Big trouble with JPG

Software
1

I am a total new comer to this field. I have been catalog jpg’s for decades. My WIN 10 computer froze in an update and I had to use Recovery disc. I got the computer up and running, but lost my data. I tried to restore my data using my external drives. Now, the jpg’s will not display correctly. A few will but the bulk appea as a big red “X”, a blue moungain icon or as a thumbnail with a THUMBSUP image. ((Note: I used ThumbsPlus programfor 20 years). I tried GM and receive tghat the image is not a JPG because it sgtat with 0x42 010.

I have thousands broken down in folders (i.e.family, vacation, art covers, etc.)

How can I recover these files. Is there an automated program to do this? Is there someone I can hire.

Thanks in advance.

2

I am no computer expert so I can be of little use here and defer to more knowledgeable people who answer you on this forum. However, losing your data on your computer would have no impact on your image files stored on the external drives. Your catalog system may have been stored on your computer and that may be screwed up, but the images themselves should be safe and untouched since they are on an external harddrive.

Try using the file explorer option in Windows to check the file structure on your external drive and to confirm the pictures are where they should be.

Good luck with this. I am sorry to hear about your problem during the update.

3

You’ll want a program called photorec.

4

Data loss or corruption is terrible and happens to the most careful of us, even when we have backups. Sorry that it happened to you.

Failed updates can certainly cause this and can be hard to recover, especially if you tried to recover or repair it, or the file system or files were previously encrypted or compressed.

What is done is done, but moving forward, the first thing you should do if you can is STOP using your storage device, whether it be a hard disk, solid state or whatever drive. If that is where you Windows installation is, STOP using it. Use another computer for now, or pull out the drive and use another to install Windows. The worst thing you can do is continue to overwrite on top of what you lost.

Oftentimes, cookie-cutter recovery prompts by Windows, using recovery disks or disk/sector repair utilities are super dangerous because they rewrite/overwrite the partition tables and the data itself.

And if you can, make a true bit-to-bit backup of the drive in case your frozen update had to do with an issue with the drive itself.

A perfect clone gives you a chance to rescue your data without risking the data itself because you now have a backup and are doing your operations on a drive you know that works fine.

STOPPING also helps you cool your head and formulate a sane strategy.

Now, after considering the above, you may then consider various strategies. Photorec is an excellent piece of software. The same dev has other tools that address disk recovery (partition, file, etc.), but that can be difficult to understand and do for a beginner in data recovery and forensics. Also, you would have to sift through broken and old data structures, files, folders and partitions.

There is an app that can open broken JPEGs and embedded JPEGs in raw files, but I forget its name and do not know if it is still available or actively being maintained.

Lastly, there are a few threads on this forum on recovery that you may want to search and read through. I contributed to some of them.

Please try to do some of it yourself with the care addressed above before exploring professional services. Mostly likely you would be charged exorbitant sums for a subpar one-click solution. You are wise to ask for help here and elsewhere.

1 Like
5

What is “GM”? Can you find out what the correct value that means “I am a JPEG” i.e. is not “0x42010”.

If so, then can you or someone (not me) write a batch script that wizzes through all your “JPEG” files inserting the right value in the right place?

All the best from this old man …

6

There are a few JPEG file magic numbers, I think the main one is FF D8 FF E0.

I think you may need to extract the disk and plug it in to a working computer to see if that fixes it. If not, something like PhotoRec may work.

7

If there is corruption, the chances that all the other bytes in the file (that actually make up the image) are correct, and only the ‘magic number’ (file type ID) is wrong, are infinitesimal.

8

PhotoRec is great – when recovering from a disk that was quick-formatted (just resetting the file system structures, but not overwriting the data), or when the partition table was lost.

However, it relies on the magic number, while Richard said those bytes in the headers were no longer the expected ones:

For example, PhotoRec identifies a JPEG file when a block begins with:

  • 0xff, 0xd8, 0xff, 0xe0
  • 0xff, 0xd8, 0xff, 0xe1
  • or 0xff, 0xd8, 0xff, 0xfe

(Source: How PhotoRec works)

9

Are the jpgs stored on the external drive or your computers drive?

1 Like
10

Let me check in to it. Thanks. RDG

11

I have a two SSD’s my computer – One for Win10, the other larger one for some of the data and operation… I was in the middle of a WIN10 upgrade when froze for hours.l I finally turned it off and back on, it would not start windows. I used my recovery disk, tried to reset the computer and save data. Didn’t work. I finally opted to reset the whole computer and reinstall my aps and data. Got MOST of the apps reinstalled,but MANy the images were corruter,man had file post, rewritten in other formats; I decided t0 use my external backups.Ther results were the same. I lost data from two external drives and an internal ssd. I have ceased to recover files. Unfortnately, BITDerfender, is finding 155 piece malware (if run a scan everyday>

Sigh…RDG

12

Then, if you suspect your computer has been compromised, you should stop using it, wipe it thoroughly, reinstall everything from clean installation packages, and restore data files, if there are any that can be salvaged. Using a known/suspected to be infected computer is inherently unsafe.

1 Like
13

I have the sinking feeling that one or more of those pieces of malware is ransomware and that is why all of the backups are now not only corrupted but probably completely encrypted.

14

Yes, that could well be the case – though then I’d expect a message demanding payment. Still, all the backups becoming suddenly corrupted does suggest ransomware, or a very broken chipset driver corrupting all disk I/O.

I store backups in the cloud as well as locally, completely decoupled from my machine (just syncing once in the evening). Maybe a provider that supports storing several versions of backup files (BackBlaze is one) could help – as long as one discovers the corruption within the cloud’s configured history window, files can be recovered even if the malware manages to upload scrambled files, overwriting what you have in the cloud. You could revert to versions of the files from before the scrambling.

This is from BackBlaze’s config screen (I’m not an affiliate, just have used the service, with encrypted Borg backups (encrypted by the backup tool, that is)):

image
image843×412 21.5 KB

15

Suggestion. Disconnect all hard disc drives from your computer except your Windows drive. Boot up then download Malwarebytes. Run Malwarebytes to see if it finds any Ransomware. If it does search the web to see if there are known decryption methods for the Ransomware your computer has been infected with. If you are lucky and there is a decryption method, attempt to decrypt your drives one at a time. If you manage to decrypt one, disconnect it then move on to the next. Once done reinstall Windows. Download fresh copies of your software from trusted sources.