Recovering accidentally deleted photos using Linux

I suppose it happened almost everybody to have some digital photo accidentally deleted from a memory card. It happened to me some days ago, after a power failure, I discovered the photos I was moving from the camera already had disappeared from the memory card but never had been saved on the hard disk.

The undelete process

The memory card, fortunately, did no suffer any damage during the power failure. Following instructions on this Ubuntu community documentation page I installed foremost:

sudo apt-get install foremost

then I executed it

sudo foremost -i /dev/sdc1 -o /recovery/foremost

“/dev/sdc1” is the card reader device .

The program extracted all previously deleted in the output directory all neatly separated, by file type, in different folders.

More the 15 000 photos?

Since I was only looking for photos I changed the folder “jpg” owner

sudo chown -R maxx:maxx output/

and started exploring it. When you recover deleted files you already expect finding files you don’t remember of but I was really stunned when I found that more than 15000 jpeg photos had been recovered! Examining recovered photos I discovered that most of them where small 640×480 photos this leaded me to think that such pictures are created and automatically deleted by the camera while recording movies. Still I had the problem to sort out the pictures I was looking for without having to peek at 15000 thumbnails. Sorting them by size would obviously be the best solution but even the good Gnome file manager seems to have some problem with such numbers …

Good old find command

The best thing of Linux is that where the graphical environment fails the shell don’t. After looking a little in the ‘net (especially here and there) and reading a little find command man pages I managed to sort out pictures larger than 1MB and move then in another folder with a single command

find . -type f -size +1024k -exec mv {} /home/maxx/recovery/ \;

Links

• Data recovery using Ubuntu