Recovering lost JPEGs on hard drive

[Industrial One]

I have no idea how this happened but I lost a whole folder of
important irreplaceable pics. This happened a few weeks before on
another folder in my My Pictures directory but luckily I had a backup
on the VM copy. I don't remember ever consciously deleting them. A
search for the files on Windows turns up nothing, but it also says my
index isn't completely updated for all drives so it's really
complicated.

I have a backup of maybe 10% of the pics in that folder in seperate
RARs that I sent to friends and forgot about, and I searched the
entire drive with a hex editor for any trace of a hex string in one of
the pics and it found multiple instances, all on free space that
hasn't been overwritten yet. I can recover them this way even if it'll
take forever but I have no idea how many bytes to select after the
recognizable header, since all MFT records seem to be gone. How do I
know how many KB a JPG is? Richter?

Anyone got brighter ideas?

[Paul in Houston TX]

I have not used this but it has been previously
recommended on the photo ng's that I read:
http://www.cgsecurity.org/wiki/PhotoRec

I have this one on my 7 machine. It works well:
http://www.piriform.com/recuva

[Paul]

There's this. But no guarantees on what it can find. While I did a simple
minded test (erase a single picture, and search) and it found the picture just
fine, it's hard to say what would be left, due to overwrites in the last
few weeks.

http://www.cgsecurity.org/wiki/PhotoRec

There are probably commercial versions of programs like that too,
depending on your budget.

Don't write the results, onto the same partition. Continue to treat
the partition in question as "read-only" until you're finished.

When the scavenging operation is completed (you've tried a few programs
like that and nothing new is showing up), you can run CHKDSK and see
if anything ends up in "FOUND.000" folder. I have a folder like that,
created from unlinked stuff on my hard drive. If there is file system
damage, that's one way for stuff to disappear. CHKDSK may notice
some unlinked material, and re-link it into FOUND.000 at the
top level, but without proper file names.

Paul

[glee]

"Industrial One" <industr...@hotmail.com> wrote in message
news:95c72c46-b630-48f0...@a11g2000yqb.googlegroups.com...

I've had good results recovering pictures and other files from hard
drives and flash drives, using the freeware Restoration:
http://aumha.org/freeware/freeware.php#restore

Here's a direct link to the download:
http://aumha.org/downloads/restoration.exe

--
Glen Ventura
MS MVP Oct. 2002 - Sept. 2009
CompTIA A+

[james...@gmail.com]

if your lost photos haven't been overwritten, then you can recover those photos with 3rd party data recovery software. For more information http://www.camerarecovery.org/

[Robert Macy]

On Sep 2, 8:54 pm, "glee" <gle...@spamindspring.com> wrote:
> "Industrial One" <industrial_...@hotmail.com> wrote in message

Seem to only get the WinXP version 193KB? The write up talks about
Win98 version that's 406KB, but can't seem to find that anywhere. Or,
are they the same now?

[Industrial One]

Thanks for all the suggestions, people. But note that even though they (at least the one I searched the disk for) haven't been overwritten, MFT records have been lost so I have no idea what the filesize would be for each one, otherwise I could've easily recovered them with the same hex editor. I don't know when the pictures disappeared but it could've been up to 3 weeks ago as that was the last time I did anything with the folder, which was moving the pack to "My Pictures" from the desktop of my old partition, to organize stuff a bit better.

I used xxcopy to copy from old partition to here to protect timestamps, then I deleted the folder on the old partition. That's all I remember doing.

Is it possible a system restore operation (which I did a few times on this partition) could've deleted the newly copied JPEGs? If so, could I find the JPEGs inside the system_volume_info folder? I see no JPG inside here, just DLLs and stuff.

Right now I'm still running iolo SM's search and recover using the deep search method which has been running for 12 hours and is at 60%. If this completes and fails to turn up the photos, I'll use your suggestions.

[Paul]

Download is LHA compressed. 197,233 bytes

I don't like running .exe files, even from trusted sites, so I found an
old copy of "lha.exe" to use, to extract the files. It's possible
I got it from CTMC package, eons ago.

Rename the original file, so it's 8.3 conformant. (That LHA program
is pretty old.) Then

lha e restor.exe

That gives four files.

06/04/2002 02:53 PM 8,127 README.TXT
06/04/2002 02:59 PM 204,800 RESTORAT.EXE
03/21/2002 03:20 PM 204,849 DLL32.DLL
03/31/2002 10:35 AM 6,144 DLL16.DLL

README.TXT says:

*******
[Supported OS]
Windows 95/98/Me/NT/2000/XP

[Supported File System]
FAT12/FAT16/FAT32/NTFS
Compressed files of NTFS are supported.
However, encrypted files of NTFS are not supported so far.
*******

Presumably, the two DLLs account for the support of various OSes.

Paul

[Industrial One]

Ok, the proprietary iolo Search & Recover failed miserably. I tried photorec on the other hand and it recovered 80,000 JPG PNG BMP and RARs, most of what it recovered was deleted temporary copies of the pics, like when you open a RAR full of PNGs it has to copy to temporary folder and disappears when you close the RAR.

The lost pics of mine are 1600x1200 and they weren't found in all the rubble. That's awesome, photorec recovered every photo except the ones I lost, neat.

I'm about to do what I was gonna do since the beginning: search entire disk with a hex editor for the header CASIO COMPUTER CO.,LTD..EX-Z33 and recover them manually one by one, copying at least 2MB after the header to make sure not to miss any data. I wish this could be done automatically, but whatever it takes...

Here's the background story so everything makes sense: I was doing a migration from my 250 GB drive I to 40GB drive C which was my older but much cleaner setup on my old hard drive.

Last month I moved partition I 300 GB forward on this 2TB drive to make room for Drive C since I intended it to be the new system partition, then I cloned Drive C from old hard drive to this one on the unallocated 300GB of space at the beginning sectors.

After Drive C was my new system drive, I began moving all the files from Drive I with xxcopy to keep the timestamps including the folder with my pics that is now gone. After they were copied to this drive I deleted from Drive I.

Once I have moved most of the stuff onto here, drive I had about 20GB used space, so I defragmented and resized partition to 25GB. Wherever the lost pics are, a copy of them is somewhere in the 275GB unallocated space now, or possibly even in the 25GB of Drive I, so a chkdsk probably won't work.

In the folder that disappeared were both the RARs I received the pics in and the extracted pics, so it would actually be much simpler to locate the lost RARs, but the problem is that I forgot the filenames.

Is there some possible way to find remnants of metadata of the folder on the disk and find out the filenames for everything? I did a search for the folder name on the disk in Unicode and got a lot of results but I have no idea what to make of them.

And if I do get the name of the RAR, would it really be helpful in finding it on the disk?

Any advice on how to recover any piece of the puzzle here would be useful and appreciated.

[bestsoftw...@gmail.com]

On Monday, September 3, 2012 3:16:26 AM UTC+5:30, Industrial One wrote:

you can get back your photos again by using the Photo Recovery Software I have used it to recover the lost images from SD card and it is very efficient application for the retrieval of images lost due to any reason. I'm sure that this tool can help you in a much better way.
http://windowsdatarecovery-software.blogspot.in/