[TriLUG] How to recover erased files on an OSX drive

[Joshua Gitlin]

Al (et al),

I once had a Compact Flash card which had pictures on it that I needed, 
and my camera accidentally formatted the card (oops!). My first thought 
was to try Norton's... but Norton's wouldn't consider the CF card a 
drive, and refused to touch it. So did every other program I tried. So 
I wrote my own... It's very incomplete, and runs only from the command 
line... but what it does is scan a device (or a file, if you want to 
make an image of a device) for JPEG Header data. When it finds a JPEG 
header, it copies the data out of the file. It worked for me.

The program has three major flaws. The first is that it will not find 
information that is split across multiple sectors. This wasn't a 
concern for me, since my CF card didn't have any pictures split across 
multiple sectors. Another problem is that the program will find deleted 
pictures as well as existing pictures... which means it's not a good 
idea to run it on a hard drive containing thousands of pictures. And 
the final problem (and the biggest) is that I didn't know how to find 
the *end* of a JPEG... so the program just copies until it hits the end 
of the device... that was the simplest solution for me, since my CF 
card was only 32 MB. (I just recompressed all the JPEGs and the extra 
data was removed) But it makes the program useless on a large hard 
drive.

If anyone is interested in the source code I wrote, just let me know.

-Josh Gitlin

On Wednesday, September 17, 2003, at 10:35  PM, al johnson wrote:

> I have a friend who knows so much about Macs, that what he doesn't know
> literally isn't worth knowing.  Jimmy Harmon is an owner of Graphics 
> Ink,
> which is a Graphics Art and Printing firm for several of the largest 
> firms in
> RTP.  He loves Macs so much that whenever there is a new model, he 
> just can't
> wait until he gets the newest models that Steve Jobs has created. His 
> company
> even has an OSX server with 2 terabytes of RAID storage. So when I read
> Brian's question, I knew who should be the one to help.  Yes, this is 
> OT (but
> I believe it's my first OT). Anyway, you might want to consider what he
> advises. --- Al Johnson
>
>
>
> ================================
>
> Re: [TriLUG] OT:MAC Data Recovery
> From: Jimmy Harmon <jimmyh at graphicsink.com>
>  To: al johnson <alfjon at mindspring.com>
>  Date: Wed, 17 Sep 2003 15:36:50 -0400
>
> Tell them to use mac os9 and Nortons. and quit screwing around where
> they don't belong.
>
> Jimmy H
>
>
> On Tuesday, September 16, 2003, at 02:45 AM, al johnson wrote:
>
>>    I thought you might be interested in this story since it is ALMOST
>>  identical to your problem with Dean and Casy's wedding pictures. If
>>  you have
>>  a solution for this problem I'd be happy to pass it along. ---AL
>>
>>  ----------  Forwarded Message  ----------
>>
>>  Subject: Re: [TriLUG] OT:MAC Data Recovery
>>  Date: Mon, 15 Sep 2003 21:05:28 -0400
>>  From: Neil Roeth <neil at occamsrazor.net>
>>  To: Triangle Linux Users Group discussion list <trilug at trilug.org>
>>
>>  On Sep 15, Brian Daniels (bitmage at bellsouth.net) wrote:
>>>>    Good Morning,
>>>>
>>>>    I know this is very off topic so I will apologize now.
>>>>
>>>>    Recently I got married. My photographer used all digital to
>>>>  photograph
>>>>  my wedding.
>>>>    Somewhere along the line he has deleted my files. He runs a MAC
>>>>  with
>>>>  OS X v 10.2
>>>>
>>>>    He is giving me his HD drive and I am going to try to recover the
>>>>  data.
>>>>
>>>>    My initial thought was to send off the drive to a data recovery
>>>>  specialist since I know nothing about MAC.
>>>>    However, If I recall correctly, I think if I throw this in my 
>>>> Linux
>>>>  machine it will see the drive?
>>>
>>>  Under RedHat 8 I was unable to mount Mac HFS disks.  When I dug into
>>>  the
>>>  problem, it appeared that the HFS driver had not been maintained and
>>>  was
>>>  no longer compatible with the kernel.  I haven't tried it under RH9
>>>  to see
>>>  if the situation has got any better.
>>
>>  Try a 2.2 kernel.  About a year ago I was able to read a Mac floppy
>>  using a
>>  2.2 kernel with HFS enabled on a Debian box, after failing with a 2.4
>>  kernel.
>>
>>  --
>>  Neil Roeth
>>  --
>>  TriLUG mailing list        :
>>  http://www.trilug.org/mailman/listinfo/trilug
>>  TriLUG Organizational FAQ  : http://trilug.org/faq/
>>  TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
>>  TriLUG PGP Keyring         : http://trilug.org/~chrish/trilug.asc
>>
>>  -------------------------------------------------------
>>
> -- 
> TriLUG mailing list        : 
> http://www.trilug.org/mailman/listinfo/trilug
> TriLUG Organizational FAQ  : http://trilug.org/faq/
> TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
> TriLUG PGP Keyring         : http://trilug.org/~chrish/trilug.asc