Recovering Photos from a Memory Card in Linux

Well, this is one of those "mostly for me" posts but, in case you find it useful (and I make no guarantees that you will! :-), here is how I recovered some photos from a memory card.

First: Don't use the card! If you do, there's a chance the data you're interested in may be overwritten.

(Optional: Instead of putting the card on the shelf, I created a backup of the data on it, like so (/dev/sdc being the sdcard; you'll have to check to find out which device is correct by mounting the card and looking at dmesg):

> dd if=/dev/sdc  of=~/image/tempfile

This may take quite a while, depending on the size of your card.)

Second: Get the TestDisk suite. We're going to be using PhotoRec.  If you have Ubuntu, you can do:

> sudo apt-get install testdisk

PhotoRec will actually recover a number of different types of files (see their website for more details). It works by reading the raw data and determining the file type, and then saving the file to a recovery location.

Third: Run PhotoRec.  If you copied your card to a file, you can run it like:

> photorec /path/to/sdcard/file

Otherwise, you can just do:

> sudo photorec

In either case, you'll have to select the "device" (be it file or actual hardware) you want to recover from, and then the partition type (if it's an SD card, you're probably fine with "Intel"), and then the actual partition (again, for an SD card, look for FAT32), and then the filesystem type (probably other), and then whether you want to search the whole partition, or just the free space (ie deleted files). I went for whole partition because I wasn't sure whether the files were deleted or not.  Finally, you have to choose where to put the recovered files (press Y when you've navigated to the correct spot).

Fourth: take a break and let PhotoRec work. Depending on the size of the card and the number of files that are on it (deleted or no!), this may take a little while. (I had about 1500 files recovered in about 20 minutes.)

Great! All your files are back! Woohoo! Now, it's just a matter of sorting through all 1500...

Unfortunately, the files don't have useful names (or mine didn't... names were like "f1071616.jpg"). However, JPG files (can) contain metadata, stored in EXIF. Most digital cameras automatically include information about the camera and the picture, like model, exposure, and... creation time! (Assuming you set the date/time on your camera...)

So we can, at least, give the files somewhat useful names now.

Fifth: Make a backup of your recovered files, just in case something goes wrong. You don't want to have to recover them again.

Sixth: It's time for the magic of Python!  Here's a handy little script I whipped up to pull out the creation time and rename the file. Note that you'll need to have the Python Image Library (PIL) installed.

renameJpgByDateTime.py:

#!/usr/bin/env python

from PIL import Image
from PIL.ExifTags import TAGS

import os, shutil

def renameJpg(fn):
    i = Image.open(fn)
    info = i._getexif()
    for tag, value in info.items():
        decoded = TAGS.get(tag, tag)
        if decoded == 'DateTimeOriginal':
            filePrefix = value + "-"
            shutil.move(fn, filePrefix + fn.replace(filePrefix, ""))

dirlist = os.listdir('.')

for fname in dirlist:
    if '.jpg' in fname:
        renameJpg(fname)

Then, go to the directory that contains the files, and run the script (don't forget to set it to executable):

> ./renameJpgByDateTime.py

And there you go!