Wednesday, September 05, 2007

The idiots guide to digital camera data recovery

I guess two idiot's guides as blogs does say something about me, but in helping others like me, I am willing to bear dents to my self-esteem. I am in India for a month. In fact its almost the end of the trip and I am leaving day after. I really enjoyed the month - did see most of my friends in Bangalore, went on a wonderful trip to Indore and am having a swell time with my family here in Mumbai.

It was during the trip to Indore that the series of events took place that has led me to write this. My parents and me (my sis was busy preparing for her trip to Glasgow) had planned a trip to Indore, Madhya Pradesh for 4 days and it was during the second day that we all went to a place called Mandu near Indore which had a lot of forts and other ancient buildings - remnants from the 15th century. On the way to Mandu from Indore was also a beautiful canyon which we some time taking in and this was followed by visits to two famous forts. Well long story short, I filled up the 1GB SD card in my father's new Canon A570 IS. This happened at the last fort we were seeing and it was then that I thought, quite innocently, of exploring the menu system of the digital camera. I am not sure why I did it or how I ended up at the dialog in the digital camera. But it was simple - "Format card. OK - Cancel". I am telling you quite frankly, there is no other dialog more emotion invoking than this - and I am sure lots of people will agree on this.
Be that, your pen drive, your SD card, your floppy disk or even your hard disk, there would be this moment in a huge lot of people's lives where they would want to turn back time for the millisecond that it takes to accidentally press that OK button and then stare stupidly at anothe dialog with a parched mouth and a bottomless stomach. For people who are Lord of the Ring fans, maybe you could relate it to the feeling that Frodo would have got when he put on the ring and saw the eye of the Dark Lord. A feeling of doom and of immense pain/frustration in store.
But I didn't lose hope. I am a computer science grad student :-D. I know about file systems and have recovered deleted files before (after the above mentioned doomy feeling) successfully. The formatting had taken a blink of an eye and one GB data cannot be lost for ever in the blink of an eye (some may disagree :-D). Besides, I saw that there was a low level format option. For anyone who has read up till now and who has broken all new records in idiocy by accidentally doing a low level format (I am not even sure how you can accidentally do a low level format), stop reading now and start seeking counsel. So my hopes rose. I told my father feeling like a 6 year old having done something really needing a spanking and with a wretched feeling of having let him down (that too goes with the feelings of a 6 year old - I am too sure of myself now - guess I shouldn't have said that - people who are sure of themselves needn't say they are sure of themselves - :-D) that I had formatted the card but that I would recover the photos.

So here is the process that I had to go through which you might find useful to read through:

Firstly and most importantly, if you formatted your card, you MUST make sure you don't use it again before running recovery software on it (that means DON'T TAKE ANY MORE PHOTOS!). If you urgently need to take photos before you can actually get down to recovering, then you can use a tool called DriveImage to make an image (in RAW mode) of your seemingly empty card, and continue to use the card. Then when you are done and you have transferred your new photos to wherever, run DriveImage again and choose the restore option (it will ask you for an XML file which would have been created when you had created the drive (card) image earlier - so look for it under the folder that you used to save the image) to restore the card into the state it was after you had just formatted it - or in other words, ready for running the recovery software on it.

I plugged the camera into a PC with the USB cable that came with the camera - in Windows XP/Vista a camera gets detected as a camera, which is a problem - that sounds idiotic - but people who have done data recovery before would know that you really need the thing that you want data to be recovered from, as a disk drive rather than a friendly 'camera folder' in Windows Explorer. This is because most of the data recovery software initially show you the drives on your computer and ask you which drive to scan and recover data from. So there I ran into my first hurdle. I knew the solution to this - I needed a SD/MMC card reader. What you do is, you take the memory card (SD/MMC) out of your camera, plug it into a suitable SD/MMC card reader attached to your PC/laptop and the card shows up as a disk drive (removable disk drive to be precise - with a drive letter like E: and everything). Then you can go ahead and use one of those data recovery software on it.
So I had to get back to Mumbai to grab my sister's laptop which had an SD/MMC card reader in-built to try what I could to recover the photos and videos that I had taken. I recommend PC Inspector File Recovery software (google for it) for all your recovery needs (hard disk, thumb drive, SD/MMC card). Its free and very easy to use (well maybe not very - but you can follow this guide and you should be okay).

PC Inspector File Recovery

The first dialog is to choose the language - and I chose English. The second dialog gives you three options - recover deleted files, find lost data and find a lost drive. The recover deleted files option does a 'regular' scan and failed to turn up anything - you have to do a Find Lost Data scan. If you choose that, the next dialog lets you choose the drive that you want to recover data from (the dialog actually shows 2 drives for each drive on your system - just choose any). When you click the green tick mark, it leads to a dialog which lets you choose a starting cluster number and an ending cluster number of the drive/card file system. So I did that (with the minimum starting and maximum ending cluster number - that is selected by default) and clicked on the green tick mark (before you do this - do read the rest of this guide - because it probably won't work) that starts the scan and to my delight, the number of lost files found just kept increasing. It went to about 140 files and when it was done I found a lot of JPG files and a few AVI files. The JPG files are image files and AVI files are video for those who didn't know. But when I did get over my initial jubilation and relief of having recovered everything, I saw that I had ended up with a lot of images that were half good and half gray garbage and the video files wouldn't open because they were only about a megabyte in size. A point to note here is that the thumbnails for the images show up full, leading you to believe that it is some minor error in the files some where in the middle that is then decoded wrong and hence showing up as garbage when you try to view the entire file. This then led me to search for other software for data recovery from SD cards, maybe something specific for image files. Lots of them out there - but none freeware - so I still recommend PC Inspector File Recovery - as yes, I was successfully able to recover ALL the photos and videos using it.

This is how I fixed the 'cropping' of the image files and the non-playing video files:

On further examination (that is make it sound techy and scientific - it went more like glancing despondently at all those files which just somehow messed up) I saw that all the files were about 1.4MB in size. This should have triggered in my head that I am not doing something right from the very beginning, but again, this IS the idiot's guide. So I started exploring more features in PC File Inspector software. So to cut it short again, there is an option in it that lets you specify the default size for each file you recover using the 'Find Lost Data' mode. My guess to what the software does in the find lost files mode is that it scans every cluster and then identifies the headers for known file types like JPG, AVI etc, reads up till the default size specified, truncates the file to that size and shows it as recovered. The truncation is the thing that leads to the messed up files. The default size is 1.4MB and most of my image files were about 2.8MB thus leading to all files being half corrupt and the video files just not playable. So before you start the cluster scan, go to the menu bar on the top, click on Object and then Options, choose the Files tab. In the Lost files section, the Find lost files check box should be checked by default, but the default file size like I said is 1474560 bytes, which is about 1.4MB. You need to change this to the largest file size you think might be taken up by your image files. An easy way to do this is to go through previous photos taken by your camera, sort the directory listing by size and see the largest one. I chose 3MB because I took shots at 3072x2304 resolution and that comes to file sizes from 1.5 to 2.8 MB.

So after choosing 3MB as the default file size, I ran the cluster scan again and voila! all image files in all their glory! True jubilation! Now for the video files. They need to be treated different. You can just delete all the video files that you recovered with your image files (or intelligently choose only JPG files to save to disk after the cluster scan with 3MB default file size) because they also will be 3MB in size. Then you need to again choose a default file size which should be the maximum file size of the different sizes of your video files. This is trickier but you can take 1800KB for each second of video as an estimate (so a minute is about 100 MB), if you do remember approximately the length of the longest video that you shot. I chose 300MB, did a scan again, and saved only the AVI files (the JPGs found during this run will also have file sizes of 300MB :-D - so don't save them).

I did run into a glitch in Windows Vista after I had saved the video files - probably because of the wrong file sizes (some of my videos where just 15 seconds but still were 300MB in size). Explorer (explorer.exe), starts using up the entire CPU(s) and the system becomes awfully slow. So to fix that, or for those of you who want those video files in their right sizes, you can do the following:

Download virtualdub (google for it)
Open the video file
Under the video menu on the menu bar, choose direct stream copy
Under the audio menu on the menu bar, choose direct stream copy
Under the File menu on the menu bar, choose save as AVI and save it with a name you like
Voila! Right file size.

So there I had it, all the photos and videos I had taken that day all restored. I have a new found respect for the saying, "If it doesn't kill you, it makes you stronger!" :-D