Now here's a bit of a conundrum, leastwise for me! :D
A number of the recovered pictures do not display in full, part being grayed out. Yet when I go to delete, the thumbnail accompanying the 'do you want to..' dialogue box shows the complete picture.
Can anyone suggest why this anomaly should be, and if it may give some indication of a way to recover the whole picture file?
-
Maybe the images have embedded thumbnails. This is a bit of an issue with images on the net, because some photoediting programs keep an unmodified version of the image as a thumbnail, so information which was removed from the image may still be recoverable.
-
recoverable.
but is usable in any practical sense to get a reasonable image, and how?
-
recoverable.
but is usable in any practical sense to get a reasonable image, and how?
No, it's not useful for recovering the full resolution image, but I just mentioned it because it could be a security risk.
-
Found a jpg file analysis program most of which I do not understand. Plenty of errors reported but widh one very interesting comment about data found beyond end of file. AFAICS the additional data is as long as the true.
[attachment deleted by admin]
-
I am no nearer to understanding where the images came from, but I do have a suggestion which may explain their corrupted display.
I do regular back-ups of all my data onto both my internal slave drive and an external drive.
The first time I did this, I received a warning message pop-up to the effect ( I cannot recall the exact wording) that there were "hidden files associated with these image files and that if I failed to copy these files along with the images then data would be lost".
So, in Windows Explorer, I went tools>folder options>view and checked the box "show hidden files and folders"........and there was revealed in each folder a little file named "thumbs data file"
With that unhidden, I could copy my data across without problem and they now all display correctly on both my K drive and my external drive.
Perhaps you need to do the same when recovering deleted images....meaning unhide that "thumbs data file" so that it can be detected along with the image data ?
As you have already recovered the image files and changed their location, it may be too late to recover the "thumbs data file" which may be by now disassociated from the relevant images, but it may be a useful exercise to re-delete the images, show the hidden files and then try to recover them again. A very long shot.......it probably won't work now, but as you don't want the images you have nothing to lose.
-
I am no nearer to understanding where the images came from, but I do have a suggestion which may explain their corrupted display.
The majority were taken on one of our cameras, accidentally wiped directly or from emptying recycle bin.
but as you don't want the images you have nothing to lose.
Not quite true, unless you refer to the foreigners from unknown cameras,some few are wanted.
-
@tuftedduck
Are you saying that the thumbs will appear along with the jpgs once the recovery program is run?
-
They should do if they had been found and recovered along with the images........but I think that to find the two together, you would have to have had the thims data files "unhidden".
Having found the image files without the thumbs data file ( because they were hidden ) and having moved the image files, the links between the images and the thumbs file will have been broken.
So probably too late now to re-link them....unless you can put the images back into the precise location where you first found the, and then try to recover the images and thethumbs data together.
-
I would have expected the thumbnail images to be embedded in the main .jpg image files, so I suspect that the thumbs data file is an index maintained by Photoshop, rather than the actual thumbnail data.
-
No, it is a Windows file........... Windows creates a file called Thumbs.db for folders that contain pictures. The Thumbs.db (.DB) file caches a thumbnail version of the pictures in the folder, making it quicker to view the thumbnail images each time the folder is opened.
-
I stand corrected. :)
-
So thumbs.db files do not need any other app than my photo editing prog to open them?
-
You cannot open the thumbs.db file........but I do believe that they are required to be present in order to open and display the images correctly.
-
See http://www.forensicswiki.org/wiki/Thumbs.db for info about possibilities to look inside Thumbs.db files.
Also http://en.wikipedia.org/wiki/Windows_thumbnail_cache .
Cheers,
Peter
Added - I just tried vinetto which is mentioned on the above links. Picked a Thumbs.db at random and to my amazement it recovered 11 thumbnails. As they are so small - 65x96 - I'm not sure what use they are, but still...
This software also claims to display Thumbs.db file http://www.mitec.cz/wfa.html
-
vinetto: wiki mentions that a python environment is needed. What on earth is that? Perhaps it crushes the info out. ;D
WFA: has anyone actually succeeded in loading files from a db cache?
-
vinetto: wiki mentions that a python environment is needed. What on earth is that? Perhaps it crushes the info out. ;D
WFA: has anyone actually succeeded in loading files from a db cache?
Python is a programming language, and presumably vinetto uses it. It's available free for Windows - see http://www.python.org/download/windows/ for example.
-
WFA: has anyone actually succeeded in loading files from a db cache?
Yes.
Cheers,
Peter
PS - The file only contains thumbnails of images, not the original images themselves.
[attachment deleted by admin]