Okay, so now we have a raw copy of the memory card in a file. What to do with it? The more obvious thing would be to get a hex editor, look for JPEG headers and figure out a way to extract all the data after those to separate files.
Actually, that is what we are going to do but in a more automatic way. Say we can write code in any language powerful enough to do some basic file input/output operations efficiently, then why not writing a short program which scans our big data dump from top to bottom, and then dumps chunks of a fixed size to sequential files?
Now before you get all excited about how easy and perfect this method is, let me tell you one thing: the JPEG format is a tricky lady. Computing the size (in bytes) of a JPEG file from its header requires a deep knowledge of the structures and algorithms involved in the JPEG image compression/encoding standard. My approach is to just extract the 2 MBs of data following each occurrence of a JPEG header (I know my digital camera never produces files larger than that). Part IV will explain how to optimize those 2MB files once we have recovered them.
I could get really technical here on how my code works and all that, but I think there is no rocket science in a pattern search program like this and therefore the source code is way enough to get an idea, so here’s the source code.
Anyone can build the source using a decent C compiler like GCC or Microsoft C/C++ compiler (both are free by the way). Once you have compiled the source code, you can run it from the command line like this:
./jpegrescue memory-card-dump.bin 2097152 jpg
With this, you are telling the program to scan the file “memory-card-dump.bin” and dump the 2 first MBs after each occurrence of the JPEG header, using “.jpg” as the output file extension. And… that’s basically it! after a few seconds (or minutes, depending on the input data size), we should have a bunch of jpeg files located within the same directory we ran the application from. If your card has been used enough times, you’ll be astonished about the amount (and age) of pictures recovered.