Recovering JPGs from a Corrupted VFAT FS
Friends of my mum came back home from their vacation recently. They where eager to see all the digital photos they took. Only to discover that their computer couldn't read the SD card anymore.
Of course this means that this card appeared on my desk in no time 
.
Put into my card reader and checking dmesg showed the card to be at least “electrically” alive:
sd 3:0:0:2: [sde] 1950720 512-byte hardware sectors (999 MB) sd 3:0:0:2: [sde] Write Protect is off sd 3:0:0:2: [sde] Mode Sense: 03 00 00 00 sd 3:0:0:2: [sde] Assuming drive cache: write through sd 3:0:0:2: [sde] 1950720 512-byte hardware sectors (999 MB) sd 3:0:0:2: [sde] Write Protect is off sd 3:0:0:2: [sde] Mode Sense: 03 00 00 00 sd 3:0:0:2: [sde] Assuming drive cache: write through sde: unknown partition table
But trying to mount it failed:
$ sudo mount -t vfat /dev/sde /mnt
mount: wrong fs type, bad option, bad superblock on /dev/sde,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
dmesg told me:
FAT: bogus number of reserved sectors VFS: Can't find a valid FAT filesystem on dev sde.
Bad. First thing to do is to make a backup:
$ sudo dd if=/dev/sde of=sdcard.img bs=1M
My next attempt was to repair the file system using fsck.vfat, but this failed.
$ sudo fsck.vfat -v /dev/sde dosfsck 2.11 (12 Mar 2005) dosfsck 2.11, 12 Mar 2005, FAT32, LFN Logical sector size is zero.
I then googled around for some tips how to manually recover a VFAT system. The best descriptions where in this forum thread, but like the OP there, I came to now result.
My next thought was, that I exactly knew what data there was to recover: JPEG files. JPEGs should be easy to recognize based on their headers.
Of course I wasn't the first with this problem. And I wasn't the first with the solution idea. Googling a bit more finally brought me to a blog post by Mark Lynch.
The solution is called recoverjpeg. After 10 minutes of downloading, compiling and running it on the backup image, my reputation as the “computer guy that can fix these things” was secured:
$ recoverjpeg sdcard.img Restored 620 pictures
PS: all pictures stolen recovered from the card 