Recover true JPG file size and hash value

Many recovery programs will scan a disk for the start of a JPEG file as can be seen by a sector starting with the values FF D8 FF.  The scan will the continue to the next possible file start.  For sequential JPG file this will display correctly and will make customers happy.

CnW Recovery software goes a few stages further. The above routine is used, but then the file is validated. The validation will determine if the file is valid and if so, it will be able to calculate the correct file size.  Once the correct file size is determined, a valid MD5 has value may be calculated.  A further part of the validation is that some of the file meta data is extracted and added to the filename, along with the date taken as generated by the camera.

For a forensic investigation, looking for files with known MD5 values can save a lot of time, along with being able to sort on file date, even though the file has been extracted from a raw recovery.

Another important feature of CnW Recovery, while doing a raw scan of an NTFS disk, if the disk has been compressed with the standard NTFS compression, then CnW software will still extract the data, although due to fragmentation, the success rate is not always 100%

To evaluate CnW Recovery software, download demo now.