was being kinda silly & riding about, left hand on my clutch, right hand on my nikon d70's shutter, hip shooting pictures hoping a couple came out alright. got home, plugged it in, saw a few pictures, then suddenly the card bricked itself - fuuuuuuuck. re-plugging it in just showed a bunch of empty folders and corrupted folder names. here's how i got the pictures back
dump the cards content, make sure the battery is fully charged so it doesn't die midway through...
~ λ sudo dd if=/dev/disk4 | pv | dd of=/Users/cass/nikon.imgsee if photorec can get us anything
~ λ photorec nikon.img
894 imageshuh, that was easier than I was thinking. unfortunately it appears as if these
are just the files that were marked as deleted, and not actually the ones lost
in the file table somewhere. at this point I can only presume the file table
took a big shit and died, but the magic byte markers still exist, so perhaps
binwalk will be some use here
~ λ binwalk nikon.img > walk.txt
~ λ cat walk.txt | grep "TIFF" | wc -l
1284ahh okay we do actually have something! that's more than the 894 photorec got
us
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
7143424 0x6D0000 TIFF image data, big-endian, offset of first image directory: 8
7144422 0x6D03E6 TIFF image data, big-endian, offset of first image directory: 8
13074432 0xC78000 TIFF image data, big-endian, offset of first image directory: 8
13075430 0xC783E6 TIFF image data, big-endian, offset of first image directory: 8
16205756 0xF747BC PGP RSA encrypted session key - keyid: 489785D5 A06AA650 RSA Encrypt-Only 1024b
19038208 0x1228000 TIFF image data, big-endian, offset of first image directory: 8
19039206 0x12283E6 TIFF image data, big-endian, offset of first image directory: 8
25034752 0x17E0000 TIFF image data, big-endian, offset of first image directory: 8
...binwalk has a flag for "carving" the files out, so giving that a spin:
~ λ binwalk -z --dd="tiff" nikon.imgmy laptop ran out of space a few mins into this, all the extracted files were coming out as 4gb (the size of the card), so maybe something was up with it not recognising the terminating bytes
anyway i quickly just bodged that by setting the max size to ~8.5mb (the largest my raw images tend to be)
~ λ binwalk -e --dd="tiff" --size=8500000 nikon.imgit's not ideal, but hey got my piccies (most of which were trash because it was dark as fuck and i was half concentrating on trying to ride a motorbike without crashing)
