Recovering Fragmented JPEGs, small warning!

The following page was true when written - however, recent developments in cameras, and the larger size of JPEGs means that the routine no longer has good results.  It is in the queue for major development.

***********

Using Raw Image recovery, at times, even on memory chips the original file will be fragmented and so will not be recovered as a full file. However, CnW are working on various routines to recover such files.  Although not always successful, they can often produce valid jpeg files that would otherwise be lost, and on camera memory chips the results can be very pleasing. The change will be an otherwise partial photo that will be completed.  The picture on the left is typical of a partial fragmented one.  When the remaining fragments are added. the complete (pre storm) photo is recovered

This process is often called data carving which can cover a complete range of capabilities.  Simple data carving will generate the photo on the left, which is the standard Image Raw feature of CnW.  The advanced data carving to handle fragmented photos goes much further to ensure when ever possible a good match between fragments.  CnW also has, as part of the forensic options, an option for manual data carving.

Camera memory chips can get fragmented when individual photos are deleted.  The space they occupied is then filled with new photos, which are typically all different sizes. Thus one new photo may not fit in the gap left by a previous one, and so the image will be saved in multiple locations.

On a working memory chip, if the files are recovered, the log will indicate the number of fragments that a photo occupies.  A value of 1 is a single fragment, but 2 or more shows that the file is stored in multiple sequences.

To enable the option, on the Image Raw Options screen select the Process Fragments check box.  Once the disk has been examined for good files, the program will attempt to merge fragments of jpegs to produce good images.  This is a slow process so be prepared to wait.  For a camera memory chip, it proceeds faster if the program is working from a disk image file of the memory chip, as many camera chips are actually very slow reading.

Does this always work - unfortunately the answer is no.  Sometimes this will be because fragments of the file have been overwritten, making recovery impossible.  Other times the file may be too fragmented, and the current routine only looks forward on the disk for missing fragments.  This routine will be developed so that success rate and speed will increase, but no system will ever be able to promise 100% success.  The task is liking doing a jigsaw with no idea of the final picture, and not knowing if there are pieces missing

Although the routine could be used on a  normal hard drive, we would not expect very good results as there is a much larger mix of files, and the process could be very slow.

Success rate

On a recent customer job, a  full 1GB camera memory chip had 470 jpeg files recovered from an erased chip.  Of these files, 24 did not recover correctly based on a sequential run. Once the fragment repair routine was run, 20 of these files were repaired.  Processing time was a few hours. It is often fastest to work with an image file on the hard drive rather than the original memory chip.  The success rate can vary considerably, but there is an option to select different contrast levels which can assist in avoiding false matches.

A very powerful recent enhancement (V2.68) with CnW defragmenting software is to make use of the thumbnail image that is often part of a photo jpeg.  By examining a potential fragment it is possible to match the new image with that of the thumbnail.  If the thumbnail shows mainly yellow for an area and the new fragment shows mainly blue, we know this is wrong and should be eliminated.  If several areas match, then it is likely to be the correct fragment.

Fragmented JPG recovery is a very powerful feature, and not available in many data recovery programs when dealing with raw data.  Unfortunately, this feature is not part of the demo program.

Fragment logging

When a picture is reconstructed, forensically it is important to know how the image was reconstructed.  This information is stored with the log.  By clicking on the ‘Frags’ column for the relevant file, each fragment will be documented.  A court expert could then use this information to reconstruct the image manually.  The information is also exported as part of the .csv export log file

.