Repair corrupted CR2 Files with ExifTool

[destroyed]

Hi,

after a trojan attack I have a lot of CR2 Images which are corrupted.
The virus has destroyed the first 12Kb of each file. I used nearly all application on the web to open or repair this files but without success.

It is possible with the ExifTool to Repair the Files or Export the Image as jpeg or something else?

I attached one of the damaged Files for testing.
Download: http://sascha.corvuscorax.de/_MG_1133.CR2

[Phil Harvey]

I fixed your link, but I still can't download the file.

What model is it?  If I know this I can tell you what the first 12 kB contains.

It may be difficult to recover the RAW image, but extracting an embedded JPEG may be easier.

- Phil

[destroyed]

Hi Phil,

if I could get the JPEG from the files it would be enough for me. Its better than nothing.

The pictures are take with a Canon EOS 350D.
I've uploaded the Sample image to an other server, now it shoult work.

thanks,
Sascha

[Phil Harvey]

Hi Sascha,

Unfortunately, all of the metadata and the start of the preview image are in the first 12 kB of the file, so these are lost. 

The raw data is still there, but recovering it could be tricky.  If the offsets are constant, you could try substituting the first 12 kB of a good CR2 from your camera and see if you can process the resulting CR2.  This has a chance of working, but if it doesn't things get much more difficult.

- Phil

[destroyed]

Thanks for the help!

I alread tried to replace the 12kb with data from an undamaged file but i Coudnt open the file in Camera Raw or somethin else.
Could you descripe an other way to get the picture information?

Sascha

[Phil Harvey]

Hi Sascha,

I was afraid of this.

The next step is to inject the raw data from a bad image into the appropriate location of a good image, but then some tag offsets and/or sizes will need to be adjusted.  This will require some dedicated software work unfortunately.

- Phil

[destroyed]

Can you tell me how I do this?

How do I find the RAW data in the bad image and wherefrom I know on which offset I have to paste it?
I attached an Image with no corrupted Header, possibly you could tell me on this what I have to do.

Download: http://sascha.corvuscorax.de/_MG_4235.CR2

[Phil Harvey]

Hi Sascha,

I don't have time to go into detail about this right now.  It will be fairly time consuming if you don't already understand the TIFF format.

Try taking a look at the exiftool -htmlDump output for a few good images to see where things are, then find a good hex editor and start playing.  Note that you will require some programming skills to automate the process once you figure out what is going on.

- Phil

[BogdanH]

Hi,

You're right Phil: one can combine two CR2 files, but success depends on each corrupted file. That is, each file must first be examined to findout if compressed raw data is present. If it is, then recovery is possible and one can create "new" CR2 file, which then must be developed (i.e. with Canon DPP).
Curious as I am, I did that with _MG_1133.CR2 file.

For whatever reason I can't attach resulting JPG file (2.8MB).

Bogdan
PS: I've attached a zip which contains smaller jpg file.

[destroyed]

Hey BogdanH,

thanks for your work! Could you tell me what you have done with the image?

I've already replaced the last block which starts with "ffd8ff" from the damaged file with the same from a undamaged file. Is that right or is this the wrong data? Unfortunately I couldn't open the "repaired" file in CameraRaw...

regards,
Sascha

[destroyed]

Now I have get it work to export a JPEG with Canon DPP.
Is there a chance to do this with exiftool too?

I would like to write a small application which replaces the rawdata and export a Jpeg Image.

-previewimage, -copy1:previewimage and -BigSize doesnt work on the CR2 file.

[BogdanH]

Hi Sascha,

In file you've posted, it was obvious that part at beginning (where metadata/file structure is defined) is missing. So I have start looking for any image data (raw or preview) from end of the file. If straight from camera, then raw image data is placed at the very end of the file. So, one only need to find the last FFD8h value (which, in this case, defines start of raw image data). That is, one need to extract all data from FFD8h value to the end of the file (signed with FFD9h) and save it somewhere (i.e. in memory buffer).
Now you take intakt CR2 file (from the same camera model) and again look for the last FFD8h position. Once you find that, cut the file at that position, add previously saved data (from buffer) and save as new CR2 file. That's all.
Of course, metadata (camera settings, etc.) and other image data (preview, etc.) inside newly generated CR2 file will have wrong data. But that's not the problem for developing new jpg/tif from generated raw file -in most cases you'll need to adjust WB properly. Needless to say, that you can't generate "original" CR2 file, because metadata (camera readings/settings) simply isn't there.
If you wish to keep "generated" CR2 file anyway (better generated than nothing), then by using DPP, you can create jpg preview file (say, 1800x1200pix) from "generated" CR2 and embedd that jpg file back into CR2. Finally, you can modify existing (wrong) Exif metadata (DateTime, etc.). For embedding jpg preview and modifying metadata, you will use ExifTool of course 

Bogdan

[Constantin]

Hi Sascha,

In file you've posted, it was obvious that part at beginning (where metadata/file structure is defined) is missing. So I have start looking for any image data (raw or preview) from end of the file. If straight from camera, then raw image data is placed at the very end of the file. So, one only need to find the last FFD8h value (which, in this case, defines start of raw image data). That is, one need to extract all data from FFD8h value to the end of the file (signed with FFD9h) and save it somewhere (i.e. in memory buffer).
Now you take intakt CR2 file (from the same camera model) and again look for the last FFD8h position. Once you find that, cut the file at that position, add previously saved data (from buffer) and save as new CR2 file. That's all.
Of course, metadata (camera settings, etc.) and other image data (preview, etc.) inside newly generated CR2 file will have wrong data. But that's not the problem for developing new jpg/tif from generated raw file -in most cases you'll need to adjust WB properly. Needless to say, that you can't generate "original" CR2 file, because metadata (camera readings/settings) simply isn't there.
If you wish to keep "generated" CR2 file anyway (better generated than nothing), then by using DPP, you can create jpg preview file (say, 1800x1200pix) from "generated" CR2 and embedd that jpg file back into CR2. Finally, you can modify existing (wrong) Exif metadata (DateTime, etc.). For embedding jpg preview and modifying metadata, you will use ExifTool of course 

Bogdan

Hi, Bogdan

I am wondering, a corrupted cr2 file which was shot in Black&White, can be repaired so I can get a color JPEG? I opened the file in HEX editor, and the Header seams to be fine. I don't know where to look further...for the color code to fix. The opened the file in Phil's ExifTool and is no error. Also I can save a JPEG but only in Black&White as it was shot.

Thanks!

[Phil Harvey]

Bogdan hasn't been around for a while so I'll throw in my 2 cents in case he doesn't answer.

I would imagine that the color information exists even in a B&W CR2 file, so I would guess that you could generate a colour image somehow, but I don't know what this would involve.  You say the image is corrupted though, so some information may have been lost.

- Phil

[Constantin]

Hi, Phil

Thanks a lot for your time! Yes, a B&W CR2 file has color info. It is possible that somehow, when I moved the files from 32Gb CF memory card to external HDD, the metadata was mixed up. Probably because the card reader has USB 3.0 connection, laptop (in which I connect the card reader and external HDD) has only USB 2.0, and the external HDD USB 3.0. Because all the pictures (app. 1200) except 3-4 are corrupted.
I read on Internet that with a HEX editor I might copy some info from a good file to a corrupted one and create a new CR2 file which can be edited in color. But I guess you didn't study this problem before, so this is why I called Bogdan. I hope he will be notified by e-mail and could answer me.

Again, thanks a lot!

Bogdan hasn't been around for a while so I'll throw in my 2 cents in case he doesn't answer.

I would imagine that the color information exists even in a B&W CR2 file, so I would guess that you could generate a colour image somehow, but I don't know what this would involve.  You say the image is corrupted though, so some information may have been lost.

- Phil