Recovering lost JPEGs on hard drive

[Industrial One]

I have no idea how this happened but I lost a whole folder of
important irreplaceable pics. This happened a few weeks before on
another folder in my My Pictures directory but luckily I had a backup
on the VM copy. I don't remember ever consciously deleting them. A
search for the files on Windows turns up nothing, but it also says my
index isn't completely updated for all drives so it's really
complicated.

I have a backup of maybe 10% of the pics in that folder in seperate
RARs that I sent to friends and forgot about, and I searched the
entire drive with a hex editor for any trace of a hex string in one of
the pics and it found multiple instances, all on free space that
hasn't been overwritten yet. I can recover them this way even if it'll
take forever but I have no idea how many bytes to select after the
recognizable header, since all MFT records seem to be gone. How do I
know how many KB a JPG is? Richter?

Anyone got brighter ideas?

 

[Paul in Houston TX]

I have no idea how this happened but I lost a whole folder of
important irreplaceable pics. This happened a few weeks before on
another folder in my My Pictures directory but luckily I had a backup
on the VM copy. I don't remember ever consciously deleting them. A
search for the files on Windows turns up nothing, but it also says my
index isn't completely updated for all drives so it's really
complicated.

I have a backup of maybe 10% of the pics in that folder in seperate
RARs that I sent to friends and forgot about, and I searched the
entire drive with a hex editor for any trace of a hex string in one of
the pics and it found multiple instances, all on free space that
hasn't been overwritten yet. I can recover them this way even if it'll
take forever but I have no idea how many bytes to select after the
recognizable header, since all MFT records seem to be gone. How do I
know how many KB a JPG is? Richter?

Anyone got brighter ideas?

I have not used this but it has been previously
recommended on the photo ng's that I read:
http://www.cgsecurity.org/wiki/PhotoRec

I have this one on my 7 machine. It works well:
http://www.piriform.com/recuva

 

[Paul]

I have no idea how this happened but I lost a whole folder of
important irreplaceable pics. This happened a few weeks before on
another folder in my My Pictures directory but luckily I had a backup
on the VM copy. I don't remember ever consciously deleting them. A
search for the files on Windows turns up nothing, but it also says my
index isn't completely updated for all drives so it's really
complicated.

I have a backup of maybe 10% of the pics in that folder in seperate
RARs that I sent to friends and forgot about, and I searched the
entire drive with a hex editor for any trace of a hex string in one of
the pics and it found multiple instances, all on free space that
hasn't been overwritten yet. I can recover them this way even if it'll
take forever but I have no idea how many bytes to select after the
recognizable header, since all MFT records seem to be gone. How do I
know how many KB a JPG is? Richter?

Anyone got brighter ideas?

There's this. But no guarantees on what it can find. While I did a simple
minded test (erase a single picture, and search) and it found the picture just
fine, it's hard to say what would be left, due to overwrites in the last
few weeks.

http://www.cgsecurity.org/wiki/PhotoRec

There are probably commercial versions of programs like that too,
depending on your budget.

Don't write the results, onto the same partition. Continue to treat
the partition in question as "read-only" until you're finished.

When the scavenging operation is completed (you've tried a few programs
like that and nothing new is showing up), you can run CHKDSK and see
if anything ends up in "FOUND.000" folder. I have a folder like that,
created from unlinked stuff on my hard drive. If there is file system
damage, that's one way for stuff to disappear. CHKDSK may notice
some unlinked material, and re-link it into FOUND.000 at the
top level, but without proper file names.

Paul

 

[glee]

I have no idea how this happened but I lost a whole folder of
important irreplaceable pics. This happened a few weeks before on
another folder in my My Pictures directory but luckily I had a backup
on the VM copy. I don't remember ever consciously deleting them. A
search for the files on Windows turns up nothing, but it also says my
index isn't completely updated for all drives so it's really
complicated.

I have a backup of maybe 10% of the pics in that folder in seperate
RARs that I sent to friends and forgot about, and I searched the
entire drive with a hex editor for any trace of a hex string in one of
the pics and it found multiple instances, all on free space that
hasn't been overwritten yet. I can recover them this way even if it'll
take forever but I have no idea how many bytes to select after the
recognizable header, since all MFT records seem to be gone. How do I
know how many KB a JPG is? Richter?

Anyone got brighter ideas?

I've had good results recovering pictures and other files from hard
drives and flash drives, using the freeware Restoration:
http://aumha.org/freeware/freeware.php#restore

Here's a direct link to the download:
http://aumha.org/downloads/restoration.exe

 

[Robert Macy]

I've had good results recovering pictures and other files from hard
drives and flash drives, using the freeware Restoration:http://aumha.org/freeware/freeware.php#restore

Here's a direct link to the download:http://aumha.org/downloads/restoration.exe

Seem to only get the WinXP version 193KB? The write up talks about
Win98 version that's 406KB, but can't seem to find that anywhere. Or,
are they the same now?

 

[Paul]

Seem to only get the WinXP version 193KB? The write up talks about
Win98 version that's 406KB, but can't seem to find that anywhere. Or,
are they the same now?

Download is LHA compressed. 197,233 bytes

I don't like running .exe files, even from trusted sites, so I found an
old copy of "lha.exe" to use, to extract the files. It's possible
I got it from CTMC package, eons ago.

Rename the original file, so it's 8.3 conformant. (That LHA program
is pretty old.) Then

lha e restor.exe

That gives four files.

06/04/2002 02:53 PM 8,127 README.TXT
06/04/2002 02:59 PM 204,800 RESTORAT.EXE
03/21/2002 03:20 PM 204,849 DLL32.DLL
03/31/2002 10:35 AM 6,144 DLL16.DLL

README.TXT says:

*******
[Supported OS]
Windows 95/98/Me/NT/2000/XP

[Supported File System]
FAT12/FAT16/FAT32/NTFS
Compressed files of NTFS are supported.
However, encrypted files of NTFS are not supported so far.
*******

Presumably, the two DLLs account for the support of various OSes.

Paul