Who is Fat Gundel?

FAT-Gundel may sound like a disrespectful name to German ears, but its an acronym that was build from the words FAT-filesystem, Graphics, and UNDELete. It is a small command line program I wrote (had to write) back in 2006, when a friend of mine erased all her St. Petersburg photos on her digital camera. She gave me an emergency phone call, and I advised to pull out that erased SD-card immediately, bring it home safely, and buy a fresh one for the rest of the holidays.

This gave me 2 weeks hunting the internet for possible windows (or Linux?) software that would allow me to restore the erased photos. I downloaded several eval-versions of commercial software, and also freeware. Most of the software I found, could only find very few images on the SD-card, or just failed to work. It turned out, that my friend had already taken 30 photos after she noticed the erase. This fact appeared to make the task much harder.

Some software claimed they would employ more advanced algorithms for buying the pro version, and such things. I did not trust them. Others had possible functionality obscured by a complex GUI. Not my style either. Instead I studied carefully what is really needed to restore deleted images.

Not much, actually. An old-style input-process-output model would do.  No fancy  user interaction. It became a simple 200 lines C-program, that would take a single parameter, the name of the raw device, (or an dd-image of the same). Optionally a directory where to put the images.

The algorithm is as simple as this: find a JPEG magic number, collect blocks, find the next JPEG magic number. All the date from one JPEG header up to the next is an image. This is very crude, but it works surprisingly well. It does not care about file-system fragmentation, does not know the correct length of a file, does no sanity checks. Most of the time some amout of additional garbage is found at the end of each file. Sometimes filesystem fragmentation causes images to be chopped into pieces, which returns images that most JPEG parsers still load fine, but are mixed up. I’d say, that 95% of all images are perfectly restored. Obviously fragmentation is almost no issue with digital cameras.

Today a colleague of mine scratched, trying to dd-rescue a faulty SD-card. I advised to try out fat-gundel, and it refused to do anything, as there was no FAT-signature in the superblock. Okay, so that is something different,  the superblock is damaged. I added a few environment variables, to control this situation, most important FAT_NO_SIG, to get past the missing signature. Recompiled and tried again.

We successfully grabbed 317 images from his SD-card, more than he actually expected. And he could not name a single image that would be missing. Strike!

A range of fat-gundel binaries are available in the Open Build Service.

Source code is in my home project @ OBS.

This is version 0.3 as of today, some 350 lines of code, and still not exactly user-friendly, unless you are at home on some Linux shell. If someone would like to contribute a simple python-gtk or pyqt user interface for the benefit of desktop users, please let me know. Also, a JPEG parser could be added to detect mixed up images, and maybe puzzle the pieces back in order. This would also allow us to strip off any garbage from the end of the files.

Advertisements