How to UNDELETE erased photos

"Oh, no! I was browsing photos on my camera and accidentally pressed «delete» key on my most important photo! How do I get it out again?"

No panic. The photo is still there; photo space gets overwritten only if you shoot another photo or video.

Look at the filename of the last photo you have shot: say it's P1130009. This means that you will be unerasing P1130008 (or some preceding number). If you just erased the latest photo, then you will begin from P1130010.

Switch off the camera. Memory cards (secure digital, compact flash, etc) are tipically formatted in MSDOS/VFAT filesystem.

Fetch your card and place it in your comfortable multimedia reader (USB or PCMCIA or dedicated port, no difference) in your Linux box.

It will be mounted, say, as /dev/hde1 - and you will be ready to explore it:
cd /tmp
dd if=/dev/hde1 of=tmpfile
mount -t vfat -o ro,loop tmpfile /mnt

That ro means "read-only": you will be able to explore the filesystem looking for the most recent directory. Let's assume you have a Panasonic camera: you will find some DCIM folder in the main directory (maybe some MISC, PRIVATE, TRASHES, and so on), and some 111_PANA, 112_PANA, etc folders inside DCIM (111-112-etc are related to that P111-P112-etc in the filename).

You will be able to guess the erased photo looking at the contents of the non-erased ones. Say you found that your precious erased photos were P1130005.JPG and P1130002.JPG: now you can undelete them (DOS is not case-sensitive, so you can use lowercase filenames):
umount /mnt
fsck.msdos -v -r -u /dcim/113_pana/p1130005.jpg tmpfile
fsck.msdos -v -r -u /dcim/113_pana/p1130002.jpg tmpfile
mount -t vfat -o ro,loop tmpfile /mnt

The fsck.msdos (or msdos.fsck or dosfsck on other systems) is part of MS/DOS compatibility packages, generally installed by default on most Linux distributions.

Answer "y" when fsck.msdos asks to perform changes.

Now the photos are undeleted (on the tmpfile mounted as a directory, not on the memory card: you would have to copy the file again on the block device, but don't try to do it if you do not know exactly how to do and why and when and etc etc).

You can copy them from the /mnt subdirectories to your hard disk.

P-H-E-W!!!

No need to buy some undelete/filerecover software...!


Sguardo particolarmente famelico!

send e-mail