[Samsung Galaxy Nexus] bmckenna:
I've had a pretty long journey so far trying to get these pictures back, and I feel like I'm really close but not quite there.

I attempted to flash JB onto my Galaxy Nexus and wound up in a bootloop. I had made a nandroid but did not back up the /sdcard/ folder...restored back to stock and my files were gone. Bonehead move, admittedly.

So, the past week has been how to get a dd image of the phone to try and do some file carving. I wound up soldering wires to the pins of the phone and using an adjustable 8V/2A max power supply to keep it running long enough to create a dd .img file on a usb thumb drive over an OTG cable. I've got said image, which is 30.7 GB (30,691,802,112 bytes), so I'm pretty confident I've got the entirety of the drive (used /dev/block/mmcblk0p12).

I wound up trying scalpel, photorec, foremost, and testdrive to see if I could pull the jpg files out, but so far nothing has proven helpful. I've got a ton of cached jpg images from web browsing/pandora album art/handcent compressed images sent via MMS, but absolutely nothing from the DCIM folder (had somewhere around 150 files in there in total).

I took a look at the scalpel carve settings and realized that while the first 3 hex values matched, the second 3 did not before the Exif data...

scalpel's default jpg setting:

# jpg y 200000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9

I had an old backup of my /sdcard/ so I compared headers of JPG files in there:

\xff\xd8\xff\xe1\x90\xb0 (older image, possibly taken with Droid X)

\xff\xd8\xff\xe1\x27\xab (newer image definitely taken with GNex)

So I changed the string in scalpel to be "\xff\xd8\xff???Exif" for the footer, which creates wildcards for the fourth through sixth values and then prompts for Exif data (as opposed to JFIF data, as most of the downloaded JPGs had, which weeded out a lot of "false positives").

I wound up getting far fewer values but most of them were images that had been sent over MMS (taken on that phone), so I know I'm on the right track. The part that is confusing to me is the footer...because the files I've looked at using "od -cb" which will do an octal export all have different footers...so I'm not sure if there's metadata that can change at the end of the files or what. I've tried using \xff\xd9 REVERSE (since apparently \xff\xd9 is the standard footer for JPG files) as the footer which provided results, just absolutely nothing out of DCIM. I also tried using no footer and grabbing the 2.5MB immediately following...got the same image files as the previous command except they were all 2.5mb in size).

Am I going crazy? Is DCIM not located on that block I got the data export out of (I can't think of anywhere else it would be other than /userdata/, which I believe is mapped to that block)? I find it hard to believe that I could recover files that most likely haven't been touched in months with no problems, but I can't recover picture files that were taken just before the partition got destroyed. I think something is either wrong with my header/footer specifications with regards to the JPG files generated specifically by the GNex (since apparently they vary when compared to other JPG images taken by phones and also amongst different images all taken by the phone) or I'm just missing something.

Any help is greatly appreciated.