Recover Deleted Fles From Canon SD Card (FAT32) on OpenSUSE

It happens. You delete files on your SD Card with family films to realize you don't have the backup @#$@(#@*&$!@(#$!!!!

Luckily the SD Card use old FAT32 => when I won't write any new data on the card I should be able to simplly un-delete the files.

Here are my 8 steps to the rescue:
=========================

1. Put SD card into the card reader

2. Unmount the card (find it using mount command)

unmount /dev/sde1

3. Get the card raw data (has anyone tried to create a boot-able SD card?)

sudo dd if=/dev/sde of=sde.raw

4. Display the image structure:

fdisk -l sde.raw

Disk sde.raw: 31.9 GB, 31914983424 bytes, 62333952 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x00000000

  Device Boot      Start         End      Blocks   Id  System
sde.raw1            8192    62333951    31162880    c  W95 FAT32 (LBA)

5. Install SleuthKit (I had it installed)

See http://www.sleuthkit.org/informer/sleuthkit-informer-14.html for info on FAT recovery

6. Browse the image using fls tool (notice I start from offset 8192 with 512 bytes/sector) to find the deleted files inodes:

fls -b 512 -o 8192 -f fat sde.raw

r/r 3: CANON       (Volume Label Entry)
d/d 4: PRIVATE
d/d 5: DCIM
v/v 996950019: $MBR
v/v 996950020: $FAT1
v/v 996950021: $FAT2
d/d 996950022: $OrphanFiles

fls -b 512 -o 8192 -f fat sde.raw 4
d/d 1029: MY_MUSIC
d/d 1030: MY_PICT
d/d 1031: CVINFO
d/d 1032: AVCHD

fls -b 512 -o 8192 -f fat sde.raw 1032
d/d 5125: BDMV
d/d 5126: CANON

fls -b 512 -o 8192 -f fat sde.raw 5125
d/d 6149: BACKUP
d/d 6150: PLAYLIST
d/d 6151: CLIPINF
d/d 6152: STREAM
r/r 6153: INDEX.BDM
r/r 6154: MOVIEOBJ.BDM

fls -b 512 -o 8192 -f fat sde.raw 6152
r/r * 10245: _0000.MTS
r/r * 10246: _0001.MTS
r/r * 10247: _0002.MTS
r/r * 10248: _0003.MTS
r/r * 10249: _0004.MTS

...

Bingo!

7. Extract the files using icat tool

icat -b 512 -o 8192 -f fat -r sde.raw 10245 > _0000.MTS
icat -b 512 -o 8192 -f fat -r sde.raw 10246 > _0001.MTS
icat -b 512 -o 8192 -f fat -r sde.raw 10247 > _0002.MTS
icat -b 512 -o 8192 -f fat -r sde.raw 10248 > _0003.MTS
icat -b 512 -o 8192 -f fat -r sde.raw 10249 > _0004.MTS
...

8. Voilà! Marriage is rescued again! ;)