I had a little adventure in data recovery yesterday. Amy had taken lots of pictures for the Christchurch Knit in Public Day, which she had saved on her CF memory card. Her co-organiser Dierdre also had a bunch of photos taken with her camera. Just before Dierdre left for Australia for two weeks, they traded copies of their photos so they both had the full set. Amy came home, copied both sets of photos from the CF card to her Mac Mini, formatted the CF card, and then the Mini's hard drive promptly died.

Because Dierdre (and her copies of the photos) was now unavailable, Amy asked whether I could recover the photos of the CF card. Since she had actually formatted it, instead of just deleting the files, the root directory and both FAT copies were zeroed out. I dumped a copy of the whole 1 GB card contents to a file, then wrote a little script that located each JFIF header, which appears at the start of each JPEG file. It turns out that there was virtually no fragmentation on the CF filesystem, so each photo was stored in sequential sectors. I captured everything between one JFIF header and the next into a set of image files, and that worked perfectly.

Amy was surprised to see photos from months ago (her triathlon, our anniversary trip to the west coast, earth day, my photos of butterflies and bumblebees) recovered in addition to the recent Knit In Public Day photos.