WTC Crime Scene

Tim May tcmay at got.net
Wed Oct 3 14:48:41 PDT 2001


On Wednesday, October 3, 2001, at 05:05 PM, John Young wrote:
> Now the help I need is how to recover the erased
> images from the Compact Flash memory chip.
> Norton's unerase detects no remnants of the JPG
> images. I would really appreciate pointers on how to
> reclaim the images: ...
...
> If anybody can tell me how to get the images restored
> I'll be immensely grateful -- technique or a program
> to buy. And I'll put the images on the Web as soon as
> reborn. They are high res images, 1MB or so each,
> and should be gruesomely spectacular, if only they
> can be unerased. Crime scene indeed.
>

Products like this one may help:

http://www.datarescue.com/photorescue/spec.htm


And there are some tips I found with Google (searching on just "unerase 
flash memory"--other combos may give even better hits):

http://www.imaging-resource.com/IRNEWS/archive/v02/20000922.htm#beg

With this tip:

Beginners Flash: Unerasing Lost Images

It happens. "My name is [unintelligible]. I erased my media card before 
I copied the images." Hi, [unintelligible]. We all make mistakes.

Before you panic and do something (else) foolish, work on a good excuse. 
Here's a starter kit:


1.	"I thought you copied them." Where "you" could be anything from an 
African violet to a goldfish to a cat to a spouse or a long lost 
relative already framed on the mantel.

2.	"I pressed the wrong button." Nobody has to know no buttons are 
involved.
3.	"It said 'Copy.'" Well, desperate measures call for desperate acts.

OK, now panic. Get it out of your system.

If this is your first time (oh, there will be others), start by 
deliberately making the same mistake again -- but to a second card or 
floppy. You can try all sorts of techniques on the second one until you 
find something that works.

The first thing to realize is that -- whether you are using a Macintosh 
or a Windows PC -- your storage device is (no doubt) formatted for 
MS-DOS.

Macintoshes have no trouble reading and writing MS-DOS media (and, just 
for the record, PCs can handle Macintosh media with third-party 
software). But neither of them is any good at running disk utilities on 
the other's media. Your Norton knows your native file system, period. So 
recovery of a DOS-formatted card is a Windows task.

Unfortunately, Windows may see your card only as a network drive (where, 
as with floppies, deletions are not safely buffered in the Recycle Bin). 
And it's rude to reorganize the directories of network drives, so your 
usual unerase utility may not go there.

But there's hope. No guarantees, but hope. Although there's precious 
little hope if you've already stored newer images on it. Or just 
reformatted the card. But you didn't do that.

So to unerase from your DOS-formatted card you'll need access to a 
Windows computer with a card reader and software that will recognize 
your card and unerase your files.

There are a number of unerase utilities that may help. We know of one 
64-MB CompactFlash card saved by the shareware program Recover98 
(http://www.lc-tech.com/r98exp.html) even after a few new shots were 
written to it by a Nikon 950. We've had no success ourselves with MS-DOS 
Undelete, Norton Quick Unerase (which has trouble with files as large as 
image files) and Unerase or shareware like Directory Snoop 
(http://www.briggsoft.com/dsnoop.htm) -- either because they wouldn't 
touch a network drive or couldn't find the first cluster of deleted 
files. The freeware program Emergency Undelete for Windows NT 
(http://www.zdnet.co.uk/software/free/utilities/file/sw35.html) sounds 
promising, but we haven't personally been saved by it. If you have a 
success story with any unerase utility, let us know about it at 
editor at imaging-resource.com and we'll pass the information along.

These utilities know a little secret: the data on the card is not really 
erased. It isn't lost until it is written over the next time information 
is saved to its formerly protected sectors. Instead, an erase operation 
simply frees the file's disk space, overwriting the file name's first 
character in the card's directory with the Greek character sigma. It's 
faster and just as effective. If not secure. To actually erase the file, 
you have to write over every byte. And more than once, if you believe 
certain U.S. government specs. (That's what the Norton Wipe command is 
all about.)

If you're lucky, your unerase utility will just ask you for the first 
letter of each erased file name it found. And a few keystrokes later 
you'll have your file right back where you hoped it still was.

We made the stunning revelation above that everyone (except goldfish) 
makes mistakes. It's our intelligence misfiring, really. So take heart! 
But if you're really intelligent, swing the odds in your favor by 
getting into foolproof habits like deleting images only in your 
camera -- using your computer solely to copy and relying on your camera 
to subsequently delete. While looking at your images on screen. From the 
CD you just burned.





More information about the cypherpunks-legacy mailing list