splitbrain.org

electronic brain surgery since 2001

Writing /var/www/html/data/log/deprecated/2024-11-07.log failed

Recovering JPGs from a Corrupted VFAT FS

Friends of my mum came back home from their vacation recently. They where eager to see all the digital photos they took. Only to discover that their computer couldn't read the SD card anymore.

Of course this means that this card appeared on my desk in no time :-).

Rescued Wooden Figurines

Put into my card reader and checking dmesg showed the card to be at least “electrically” alive:

sd 3:0:0:2: [sde] 1950720 512-byte hardware sectors (999 MB)
sd 3:0:0:2: [sde] Write Protect is off
sd 3:0:0:2: [sde] Mode Sense: 03 00 00 00
sd 3:0:0:2: [sde] Assuming drive cache: write through
sd 3:0:0:2: [sde] 1950720 512-byte hardware sectors (999 MB)
sd 3:0:0:2: [sde] Write Protect is off
sd 3:0:0:2: [sde] Mode Sense: 03 00 00 00
sd 3:0:0:2: [sde] Assuming drive cache: write through
 sde: unknown partition table

But trying to mount it failed:

$ sudo mount -t vfat /dev/sde /mnt
mount: wrong fs type, bad option, bad superblock on /dev/sde,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

dmesg told me:

FAT: bogus number of reserved sectors
VFS: Can't find a valid FAT filesystem on dev sde.

Bad. First thing to do is to make a backup:

$ sudo dd if=/dev/sde of=sdcard.img bs=1M

My next attempt was to repair the file system using fsck.vfat, but this failed.

$ sudo fsck.vfat -v /dev/sde
dosfsck 2.11 (12 Mar 2005)
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Logical sector size is zero.

Rescued Cuckoo Clocks

I then googled around for some tips how to manually recover a VFAT system. The best descriptions where in this forum thread, but like the OP there, I came to now result.

My next thought was, that I exactly knew what data there was to recover: JPEG files. JPEGs should be easy to recognize based on their headers.

Of course I wasn't the first with this problem. And I wasn't the first with the solution idea. Googling a bit more finally brought me to a blog post by Mark Lynch.

Rescued Jesus

The solution is called recoverjpeg. After 10 minutes of downloading, compiling and running it on the backup image, my reputation as the “computer guy that can fix these things” was secured:

$ recoverjpeg sdcard.img 
Restored 620 pictures

PS: all pictures stolen recovered from the card ;-)

Tags:
linux, vfat, jpeg, recovery
Similar posts: