Hack 48 Unerase the Lost

Hack 48 Unerase the Lost

Nothing wrenches the heart like accidentally erasing a memory card full of images. But all is not necessarily lost .

A few years ago, a buddy of mine's mother was approaching her 100th birthday. She didn't get out much any more, but she'd been to the hairdresser and had her hair Cool Whipped to perfection . She even went to the dry cleaner to get her Queen Bee formal gown pressed. The tiara she always kept gleaming.

She enlisted her friend to pick her up at her summer residence to drive her to her son's newly remodeled home. His dinky two-bedroom gardener's shack had been magically rebuilt into a four-bedroom palace with closets the size of shoe stores.

And her son even got a haircut. She'd been begging him to do that for 32 years. "Danny, why don't you get a haircut? Take the money from my purse. Go on."

I'd recently been out to shoot the new baseball stadium in town, so I brought along the shots on the Compact Flash I'd used. While we were waiting for the Queen Mum, I plugged my digicam into their television and wowed the kids with delusions of a World Series to come.

Naturally, I also brought a blank card to shoot the festivities. And, as luck would have it, I got a once-in-a-lifetime shot of mother and sonyep, a rare simultaneous smiling.

The next morning, before any cup of anything could clear the cobwebs from my head, I deleted the wrong card. "No," I said. "I didn't."

Oh, yeah, I did. But I was confident I could recover the data from the card. I'd done it with floppies, why not with a card? So, I spent the next few weeks trying every trick in the book to undelete the files on the card. But they were lost.

I consoled myself with the thought that I'd get that portrait again one day, but the dear matriarch never lived to see her 101st birthday. And her son was so distraught, he let his hair grow out again.

It's a sad story. But there's no reason it should ever happen again.

These days, even one of the kids could salvage that image while waiting for a World Series. All the little gotchas that defeated me years ago have themselves been defeated by modern utilities designed especially for just this sort of thing.

5.3.1 How They Don't Work

The first thing to know is thatwhether you are using a Macintosh or a Windows PCyour storage device is formatted for MS-DOS.

Macintoshes have no trouble reading and writing MS-DOS media (and PCs can handle Macintosh media with third-party software). But neither of them is any good at running disk utilities on the other's media. Norton knows your native filesystem, period. So, recovery of a DOS-formatted card is a generally a Windows task.

Unfortunately, Windows might see your card only as a network drive (where, as with floppies, deletions are not safely buffered in the Recycle Bin). And it's rude to reorganize the directories of network drives , so your usually reliable unerase utility might not go there.

The size of your card is also a factor. The file allocation table for a 16 MB card is not quite the same beast as for a 256 MB card, which is also why some larger-capacity cards don't work in some cameras .

The complications build from there.

You might have success using freeware to unerase your card. I report every success story I hear in the letters column of the Imaging Resource Newsletter (http://www.imaging-resource.com/IRNEWS). But the free utilities run primarily on Windows (the exception is Carsten Exif Untrasher: http://q41.de/downloads/exif-untrasher_en).

But this job is a lot more difficult than it might seem. I prefer to rely on a utility that will do everything possible to restore the data, rather than pat myself on the back for saving US$30 and not recovering two or three images every time I run it.

5.3.2 The Secret to Unerasing

All of these utilities know a little secret: the data on the card is not actually erased. It isn't really lost until it is written over the next time you save information to its formerly protected sectors.

An erase operation simply frees the file's disk space, overwriting the filename's first character in the card's directory with the Greek character sigma. It's faster than zeroing all the data and just as effective, if not as secure. To actually erase the file, you have to write over every byte. And you have to do so more than once, if you believe certain U.S. government specs . That's what the Norton Utilities Wipe command is all about.

5.3.3 To the Rescue

After my traumatic experience, I wanted the best utility for recovering images. I came up with DataRescue's PhotoRescue (http://www.datarescue.com). It runs on Windows 98 or higher and Mac OS X. The basic version, shown in Figure 5-3, costs US$29 (or US$45 for both platforms). An expert version, offering even more harrowing measures to restore the past, costs US$39.

Figure 5-3. Windows version of PhotoRescue's analysis of a Memory Stick

PhotoRescue uses a proprietary data-recovery engine, optimized for image files, that dynamically switches between up to 12 data-recovery algorithms to apply a recovery strategy that is optimized for each image.

It can also create a disk image of your card, a file on your hard disk that mirrors the data on your card. This is a pretty interesting capability, because it means you can duplicate the card data any number of times to try different recovery strategies and diagnostics. When PhotoRescue finds all the files hiding on your memory card, it displays the directory tree, a thumbnail, and the filename for each recovered item, as shown in Figure 5-4.

Figure 5-4. Formerly lost files recovered by PhotoRescue

5.3.4 What Can and Can't Be Done

PhotoRescue has recovered every image I erased and every card I reformatted. But to be retrieved, the data has to reside on the card. And that isn't always the case. Let's look at what can and can't be done:

• If you simply erased files on your card from your camera, PhotoRescue can retrieve them by uncovering all the information that's still lingering on the memory card. You can't see it, but it's still there.

• If you used the card to capture more images after erasing, you are overwriting whatever PhotoRescue might be able to recover. Something might be recoverable (from the part of the card not yet reused), but not everything.

• If your camera can't read your card, PhotoRescue might still be able to recover your images by reading the card in physical (rather than logical) mode.

• Because IBM Microdrives can suffer mechanical failures, data retrieval by software alone might be impossible . But you can still try a disk-recovery firm, such as Drive Savers (http://www.drivesavers.com), that actually pulls data blocks off damaged drive platters and puts the information on other media for you.

• Using your camera or computer to reformat your card might make recovery impossible. According to DataRescue, "Nikon and Canon digicams usually do not fully erase cards. Olympus digicams may or may not fully erase cards during a format. Sony digicams always seem to do a complete wipe."

After reformatting your card, to see if you have recoverable data, use PhotoRescue's "Image the Input" command to create a disk image. Compress that disk image with a utility such as WinZip or StuffIt. If the resulting archive file is small, it means that there wasn't any data to compress.

After an in-camera reformat of my card, PhotoRescue recovered exactly what I had recovered after merely erasing the card.

5.3.5 Safe Practices

Naturally, the best approach is not to erase your card until you've copied your images. One copy is not enough. Two copies on different media is the minimum. The copies should be created with as few shared variables as possible. If something goes wrong with one scheme, the other should not suffer the same fate.

Then, use your camera, not your computer, to erase the images. Once in a while, feel free to reformat the card, but that's not really necessary. If you make sure never to erase files or format your card on your computer, your camera will always be able to make sense of your card. If you use your computer, your camera might not. Cameras aren't as smart as computers.

5.3.6 Final Thoughts

Before you make the tragic mistake I made, find a flash-card unerase utility you can live with. The next time you erase a card, use your utility to try to recover the images that were on it. Try it after a reformat, too. If you don't get them all back, try another utility.

Rehearsing for disaster might seem silly, but I know at least two people who wish I'd done it. It's a tragedy, yes, but it's entirely preventable. Don't let it happen to you.

Mike Pasini