Extracting PreviewImage results in Invalid XMP warning

[thomashw]

Background:
A friend accidentally deleted a bunch of CR2 files and then emptied their trash. They also continued using their computer after doing that.

I was able to get my hands on their computer and recover some files with photorec using a Linux live USB. What I have now is seemingly partial CR2 files that can't be read/viewed.

After searching I came upon the idea of extracting the preview image from them. I can see "preview image start" and "preview image length" in the metadata exiftool shows but when I go to extract the preview image using "exiftool -b -PreviewImage filename.cr2 > out.jpg" I receive "Warning: Invalid XMP - filename.cr2".

I'm very comfortable with CLI tools, Linux, etc. but have almost no experience with exiftool/cameras/images this in-depth. So I was fairly comfortable actually trying to retrieve the files but am now out of my league.

Any help/suggestions is much appreciated!

[Phil Harvey]

I usually recommend running my extract_preview script on files like this.  It does a brute-force scan for embedded JPEG images.  You need to have Perl to run this script.

- Phil

[thomashw]

Appreciate the response! I tested on a "good" cr2 and was able to extract the preview image. Unfortunately on all the "bad" cr2s I didn't get anything.