Need help to repair CR2 files and jpgs

[sarinsoman]

Hi,

I am a newbie here. I am seeking basically your help to repair my corrputed CR2s and JPGs taken with my Canon 5D MK III. I had covered two events and all those photos are now not readable after i copied to hard disk.i have formatted and taken many other pics after this event. tried file recovery from memory card but no luck so far. I am afraid it is a virus attack as the photos copied from the camera memory card before this issue were working well. You can find the links for the working and corrupted CR2 for the same file given below.Also attached some working and corrupted files. If you can tell where exactly the corruption happens and how to fix it, so that i can use the method to repair the rest of the photos. Your valuable help much appreciated.

Thanks in advance

Sarin


Same CR2 file with corrupted and working version
https://www.dropbox.com/s/3s9sax6nrn0dter/IMG_8528_Corrupted.CR2?dl=0
https://www.dropbox.com/s/b3gnsa2a8idhvw0/IMG_8528_working.CR2?dl=0


Working CR2s
https://www.dropbox.com/s/hjcvscrxlmet08s/IMG_1406.CR2?dl=0
https://www.dropbox.com/s/jvy8t0p4n2fp188/IMG_9704.CR2?dl=0

Corrupted CR2s
https://www.dropbox.com/s/yathmnfpf62h1zr/IMG_1898.CR2?dl=0
https://www.dropbox.com/s/niofwc72jrdgijv/IMG_8551.CR2?dl=0
https://www.dropbox.com/s/p9cswoyun3qgefb/IMG_8565.CR2?dl=0


Corrupted JPG
https://www.dropbox.com/s/19yi8scs1c41p1l/IMG_8583.JPG?dl=0

Working JPG
https://www.dropbox.com/s/4lhicgblgu9fmiz/IMG_9186.JPG?dl=0

[StarGeek]

Some of those are irrevocably gone.  The first "working" CR2 isn't there.  There appears to be a low res embedded preview that you probably can extract, but as a Raw file, there's nothing there.

Any file that is less than a meg in size is not going to be recoverable in any way.  It looks like the CR2s your camera takes should be in the 20-30 meg range.  If they're smaller than that, they're most likely gone.

If you have Perl installed, you can try Phil's extract_preview script to see if it can extract any embedded jpgs.

Otherwise, you'll have to wait a few days as Phil is AFK.

[sarinsoman]

Thank you starGreek.  The first working CR2 link i fixed now. all the CR2 file links i posted here are more than 25MB in size.

I have installed perl and i kept the extract_preview script and CR2 files in D drive. Can you give me the ms-dos command to extract the preview images.

There is no way to recover the JPGS?

[sarinsoman]

I could not succeed phil's extract preview script, i tried to use standalone exiftool to extract the preview image but following error

D:\>exiftool -PreviewImage -b D:\IMG_8528.CR2 > D:\IMG_8528.jpg
Warning: XMP format error (no closing tag for bdf:Deccbi) - D:/IMG_8528.CR2

How I can find the CR2 file header length(last offset) for each file from a hex editor?

[StarGeek]

I have installed perl and i kept the extract_preview script and CR2 files in D drive. Can you give me the ms-dos command to extract the preview images.

The post I linked shows how to do it on a mac/linux OS.  But since you mention D drive, I'll assume you're on Windows.  In that case, as long as the extract_preview is in the current directory, you would run it with
perl extract_preview  DIR
replacing DIR with the directory to process.

You also need to make sure the full perl distribution of exiftool is installed.  You can find it from the "Download Version 11.10 (4.2 MB) - Aug. 17, 2018" link on https://exiftool.org/

There is no way to recover the JPGS?

You'll have to wait for Phil to get back or see if someone more experienced than me takes a look to be sure.  But when I run exiftool -g1 -a -s on the files, it comes back with many errors and the metadata has widespread corruption.   I would suspect either the drive or the card was going bad.  A virus such as ransomware would make them completely unreadable to exiftool.  One thing to remember is that even though they may look correct in the camera, the camera is only displaying the small preview image and not decoding the whole thing for display.  So a bad card may still display what look like good shots.

[Phil Harvey]

Wow, those files are messed up.  I took a look at the 4 corrupted files you posted and each has been corrupted in exactly the same way.  So this was some software that systematically scrambled the files, not something like a disk error.

Looking at the way things were scrambled, I don't think it is possible with a reasonable amount of effort to recover any useful data.

It does look like something that a ransomware virus could do.

If they still display properly in the camera, then the files are probably good on the memory card.  (There are no usable embedded JPEG images in these files for the camera to display, so the files on the memory card must be different.)  Try copying them to disk using another computer.

- Phil

[sarinsoman]

Hi Phil,

Thanks for your reply. First time in my life I have connected my camera memory card(right after the photo shoot) to someone else computer to copy the photos. I believe the virus attack happened that time. When I tried to copy the photos from my home PC I found many unwanted files had been created and there were many folders as well. I simply ignored them and copied all the files(still those files are working well). After that i went on vacation and took some photos(on different days)  and didn't copy until Aug 30th. On Aug 30th I copied  all the photos including the ones I have copied already. Before copying all the photos I have previewed them from the camera screen. I saw many other files plus and many folders(same name as CR2 files)were created for each CR2 files while copying from memory card. After I copied everything i deleted all of those unwanted files and folders. My bad luck i didn't preview the images after i copied to them external disk. After that i have formatted the memory card as well. All the photos I clicked after that didn't have the unwanted filed and folders issue in memory card.

I came from vacation and when I tried to open the vacation photos in adobe Photoshop, I realized the photos clicked and copied till Aug 30th were corrupted. Even the ones I copied successfully earlier.

Two of the three events covered during my vacation were our school mates reunion after 21 years and one family function. Both loss I cannot compensate throughout my life.

Thanks alot every one here who tried to help me.

- Sarin

[andrewprj]

I found this thread while trying to rename a bunch of files based on their creation date. I tried following a solution I found in an article, but it didn't work for me.

Thankfully, I stumbled upon this thread and found out that I needed to use the -d option in Exiftool to specify the date format. Once I did that, everything worked perfectly!

By the way, I recently came across an article about CR2 file recovery that I found really helpful. It covers a lot of useful information for anyone dealing with corrupted or lost CR2 files, and it might be worth checking out if you're in that situation.

[Phil Harvey]

Hi Andrew,

... but the -d option isn't mentioned in this thread. 

- Phil