Tips for recovering deleted images

I just had a colleague come in who had taken lots of photos on holiday but was unable to find them after an occasion where they went into the menus to try and fix an issue after the camera was dropped  I ran my favourite utility, PhotoRec, and we realised that the photos were gone entirely, with little explanation as to why. I suspect she had overwritten the files by taking more photos, which is a data-recovery no-no So with that in mind, here’s a quick post giving a simplified and brief explanation of how media storage works and what you can do in order to prevent your own photographic catastrophe . This isn’t a how-to for PhotoRec / TestDisk, as there are plenty of tutorials out there for that.

In the digital world, speed is important, and storage controllers (that is, devices that read and write to your storage) take shortcuts to ensure things keep zooming along. For example, if you move a folder between two spots on the same disk, the controller isn’t going to spend forever physically moving your files, bit by bit. That would be like moving a house, brick by brick. Instead, a storage controller does the ol’ switcheroo, taking the label off your folder, and giving you the label of another folder instead. The folder hasn’t moved, but to anyone looking at it, it has, because the label has changed. This is why you can move 100gb of movies from one spot to another on your disk in seconds, but copying them over for a friend takes hours.

Digital storage also takes these sorts of shortcuts when dealing with deleting files. In order to delete a file properly, you need to overwrite it with 0’s. But if you have a 4gb movie, that’s a lot of 0’s to write. So what the controller does, is mark the file as deleted. It’s still physically there on the disk, but the system ignores it, because it’s been told that the file has been deleted. When a new file comes rolling along, it moves over the top of the deleted file, so it’s finally deleted.

As you can see, this makes file recovery easy with a tool like TestDisk which ignores the system saying “Nah, this file isn’t here” and makes a copy of the file on another disk, because the file is still there, but it’s just been marked as “invisible” essentially. As you can also see, if you keep shooting, you’re overwriting the “deleted” files, and you have almost zero chance of getting those files back. Even if you don’t take a photo, your camera might still perform some kind of maintenance which causes data to be written to it, and you obviously don’t want that.

So if you’re on holidays and your card stops working, just eject it, pop it in your bag, pop in a second card (you do have one, right?!) and keep on shooting. Unless your card is snapped in two or burned out or in the mouth of a dolphin you were taunting, there’s a good chance you can get your files back

The image at the top of this post is one I took in Sydney back in 2013. I had to recover this, along with a ton of other files with TestDisk because I had accidentally formatted the card, not realising that I didn’t have the photos stored on my PC yet.

So the TL;DR version of this post is:

  1. If your card is cactus, eject it immediately. Don’t write to it!
  2. Take it to your nearest willing IT guy as soon as possible, or use TestDisk / PhotoRec to recover it if you know how
  3. Make sure you carry many cards with you, just in case one dies. Storage is so cheap, you have no excuse!
  4. Keep backups of all your files and import them onto your PC as soon as you get a chance! Even if it’s just one photo, back it up! Your daddy taught you good, right?

Leave a Reply