JPEG Recovery With Foremost: Filtering Results

Following my previous article, I’m writing my experience with foremost.

My mother had its Windows XP/Vista ravaged out by her son. She was very happy with Linux Mint until she asked me: «Where are our dog’s photos? They were stored in $randomproprietaryapplication with the extension .ads and I can’t find them».

Ooops. I wiped it. «Gimme the laptop mom, I’l, find them.»

I used foremost as follows:

foremost -v -t jpeg -i /dev/sda1 -o /media/Enermax/BKP 

According to the audit.txt file, it scanned 108GB of disk in 1 hour, and found 19517 jpegs. OMG OMG OMG.

So let’s narrow it down a bit, shall we? I made a little script that moves files bigger than a predefined size (in this case, 500000) in another directory (jpg500):

#!/bin/bash
i=0
for filename in $( ls jpg/* ); do
	filesize=$(stat -c%s "$filename")
	if [ $filesize -gt 500000 ]; then
		mv $filename jpg500
		i=$((i+1))
	fi
done
echo $i

Well, here are the statistics:

  • JPEGs bigger than 500KB: 1773, only valuable pics
  • Between 400KB and 500KB: 0
  • Between 300KB and 400KB: 0
  • Between 200KB and 300KB: 776, valuable pics
  • Between 100KB and 200KB: 1441, valuable pics
  • Between 50KB and 100KB: 0
  • Between 40KB and 50KB: 1087, here you find thumbnails and crap
  • Below 40KB: 14440, crap to be shredded

So, rule of thumb, know your target. If you want to recover pics taken with your digital camera, go for the 500KB+ files. If you want to recover everything, stay above 100KB. Below 100KB, it’s only waste.

2 thoughts on “JPEG Recovery With Foremost: Filtering Results

  1. Fab scrive:

    Hi
    6th line of your script is buggy i think (missing a /) but thanks for the hint !

    #!/bin/bash
    i=0
    for filename in $( ls jpg/* ); do
    filesize=$(stat -c%s “$filename”)
    if [ $filesize -gt 500000 ]; then
    mv $filename jpg500/
    i=$((i+1))
    fi
    done
    echo $i

  2. sevencapitalsins scrive:

    Thanks for the correction, I didn’t see the bug because I created the directory “jpg500” before running the script.

    The correct way would have been to create the directory before beginning the loop, so the script becomes:

    #!/bin/bash
    mkdir jpg500
    i=0
    for filename in $( ls jpg/* ); do
        filesize=$(stat -c%s “$filename”)
        if [ $filesize -gt 500000 ]; then
            mv $filename jpg500/
            i=$((i+1))
        fi
    done
    echo $i
    

Lascia un commento

Inserisci i tuoi dati qui sotto o clicca su un'icona per effettuare l'accesso:

Logo WordPress.com

Stai commentando usando il tuo account WordPress.com. Chiudi sessione / Modifica )

Foto Twitter

Stai commentando usando il tuo account Twitter. Chiudi sessione / Modifica )

Foto di Facebook

Stai commentando usando il tuo account Facebook. Chiudi sessione / Modifica )

Google+ photo

Stai commentando usando il tuo account Google+. Chiudi sessione / Modifica )

Connessione a %s...

%d blogger cliccano Mi Piace per questo: