Case of the Missing Nikon NEF files

Sd Card corrupted with No NEF FILES.

A client came to me after a holiday in Egypt saying that the SD-CARD he had been using was somehow corrupted. The client was using a Nikon D3300 camera and there were some jpegs and but no NEF files on the card. The client was positive what was there was not enough given how many shots he had taken on that day. NEF files are Nikons raw high resolution format and I would have expected to find a truckload of these on the card. My client was unaware of Nikon’s NEF format

Scan with r-studio built in signature produced no NEF files

The first thing to do was to scan the SD card with my tried and trusted data recovery software R- Studio . In this case we perform a Raw Recovery and use R-Studios in-built signatures to detect the missing NEF files.
Normally , the partition table is used to locate files on a SD-CARD So the partition table is a like an index in a book. R-Studio ignores the partition table and scans for known file types in lieu of this partition table by searching for identifiable file signatures starting from the start of the SD-CARD and moving linearly to the last sector. Almost every file type has a recognizable data pattern (i.e. file signature or magic number) that acts like a fingerprint for the file type. File signatures occur at the beginning of the file at a certain offset, and in many cases, at the end of the file as well. By scanning for these file signatures, R-Studio can identify and recover files and data, as long as it’s a known file type.

R-Studio did not manage to find any NEF files with it’s in-built signature as shown by the screenshot below.

Examination of SD-CARD indicated 1666 NEF  files might be available

The fact that we found no Nikon NEF files using R-Studio signatures seemed very odd so I went about  examining the 32gb SD with a HEX editor  to see if there was anything that looked like a picture file. The screenshot below has familiar info indicating that this is the start of a picture file as it contains the Camera Make, Camera Model, Date & Time.

On further examination of the whole SD-CARD I found 1668 images.

If I was right about this being the start or header of a Nikon raw file then I could establish how many of these headers existed on the SD-CARD by searching for some text that exists in each header. The camera model type meets this criteria and after searching the whole SD-CARD it appeared  there were 1668 missing images.

There were many things puzzling me as by now I had tried  other data recovery software tools that claimed to be able to scan and find Nikon NEF files however none of these tools find could find any.

So the only thing to do now was to create myself a signature with R-Studio to find these images. Now there is a guide on how to do this at https://www.r-studio.com/creating-custom-file-type-r-studio.html so I don’t really want to get into the detail of how you do this but I will explain my reasoning.

To be able to identify a signature for a file you have to identify when the file starts and of course when it ends.

To find the start of the Nikon D3300 images on the SD-CARD I identified the following  ÿØÿáÿþExif??II*?   ascii string which is easier to look at by it’s hexadecimal equivalent

 FF D8 FF E1 FF FE 45 78 69 66 00 00 49 49 2A 00.

The text below is the xml file created by R-STUDIO which indicates the start series of HEX values.

<?xml version=”1.0″ encoding=”UTF-8″?>

<FileTypeList >

    <FileType id=”50001″ group=”Other Files” description=”Nikon” features=”” extension=”nef”>                    <Signature>\xFF\xD8\xFF\xE1\xFF\xFE\x45\x78\x69\x66\x00\x00\x49\x49\x2A\x00</Signature>

      </FileType>

</FileTypeList>

There was no discernible string of characters indicating the end of these files however given that the SD-CARD was only used to shoot images in the Nikon D3300 and that we found 1668 of these files then they should be the only files on the SD-CARD. In addition these files should be laid out consecutively on the card. Why is this important well as R-Studio finds files using my header signature it should in theory close off the previous file it had found and mark the end of file just before the new header.

My thinking was this could work although it might screw up the size of the files

Well as the snapshot above indicates we found 1666 files with this technique all readable as NEF files and most definitely pics of Egypt. The size of the files recovered indeed were incorrect but very much readable as images some of which can be  seen below

For more ino about our Camera Card Data Recovery Services