Hardcore data recovery
I did the unthinkable. I modified one of my digital pictures in a destructive way, clobbering the original. Namely, I resized it down to 1024x768. I did it by mistake, due to a brain fart, but it was still maddening. I wanted my original image back.
I succeeded thusly:
- List inodes of surrounding image files (i.e. the ones before and after the one I clobbered)
- Use debugfs to print the block ranges those files use
- Verify the sequential files fall roughly on sequential blocks
- Write a program to scan given blocks, look for JPEG start of image and end of image markers, and extract the blocks where those markers lie
- Run the JPEG scanner on the block range obtained earlier
- Extract EXIF thumbnails from resultant files
- Look through thumbnails to find image in question
- Remove the 13th block -- which is called an IND, or indirect block -- from the file
- Enjoy the fruits of my labor
Update: added more detail