Recovered Files aren't viewable

[rogval]

Ok...I've read until my eyes are bleeding, so I'm going to post my situation to see if I am just simply missing something, or if I'm just siply out of luck.

I am using ZAR on a Compact Flash card from my Cannon 20D. Obviously to recover some deleted images. If I use the image recovery option, then I get 150 images that have indeed been deleted, however I can follow the chronological order of use by following the order of viewing the pictures. For instance...the oldest photos (of my daughter on 2-10-08) are at the end and the latest photos (Easter Sunday 2-23-08) are at the beginning...and all the photos taken in between are, well...in between those. EXCEPT...I took some on Valentines Day (2-14-08) and those aren't on there, and guess what...those are the ones I was hoping to recover.

So...I do a simple volume recovery, which in turn recovers hundreds and hundreds of Camera Raw files. So I pull them in and go to open them in photoshop (which always worked fine before) and it tells me it can't open it cause it's not the right file type. Whatever...so I try using the DNG converter for Adobe and it tells me that it can't "Parse" the file, and it may be corrupted. Upon further investigation...I did notice that when I attempted to just simply recover the files, as opposed to "Images", I noticed that all the camera raw files, that are normally written by the camera as "IMG_####" are now, after recovery is "_MG_####" So it's replacing the "I" at the beginning with "_", which is in turn apparently making it a corrupt file, as far as camera raw standards are concerned. So...that's it in a nut shell.

I'm just really confused why the image recovery option only finds 150 photos, when this compact flash card has been used for NOTHING but my Cannon 20D and the simple file recovery option shows that there are obviously tons more images on there than that.

Any thoughts?

Thanks
Roger

[Alexey V. Gubin]

See how this works. There are two types of items on the card. There are files (actual images) and references (pointing to images). References are, bascially, file names. A reference to an existing file has a name like "IMGxxx". Reference to the erased file has a name like "_MGxxxx". Typically, there are more references than valid files, even during a normal filesystem use. Part of the references just point nowhere.

So, "image recovery" mode works with image data. Ignores references completely. On contrast, "simple volume" mode works with references only, trying to figure and sort them out. It ignores the image data. Given the fact that there are more "seemingly recoverable" references than valid image files, "simple volume recovery" mode brings in more garbage.

Open the log file, C:\Program Files\ZAR\logfile.txt, and search for "Object count" without quotes. There will be series of lines defining number of various types of files. Check "Object count: CRW". If it is indicated as 150, then you are out of luck. Otherwise we've got a bug.

[rogval]

Ok....I've attached a Zip folder of two logs...one of them (Image logfile.txt) is the log created from doing the Image Recovery option. The other (Simple Volume logfile.txt) is from doing the Simple Volume Recovery option.

Can you look at them and see if there is something that catches your attention? I looked for what you said, and it shows, 0 for CRW Object count. However it shows 140 for the Tiff count, which the instructions state that it will save recovered raw images as tiff format, so I'm confused, if you can take a peek at the logfiles and see what they say.

Thanks
Roger

[Alexey V. Gubin]

Two different formats are called "Canon RAW". CRW and CR2. CRW is a format of its own, CR2 is a derivative of TIFF (and recovered as TIFF). Earlier cameras use CRW, later models use CR2. So I mistook your camera for the one using CRW, whilst it is in fact CR2/TIFF.

The log indicates there are total of 140 TIFF (same as CR2 in this context) images on the card. So if you said it recovered about the same amount, I guess that's it.

There is one more thing you can try,
1. Start ZAR
2. Click Advanced Configuration
3. Under Image Recovery, set End of file detection to None (leave as is).
4. OK to close config.
5. Retry in image recovery mode.
This will still produce 140 images, check if they are somehow better than the earlier version.

[towpik]

I have similar problem. It seemed that I recovered files, but cant open themm. They are unreadable. I have RAW partition which can't be read by windows, although it is NTFS formatted and have drive letter. I don't know how i happened. I recovered over 40GB but its unusable. Any help. I want to claim my money back.

[Alexey V. Gubin]

Sure I did a refund. Could you please open ZAR log file - C:\Program Files\ZAR\logfile.txt with notepad or whatever text editor you use. Then, search for "MFT regions dump" and "Directory tree read-in started" (without quotes). I would like to see the excerpt of the log file between these two entries. This still may provide a clue as to fix the problem.

[magnam212]

I had something similar happen where I recovered 80 GB of files, but the files (not just pictures, but docs, scripts, etc) have nothing in them.....I guess an analogy I could use is that I'm holding the wrapping paper, but there is no present. What should I look for in the log file that will help determine the problem? Thanks in advance!

[Alexey V. Gubin]

You'd rather ZIP the log file and email it to me at development@z-a-recovery.com for review.