News:

2023-03-15 Major improvements to the new Geolocation feature

Main Menu

Canon CR2 files - ExifToll recovers corrupted photo, but preview is ok

Started by fifek, December 01, 2013, 05:29:13 AM

Previous topic - Next topic

fifek

Hello! I have the following problem: my HDD crashed, but not mechanically, but logically. I am trying to recover my CR2 photos from Canon 6d located on it.
I tried different apps, but still obtain corrupted CR2 files. The only one software that gave me different result is Stellar Phoenix Photo Recovery.
It gave me preview of real orignal files, giving me at the same hope for recovering them in any way.
Below screenshot of this program with preview on one of the files:



and below, result of extracting jpg preview by ExifTool (I obtain the same result from Instant JPEF from RAW app):



The question is: why the recovered image is corrupted, since its preview contains info about the image. Is there any way to extract proper photo from corrupted CR2 file?

Phil Harvey

The photo recovery software is displaying the tiny thumbnail image (160x120 bytes).  CR2 files contain 2 embedded JPEG's, the tiny thumbnail, and the preview.  It looks like your preview is corrupted.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

fifek

Does it matter that the corrupted CR2 files are on RAID HDD? Maybe another approach is necessary.

fifek

And one more: since the file contains data about location of pixels in thumbnail, doesn't any method exist to extract these data into large preview?
In addition, I have a lot nice 10-15 MB CR2 files, but I also recover 15-100 kB CR2, which is a bit strange. What's more, extracting multimedia data from CR2 files by Multiextractor shows completely different images written in recovered CR2 files (even mp3 an mov files!). How is this possible? It looks like recovered CR2 files are containers of many different data.

Phil Harvey

Your filesystem has obviously been scrambled so that files are now a random collection of data from different original images.  A well-formed CR2 will not contain data from other images.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

MOL

QuoteDoes it matter that the corrupted CR2 files are on RAID HDD?

Which RAID level?  I'd bet it was 0, and then you're most likely out of luck unless you have a backup somewhere.

-Uwe

fifek

Yes, I have 2 HDDs which were in RAID, but the 1st one was formatted and Win 7 was installed there. This is certainly RAID, since dmde recovers 100% of folder structure, but stil there is problem with CR2. Fortunately, they are now of "normal" (expected) size and no small files are present. Is there any chance to patch them together?

MOL

Are you sure you have a RAID setup?  Your description sounds as if you had a master HD with your operating system on it and and an attached slave with the data.

-Uwe

fifek

This is what I've thought. But making approach in dmde "Reconstruct RAID 0" (but for now I don't know yet wheter it was 0 or 1) it finally showed me folder structure as I saw it before HDD crash.
But, until now after 50% of scanning this RAID matrix, it is still giving me CR2s without possibility of preview (fortunately now the CR2s are of 10-15 MB, not 50 kb or 50MB, as it was previously). So I suppose the approach is correct. In addition, my wife, who's colleague composed this comupter 6 years ago, told me that this is RAID and I didn't know it??

I only wonder, is this why I obtained corrupted CR2, because part of the information was on the second drive? But the CR2s was only on the second physical drive (as seen by windows' explorer), so why does it need the second drive for?

MOL

Quoteso why does it need the second drive for?

"A RAID 0 (also known as a stripe set or striped volume) splits data evenly across two or more disks (striped)"

RAID 0 comprises striping (but no parity or mirroring). This level provides no data redundancy nor fault tolerance, but improves performance through parallelism of read and write operations across multiple drives. RAID 0 has no error detection mechanism, so the failure of one disk causes the loss of all data on the array.

http://en.wikipedia.org/wiki/Standard_RAID_levels#RAID_0
http://en.wikipedia.org/wiki/RAID#RAID_0

Quoteis this why I obtained corrupted CR2, because part of the information was on the second drive?

Possibly. RAID turns several hard disks into one logical disk and parts of a file might have been written across the array. So if you lose one HD of the two, you've lost the whole file.

HTH
Uwe