The data recovery engineer got one SD card and according to the owner of SD card, the photos in the card are the wanted data and very important to the client. When the photos were clicked to open, they didn’t open; all photos had the same problem without response when trying to opening them.
The very first thing to do was to image the SD card to keep the original data status and this was also to respect the client and his data. All operations need to be careful and smart.
Next the engineer checked the DRB, FAT table and FDT but they’re all in good status and therefore, needed to diagnose further.
Next the engineer copied the photos out to the local disks and tried to open some of them in winhex to look inside the file contents. These photos were jpg format.
The engineer selected 4 jpg photos to open in winhex:
And at the same time, the engineer opened one normal jpg photo to compare with above 4 un-opened jpg photos.
By comparing the un-opened the photos and normal photos, we could easily find the file header was different. The normal header should be started with ‘FF D8’ but the one for un-opened photos was ‘C7 E0’.
The engineer tested from the first byte C7 because he trusted from FF to C7, there must be some kind of algorithm changed, usually it’s the XOR algorithm.
Next the users tried to XOR calculate the changed value:
FF XOR C7
The result was 38
The engineer confirmed again by the second byte E0 XOR 38=D8 and therefore, the engineer judged the un-opened photo files had one XOR 38 algorithm change.
Next the engineer opened the SD card using winhex and select all un-opened photo files’ data area to do the XOR 38 calculation to make the files restored to the normal file contents.
Next all the photos were able to be opened normally.
For a higher success rate of hdd repair and data recovery, cheers! Dolphin Data Lab will continue sharing and teaching more real hdd repair and data recovery knowledge. Full pdf document with details is available for Dolphin Data Lab users only here.