Citylight

About three years ago, I was in Rome, at John Paul II funeral. After the whole day of taking photos (we were designated to take photos of our pilgrimage), my friend discovered that his memory card was broken and he was unable to transfer images to his laptop. Because the photos he had taken were far too precious for him to just throw them away, he asked me if I could try to recover them.

Back home, I wrote a simple script that scans a linux file (so it might be a device like /dev/hda as well) searching for JPEG files' magical number.

When found, the offset is passed to a dd-like program. I was actually using dd back then, but found it to be too slow as I had to use a block size of 1 byte to be able to seek exactly at the image's offset. The data read is then piped to jpegtran which sole purpose is to read as much image data as possible (hopefully the whole image) and save it to some file on the backup disk.
At the end, a check is performed and all zero sized images are deleted (most probably their data was overwritten just after the end of the JPEG header, so jpegtran wasn't able to recover anything)

This method worked surprisingly well, and I was able to recover all the photos my friend had taken.

The funniest part of the story is that when another friend of mine lost all data on her disk, people from a recovery company she called weren't able to get the photos back. Guess what? Yes, I recovered them :) (I still wonder how was it possible for these guys NOT to be able to do it :-/)