Image gallery: Surviving a home data disaster

Recovering 736 missing digital images can be an arduous (and expensive) task.

Here's what undamaged (left) and damaged (right) JPEG files look like at the bits and bytes level from within the Windows NT Device Examination utility. (Full description below the image.)
Image 1

In the window on the left, the file to be recovered is undamaged. The first four columns contain hexadecimal code and the fourth translates that into the ASCII text description. Notice the "Exif" header and the words "Eastman Kodak Company" in the body of the file. That's the signature, indicating the beginning of a new file. (The string of zeros underneath the header might look suspiciously like damaged or missing data, but that's actually an unused location where additional metadata about the picture can be stored.)

Now look at the window on the right, which shows a view of what should be another JPEG image that came from the same folder as the first. The letters "MZ" at the top of the last column indicate the point where this deleted file was overwritten by a new file. The letters that form the new file header indicate that this is a Windows executable file. (The letters are also the initials of Mark Zbikowski, one of the designers of MS-DOS. But that's another story.)

A Windows dynamic link library file has completely overwritten the entire image file, including the original file header, irreversibly damaging it. This photo was lost.

Return to Surviving a home data disaster: How Shirley got her files back

Copyright © 2007 IDG Communications, Inc.

1 2 3 4 5 Page 5
Page 5 of 5
7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon