> > Is it possible to recover data (photos) that have been "deleted" from > > a Sony Memory Stick? > It depends. On what happened, what you do next, and the amount of time > (or money) you are willing to invest. > > How can I get a look at what is really in there? > Use dd to make a backup (that is, copy the contents of the stick (the > raw bits, not the files) to your harddisk, and work on that copy. > You can use your favorite hex-editor (there are a bunch of them in > portage) to recover the directory-structure (or what is left of it). > :-) > You won't have ANY success with it, if you don't understand a bit > about filesystemstructure and how to use the tools you want to use. > Its very likely that you will destroy data if you are not careful. > There are a few things you can try, depending on your knowledge. > > You could use the forensic toolkit sleuthkit (and perhaps its > web-frontend autopsy). For recovering photos, I have had good results > by just searching for jpeg-headers (first 4 bytes, assuming you have > jpeg-images, ofcourse) and simply cutting a bit more than your average > filesize after the header. Result of that will depend from your usage > pattern on the Memorystick, that is, if you delete all files, than > make new photos, or just delete some files (which results in > fragmentation, which will prevent the copy-x-kb-after-jpeg-header- > approach). > > There are some other ways, but these are the simple ones. > > In any case, MAKE A BACKUP!!! before you try to recover the files. > > HTH. > > Timo
Alright, thanks Timo. - Grant -- gentoo-user@gentoo.org mailing list
