Hi Grant, * Grant <[EMAIL PROTECTED]>, 06.04.2006, 22:39:11:
> Is it possible to recover data (photos) that have been "deleted" from > a Sony Memory Stick? It depends. On what happened, what you do next, and the amount of time (or money) you are willing to invest. > How can I get a look at what is really in there? Use dd to make a backup (that is, copy the contents of the stick (the raw bits, not the files) to your harddisk, and work on that copy. You can use your favorite hex-editor (there are a bunch of them in portage) to recover the directory-structure (or what is left of it). :-) You won't have ANY success with it, if you don't understand a bit about filesystemstructure and how to use the tools you want to use. Its very likely that you will destroy data if you are not careful. There are a few things you can try, depending on your knowledge. You could use the forensic toolkit sleuthkit (and perhaps its web-frontend autopsy). For recovering photos, I have had good results by just searching for jpeg-headers (first 4 bytes, assuming you have jpeg-images, ofcourse) and simply cutting a bit more than your average filesize after the header. Result of that will depend from your usage pattern on the Memorystick, that is, if you delete all files, than make new photos, or just delete some files (which results in fragmentation, which will prevent the copy-x-kb-after-jpeg-header- approach). There are some other ways, but these are the simple ones. In any case, MAKE A BACKUP!!! before you try to recover the files. HTH. Timo PS: Message me of-list, if you need specific help. -- gentoo-user@gentoo.org mailing list
