Photo & Video Recovery (Deep Scan of a Disk Image)

About the Photo & Video Recovery (Deep Scan of a Disk Image)

First make a disk image of the card or drive (a file with every sector of it; the Data Recovery Assistant shows how), then open it here. This deep scan does not need the file system: it reads every sector of the image and recognises photos, videos and documents by their own structure, so it works on cards that were formatted, that a camera calls unreadable, or that a computer offers to format.

Each hit is accepted only after its structure has been followed from its first byte to its last: JPEG markers to the end marker, every PNG chunk checksum, the boxes and index of an MP4 or MOV, the directories of a RAW photo, the parts of a DOCX or ZIP. Each file is marked Opens fully or Partly damaged, photos are named from the date and camera in their EXIF data, files whose bytes are identical to another find are marked as copies and left unselected, and the scan can stop and go on later. Nothing is uploaded.

Without a pass this is a free preview: the scan runs in full and lists every file found with its condition, photos show small watermarked thumbnails and videos the first half of what plays (up to 10 seconds), marked; saving the files needs an Ultimate pass.

Common uses

• Recovering photos and videos from a card that was formatted in a camera, drone or action camera.
• Getting files back from a card or stick that shows as “RAW” or that a computer asks to format.
• Finding photos on an NTFS, Mac or Linux drive image, whose file systems the undelete page does not read.
• Pulling RAW photos (CR2, CR3, NEF, ARW, DNG) and their camera previews out of a damaged card.

What it finds

• Photos: JPEG, PNG, GIF, WebP, HEIC and AVIF, TIFF and RAW (CR2, CR3, NEF, ARW, DNG, ORF, RW2).
• Videos: MP4, MOV, 3GP and AVI; the length the video states and the length whose data was found are both shown.
• Audio: WAV and M4A.
• Documents and archives: PDF, Word, Excel and PowerPoint (DOCX, XLSX, PPTX), OpenDocument, EPUB and ZIP; small archives are opened file by file and their checksums compared.
• Databases: SQLite (the database header gives its size).

What it cannot give back: the original file names and folders (those lived in the file system), and files whose data has been written over.

How the scan decides what is a file

A file signature alone proves little: the bytes FF D8 FF that start a JPEG also turn up inside other data. So every candidate is followed through its own structure, and only files whose structure holds are listed; random matches are dropped. While a file is followed, every sector boundary is checked for the start of another file: when one appears before the end, the file was cut off there and is marked Partly damaged, so it never swallows the next file. Embedded pictures (a video’s frames, the photos inside a ZIP or PDF) are recognised as parts of their file.

The method follows Simson Garfinkel’s work on carving with fast object validation; the code is MySmartCoPilot’s own.

Fragmented files

A deep scan finds files that were written in one piece. A file stored in several fragments comes back with its first fragment only and is marked partly damaged. In Garfinkel’s survey of more than 300 second-hand hard drives, 6% of all files were fragmented, 16% of JPEGs and 20% of AVI videos, while about half of the drives had no fragmented file at all. Those were computer hard drives; how fragmented a card is depends on how it was used.

Measured on test images

On card images whose file system was wiped, built in code with every supported kind of file (JPEG, PNG, GIF, WebP, HEIC, AVIF, TIFF and the RAW formats, MP4, MOV, 3GP, AVI, WAV, M4A, DOCX, OpenDocument, EPUB, ZIP, PDF and SQLite), each file was found at its exact position and length and named from its EXIF date where it had one; copies cut short, with a damaged PNG checksum, or missing a video index were all marked partly damaged, and signature look-alikes without a valid structure were rejected. On two card images made by macOS (FAT32 and exFAT), every photo, video and document on them was found at its exact length. These checks are part of the page’s automated tests. Scan speed depends on your device and browser and on where the image is stored.

Limitations

• Works on disk images only, not on cards or drives directly (browsers do not allow it). Raw images (.img, .dd, .bin, .raw, .iso, .cdr), raw images saved in parts (.001, .002 …) and fixed-size VHD files open directly; E01, DMG and other compressed formats must be converted to raw first.
• Names and folders are not recoverable this way: files get names from their kind and number, or from a photo’s EXIF date and camera.
• Files stored in fragments come back incomplete (only their first fragment).
• Data that has been written over is gone. A full (zeroing) format, a secure erase or TRIM on an internal SSD leave nothing to find, and encrypted cards and drives cannot be read without their key.
• Thumbnails need the browser to decode the file: HEIC photos show one only in browsers that decode HEIC, and video frames and previews need WebCodecs (recent Chrome, Edge, Safari and Firefox) and a codec the browser has. Video previews play without sound.
• A paused scan is kept in your browser’s own storage, where the browser allows it; Safari may delete it after seven days without a visit, and a browser with no room for it starts the next scan from the beginning.

Privacy

The image is read by your browser on your device, a few megabytes at a time, in a background worker; nothing from it is sent anywhere. A paused scan keeps only its position and the list of what it found in your browser’s own storage, never file data.