After some very successful photo sessions in Africa, my collection counted like 2000 photos. I was quite happy since most of them were good to show to my friends.

Once in the evening I open my Picture folder in Ubuntu and found that it is empty. Completely empty, nothing was there. I was totally destroyed, shocked.

But I stayed optimistic, since nothing is lost without tracks, even in some cases it is very hard to destroy piece of information.

I found out that undelete does not work well on ext4. Some undelete utility found nothing on that drive related to recently lost file. Looking for other undelete programs I found whole another bunch of restore programs that work based on file signatures.

These programs analyses your HD like a flat file, looking for common signatures of JPEG or other files and tried to restore them.

# Meet foremost

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive.

Most important rule: Do not restore to the same drive. Basically you want to touch source drive as little as possible. $ foremost -t jpg -i /dev/sda5 -o /mnt/restore/ /dev/sda5 - is partition that holds my /home partition, /mnt/restore is another partition on same drive to hold restored images. Be sure that target directory can room all restored files, because it restored everything, is it deleted or not.

# Filtering photos

After one night work, it restored thousands of files. That included all not really useful images as well, like my browser cache.

To filter only needed one I grep collection using camera ID stored in EXIF part of picture, using this command: $ find /mnt/restore/* -exec grep -L "PowerShot G12" {} ; | xargs -L 10 /bin/rm It removed all photos where "PowerShot G12" was not found inside. My collection was almost intact, except several files and fact that I had to sort it in folders once again.


You can found out more on official Data recovery page here