Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: [1] 2 3

Author Topic: Recuva'd Jpegs...Sort of!  (Read 11185 times)

renluop

  • Kitizen
  • ****
  • Posts: 3326
Recuva'd Jpegs...Sort of!
« on: June 29, 2011, 07:37:34 PM »

I recovered several jpegs with Recuva, but the headers have been corrupted; the headers do not commence with the usual hex
FF   D8   FF   E0. This is evident when I view the file headers within Recuva.

I want to edit the header information. Although I can view in Recuva, I can see no way to edit. When I save the recovered file, the hex does not seem viewable let alone editable.

Can anyone point me, lead by the hand :D, to a solution? Please!
Logged

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 43467
  • Penguins CAN fly
    • DSLstats
Re: Recuva'd Jpegs...Sort of!
« Reply #1 on: June 29, 2011, 10:40:04 PM »

What you need is a hex editor. I don't use Windows so I can't recommend a particular one, but there are plenty of free ones available.
Logged
  Eric

tonyappuk

  • Reg Member
  • ***
  • Posts: 589
Re: Recuva'd Jpegs...Sort of!
« Reply #2 on: June 29, 2011, 11:17:14 PM »

One I've used some time ago and it is still available at http://frhed.sourceforge.net/en/
Tony
Logged

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 43467
  • Penguins CAN fly
    • DSLstats
Re: Recuva'd Jpegs...Sort of!
« Reply #3 on: June 30, 2011, 07:27:53 AM »

Yes, that looks exactly the right thing.
Logged
  Eric

renluop

  • Kitizen
  • ****
  • Posts: 3326
Re: Recuva'd Jpegs...Sort of!
« Reply #4 on: July 03, 2011, 08:19:35 PM »

I have found that both signature strings and end strings are missing/incomplete. At start I need insert
"FF D8 FF E1 00 00 45 78 69 66 00" and end "FF D9". Reading Help does not  (for me that is ::)) make it clear how I do it.
Logged

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 43467
  • Penguins CAN fly
    • DSLstats
Re: Recuva'd Jpegs...Sort of!
« Reply #5 on: July 03, 2011, 10:33:28 PM »

I'm not familiar with that particular editor, but with most editors you press the Insert key once to go into insert mode, and press it a second time to return to overwrite mode.
Logged
  Eric

geep

  • Reg Member
  • ***
  • Posts: 452
    • My ST546 Statistics
Re: Recuva'd Jpegs...Sort of!
« Reply #6 on: July 03, 2011, 11:19:00 PM »

In order to add additional bytes at the beginning of the file:
1/ Start Frhed.
2/ Add the header bytes immediately into the empty screen. e.g. FF   D8   FF   E0
The cursor should be just after these characters.
3/ File > Insert file.
Select the .jpg file. It will be appended to the data you entered in 1/. (It appears in yellow).
4/ Do any other edits needed. You can append data to the end of the file.
5/ File > Save as > select your new .jpg file.

Cheers,
Peter

PS - I'm not sure your approach will work. See - http://www.fastgraph.com/help/jpeg_header_format.html

[attachment deleted by admin]
« Last Edit: July 03, 2011, 11:25:05 PM by geep »
Logged

tonyappuk

  • Reg Member
  • ***
  • Posts: 589
Re: Recuva'd Jpegs...Sort of!
« Reply #7 on: July 03, 2011, 11:29:51 PM »

renluop
It's a long time since I've used it and I'm not sure I ever attempted to insert anything just replace a faulty bit of hex code. However I have found a work around since Eric's suggestion wouldn't work for me. If you go to the end of the file you want to edit it is quite simple to type in the additional code you want to tag on. Just make sure you are not in Read Only mode (about half way down in the Edit Menu tab). Follow this with the FF D9 bytes you want to add, high-lite them with the mouse (turns yellow), cut and paste. When you select cut a box pops up, just select OK. Position the cursor at the beginning of your file and select paste . Another box pops up and select insert and OK.
Tony
Edit. Posted anyway but I see Geep beat me to it. His method is neater than mine but both will work. (for the edit, not sure if it will fix your jpeg!)
Logged

renluop

  • Kitizen
  • ****
  • Posts: 3326
Re: Recuva'd Jpegs...Sort of!
« Reply #8 on: July 06, 2011, 07:26:42 AM »

Haven't done much more about it all yet, but have found I have two files called DSCF1322 of identical size and Modified dates
 
Code: [Select]
     Created     Modified      Accessed
           14/11/09    02/07/08    05/07/11
           28/03/10    02/07/08    14/11/09
.

Very strange thing is that all the hex info in each is completely different. I just do not understand how that can happen.


Ideas, explanations? Gentle Kitzfolk. :)
Logged

broadstairs

  • Kitizen
  • ****
  • Posts: 3697
Re: Recuva'd Jpegs...Sort of!
« Reply #9 on: July 06, 2011, 07:41:33 AM »

Maybe I missed another thread when you explained how these jpegs got lost. However when I have had to recover files (not just photos) it is important to get to them before anything else is written to the disk/card. Normally when files are deleted it is the directory only which gets updated so long as you dont write any other files to the disk/card. If some files are written then some of the originally deleted files will be overwritten but not necessarily all of the files so when you recover them you may get only part of the original and part of the new file. My experience is that if any of the files are corrupt then it is more than likely that it will be totally unuseable, in the case of jpegs even if you re-write the header it is likely some or all of the rest will be garbage - you may get lucky but it is in the lap of the gods.

Stuart
Logged
ISP:Vodafone Router:Vodafone Wi-Fi hub FTTP

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 43467
  • Penguins CAN fly
    • DSLstats
Re: Recuva'd Jpegs...Sort of!
« Reply #10 on: July 06, 2011, 07:50:32 AM »

Haven't done much more about it all yet, but have found I have two files called DSCF1322 of identical size and Modified dates
 
Code: [Select]
     Created     Modified      Accessed
           14/11/09    02/07/08    05/07/11
           28/03/10    02/07/08    14/11/09
.

Very strange thing is that all the hex info in each is completely different. I just do not understand how that can happen.


Ideas, explanations? Gentle Kitzfolk. :)

Have you checked what their file extensions are? they may not be the same.
Logged
  Eric

renluop

  • Kitizen
  • ****
  • Posts: 3326
Re: Recuva'd Jpegs...Sort of!
« Reply #11 on: July 06, 2011, 09:32:48 AM »

@broadstairs. It was a case of Seniormomentitis Maxima. I thought I'd saved them to external medium before a factory reset. let's leave it there. ;).  OK, "lap of the God's", so is there one for photography? :-\. No matter what the outcome, to attempt is to educate. :D

@roseway. Properties show both as jpgs: first thing I thought of. :)
Yet if file were of different types would size be the same?
Logged

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 43467
  • Penguins CAN fly
    • DSLstats
Re: Recuva'd Jpegs...Sort of!
« Reply #12 on: July 06, 2011, 09:49:28 AM »

>> Yet if file were of different types would size be the same?

I was thinking that maybe one file was xxx.jpg and the other was xxx.jpeg or something like that. Both JPEGs but slightly different file extensions.
Logged
  Eric

broadstairs

  • Kitizen
  • ****
  • Posts: 3697
Re: Recuva'd Jpegs...Sort of!
« Reply #13 on: July 06, 2011, 09:52:23 AM »

I think the accessed date may be a clue, cameras can and do wrap or reset file numbers and so with a 2009 date it is possible that this is an old file at least part of which did not get overwritten, unusual but not impossible.

Stuart
Logged
ISP:Vodafone Router:Vodafone Wi-Fi hub FTTP

tuftedduck

  • Senior Kitizen
  • ******
  • Posts: 29658
  • Router Luvvin Duck
Re: Recuva'd Jpegs...Sort of!
« Reply #14 on: July 06, 2011, 09:55:33 AM »

It may be corrupted metadata rather than a hex error.

We need to know from where was the data recovered......was it the HDD or something like a flash card?
Logged
Pages: [1] 2 3