[SGVLUG] Anyone with experience recovering data from flash memory (camera card)

[Michael Proctor-Smith]

On 4/10/06, Emerson, Tom <Tom.Emerson at wbconsultant.com> wrote:
> Over the weekend I took a bunch of pictures of our rocket launch
>
> At my brother-in-law's house, I was using his laptop to view the photos
> (since his laptop has a built-in memory slot that takes Fuji's "XD"
> memory...)  Of course, this meant I was using XP.
>
> At one point, moving from picture-to-picture froze up, so I pulled the
> card, closed the app, put in the card, and selected "open folder" when
> the card was detected -- all was fine.  This happened a few more times,
> then "boom" -- re-inserting the card didn't bring up the "what should I
> do with this?" box, so I manually tried to open drive E:  At this point,
> the system said, "device not formatted" -- accckkk!!! I hadn't "saved"
> them to anything more permanent (partly because it wasn't my own system,
> and partly because it is a 1gb memory stick...) so now I'm hosed!
>
> I suspect the application that was viewing things semi-slide-show like
> [with forward/back, rotate, and resize buttons...] was /writing/
> temporary files to the device, and upon hanging, "pulling the card"
> resulted in a corrupt directory or "superblock" [hence why XP thinks it
> isn't formatted]  I rather doubt the /entire/ contents of the card are
> scrambled as it is a gigabyte sized flash card (and, well, even flash
> memory takes a while to write...)

> *I hope* I can mount this under linux as a raw device and use "dd" to
> copy the contents of the flash card to a file, then perhaps I can
> determine the extent of any "damage" and eventually recover "the file"
> as a mountable partition [using a loop device]  Barring that, what tools
> [dos/windows or linux based] would anyone recommend to recover the data?
>

They are probably not, you can use dd(I assume your card reader is usb
and so it will be access as sd*1 where * is the next available scsi
drive letter) to copy of the contents and fsck check the image, unless
you managed to corrupt both copies of the fat you should be fine.

> This might be a real outside chance, but does anyone else think that a
> windows "quick format" followed by an "unformat" operation would recover
> the corrupted superblock? [if, indeed, that is the problem...]  Does
> windows even support or include the "unformat" command anymore? (or
> unerase, or was that always a norton-utility program?)

I would never do the a format if I want the data that on the device.

> Likewise, if the "dd" trick works to capture viable contents of the
> memory, how much of a freshly-formatted memory stick would I have to
> write over the "corrupted" image to repair it to a point to retrieve the
> files?

I don't get what you are talking about here if you have recovered the
data I would ether reformat the memory card and copy needed stuff back
or use the same working commands on the memory card as I used on image
of the card.