Difference between revisions of "Data recovery using Photorec"

From FreekiWiki
Jump to navigation Jump to search
Line 1: Line 1:
[http://www.cgsecurity.org/wiki/PhotoRec  Photorec] is a free software tool capable of recovering data even when files have been erased or dirves formatted. It works by ignoring the file system and searches for known file headers in the underlying data. It will recover many types of files but cannot recover file names. To run it simply type  
+
[http://www.cgsecurity.org/wiki/PhotoRec  Photorec] is a free software tool capable of recovering data even when files have been erased or drives formatted. It works by ignoring the file system and searches for known file headers in the underlying data. It will recover many types of files but cannot recover file names. To run it simply type  
 
  sudo photorec
 
  sudo photorec
into a terminal and follow the prompts. '''Make sure you store the recovered data in its on directory on a different partition/hard drive'''. N.B. It can take up to a week to complete it's task depending on the size of the drive etc. You should be able to select file types though we normally recover everything and deal with it later.  
+
into a terminal and follow the prompts. '''Make sure you store the recovered data in its own directory on a different partition/hard drive'''. N.B. It can take up to a week to complete it's task depending on the size of the drive etc. You should be able to select file types though we normally recover everything and deal with it later.  
  
 
Thumbnails found inside pictures are saved as t*.jpg
 
Thumbnails found inside pictures are saved as t*.jpg

Revision as of 13:17, 24 May 2012

Photorec is a free software tool capable of recovering data even when files have been erased or drives formatted. It works by ignoring the file system and searches for known file headers in the underlying data. It will recover many types of files but cannot recover file names. To run it simply type

sudo photorec

into a terminal and follow the prompts. Make sure you store the recovered data in its own directory on a different partition/hard drive. N.B. It can take up to a week to complete it's task depending on the size of the drive etc. You should be able to select file types though we normally recover everything and deal with it later.

Thumbnails found inside pictures are saved as t*.jpg If you have chosen to keep corrupted files/file fragments, their filenames will beginning by the letter b(roken).

Once it has recovered the data you will be left with a variety of files in side different folders. There is a script called

data-sort

that will sort these by file extension. You can then use this to narrow the files down to the more useful ones. For instance it will often recover ELF which are not needed, where as jpegs most certainly are.