Now let’s get our hands dirty. First step is getting a safe copy of our memory card contents into a file within our hard disk. This will allow us to play around with its contents way faster than we would by just reading the card every single time.
If you haven’t written anymore to your card since the lost files where removed, your chances for a flawless data recovery are almost of a 100%. As many files you (or your camera) have written to the card, less chances of getting back your files.
This happens because most filesystems don’t erase file data when the file is deleted. They just mark that space as “free”, so that other files can use that available space. If no files were written to your card after deleting those files, then you can be sure your data is still there, only the path to it is lost.
Back to the memory card data dump issue, we well need to open the Terminal program in order to pull some UNIX swiss-army-knife tricks. I assume your memory card is inserted in your card slot, or camera’s slot while the camera is hooked to your PC via USB. If you did this correctly (and if you didn’t, stop reading this post), you should be able to access the card’s contents using Finder without much problem. Now switch back to the Terminal and type “mount”, then you should get some stuff like this:
/dev/disk0s2 on / (local, journaled)
devfs on /dev (local)
fdesc on /dev (union)
/dev/disk0s3 on /Volumes/Untitled (local, read-only)
automount -nsl [185] on /Network (automounted)
automount -fstab [189] on /automount/Servers (automounted)
automount -static [189] on /automount/static (automounted)
Find out which line represents your memory card device and note down the device filename for it (the first path before the “on” word), stripping the last two characters (sX), where X is a integer number.
Finally, we’ll use UNIX command “dd” to dump all the raw binary contents of the card to a file in our HD (replace “/dev/disk2″ with the path you got in the previous step):
dd if=/dev/disk2 of=~/memory-card-dump.bin
Dumping the data will take some minutes, depending on the size of the memory card and the transfer rate of it. For instance, dumping my humble 128 memory stick took around five minutes.
After the command finishes, you will have a perfect binary copy of your memory card (containing you valued pictures somewhere), ready to be analyzed and processed as many as we need. Don’t you start loving this thing?.