Recovery Force® Data Recovery Forum

I managed to extract 1620 x 1080 x 24bit JPEGs from each .cr3 file, plus 160 x 120 x 24bit thumbnails. That could be an option if other methods fail.

Hi fzabkar,

appreciate that, but we need RAWs :/ photorec script is a brilliant idea (and one and only for now) unless i find software that already implemented solution.


btw that`s odd situation, that particular camera settings have influence to CR3 format...

Regards,
Davey

fzabkar wrote: ↑Mon Feb 06, 2023 1:38 am I managed to extract 1620 x 1080 x 24bit JPEGs from each .cr3 file, plus 160 x 120 x 24bit thumbnails. That could be an option if other methods fail.

Yes, so can I but then better option would be to scan using JpegDigger and hunt for higher resolution embedded JPEGs.

fzabkar wrote: ↑Mon Feb 06, 2023 1:01 am

Joep wrote: ↑Sat Feb 04, 2023 1:54 amIt is as if the carver decides to end carving when it encounters the 'free' atom. I bet if it just continued and ignored the free atom the CR3 could be correct.

I notice that PhotoRec "recovers the mdat atom as a separate file". Would it be possible to use PhotoRec to carve the data and then stitch the two parts of each file together with a .bat script? That appears to be the approach taken by PhotoRec users.

https://git.cgsecurity.org/cgit/testdis ... file_mov.c

I am pretty certain that using DMDE we can carve the CR3's.
Do you have DMDE? I am suggesting DMDE because it's the only thing (AFAIK) that allows for setting up a decent end signature.

Joep wrote: ↑Mon Feb 06, 2023 9:01 am

fzabkar wrote: ↑Mon Feb 06, 2023 1:38 am I managed to extract 1620 x 1080 x 24bit JPEGs from each .cr3 file, plus 160 x 120 x 24bit thumbnails. That could be an option if other methods fail.

Yes, so can I but then better option would be to scan using JpegDigger and hunt for higher resolution embedded JPEGs.

Already did that, afair JpegDigger succeeded but RAW only is our goal.

Joep wrote: ↑Mon Feb 06, 2023 9:05 am

fzabkar wrote: ↑Mon Feb 06, 2023 1:01 am

Joep wrote: ↑Sat Feb 04, 2023 1:54 amIt is as if the carver decides to end carving when it encounters the 'free' atom. I bet if it just continued and ignored the free atom the CR3 could be correct.

I notice that PhotoRec "recovers the mdat atom as a separate file". Would it be possible to use PhotoRec to carve the data and then stitch the two parts of each file together with a .bat script? That appears to be the approach taken by PhotoRec users.

https://git.cgsecurity.org/cgit/testdis ... file_mov.c

I am pretty certain that using DMDE we can carve the CR3's.
Do you have DMDE? I am suggesting DMDE because it's the only thing (AFAIK) that allows for setting up a decent end signature.

Awesome! Yes, i do have DMDE. If needed i can provide part of image where problematic CR3`s signatures was found (original is 2TB) for testing purposes.

To sum up : problem is premature eof because of some newly created atom in each CR3 structure, we need to ignore it or "stitch" parts of file as fzabkar said.

Oh yes, if we can be fairly certain part of image does contain files we're after that could be useful.

I only have the few files you gave me and some I got from dpreview.com, but for these it works. With this I carve intact CR3 files that preview in explorer and that open in RawDigger. It goes specifically for the R6 CR3 files. Of course non contiguous files can not be recovered this way. I got some false positives but those are easily detected due to odd sizes - Best to set file size filter before copying!

Joep wrote: ↑Mon Feb 06, 2023 7:53 pm I only have the few files you gave me and some I got from dpreview.com, but for these it works. With this I carve intact CR3 files that preview in explorer and that open in RawDigger. It goes specifically for the R6 CR3 files. Of course non contiguous files can not be recovered this way. I got some false positives but those are easily detected due to odd sizes - Best to set file size filter before copying!

On it, i`ll let You know about results.

Joep wrote: ↑Mon Feb 06, 2023 7:53 pm I only have the few files you gave me and some I got from dpreview.com, but for these it works. With this I carve intact CR3 files that preview in explorer and that open in RawDigger. It goes specifically for the R6 CR3 files. Of course non contiguous files can not be recovered this way. I got some false positives but those are easily detected due to odd sizes - Best to set file size filter before copying!

There`s progress, update:

-whole 2TB image scanned with DMDE prepared ini by Joep
-R6 RAW`s found - correct size (~ 30MB each) and quantity but unreadable under RAWDigger etc. None of software i have can`t repair / partially show contents of file.

I`ve cut 50GB of image where "normal" and R6 CR3`s are located, uploaded do gdrive (Joep i`ve sent You link)

Regards,
Davey

Downloading.

If you could also share a few of the recovered files, that may be useful too.

Also, I hope you have the correct signature file, because I updated it one time, shortly after I uploaded first version. For completeness sake I attached it again to this message.
I suggest to try it, recover like 10 CR3 files and check those. What you have there sounds like my previous version and although these files are very easy to repair, it's still not what we want ..