photorec

Run PhotoRec on a specific device

$ sudo photorec [/dev/sdb]

$ sudo photorec [path/to/image.dd]

photorec [<options>] [<device_or_image>]

When run without arguments or with a device/image, photorec typically starts an interactive, text-based user interface to guide the recovery process.

Examples:
photorec
photorec /dev/sdc
photorec my_disk_image.dd

/d <directory>
    Specify the destination directory where recovered files will be saved. This is often used to override the default interactive prompt.

/log <filename>
    Write log messages to the specified file instead of the default photorec.log.

/debug
    Enable debug messages for detailed output, useful for troubleshooting.

/keep_corrupted_files
    Instructs PhotoRec to save files even if they appear to be corrupted or incomplete.

/nonfree
    Enable the recovery of non-free file formats, such as certain proprietary audio, video, or image formats. By default, PhotoRec may restrict recovery to open formats.

/cmd <device> <partition> <filesystem> <output_dir> [options]
    Run PhotoRec in non-interactive mode. This requires specifying all necessary parameters directly on the command line, including the device, partition (or 'none' for whole disk), file system type, and output directory.

/search
    Used in non-interactive mode (with /cmd) to immediately start the file carving process without requiring user confirmation.

/disable_all
    Initially disable all known file types. This can be combined with /enable to recover only very specific file types.

/enable <filetype_list>
    Enable specific file types for recovery. <filetype_list> is a comma-separated list of file extensions (e.g., jpg,doc,mp4).

/disable <filetype_list>
    Disable specific file types from being recovered.

PhotoRec is a free, open-source data recovery utility designed to recover lost files, including video, documents, archives, and pictures, from various digital media like hard disks, CD-ROMs, USB drives, and memory cards. It operates by ignoring the file system and going after the underlying data, searching for file headers and footers (known as file carving). This allows it to work effectively even if the file system is severely corrupted, formatted, or repartitioned. PhotoRec is non-destructive, performing read-only operations on the compromised media, ensuring no further damage is done during the recovery process. It is part of the TestDisk suite of data recovery tools, which also includes TestDisk for partition recovery.

Never write to the recovery source: Always recover files to a different storage device or partition to avoid overwriting the very data you're trying to recover.
Data Overwrite: Success depends on how much new data has been written to the disk since the files were lost. Overwritten sectors cannot be recovered.
Lost Filenames and Structure: PhotoRec recovers files based on their content signatures, not the file system metadata. Therefore, original filenames, creation dates, and directory structures are lost. Recovered files are typically named numerically (e.g., f0000001.jpg).
Disk Space Requirements: Recovered files can occupy a significant amount of disk space, potentially more than their original size if fragmented or multiple versions are found. Ensure your destination drive has ample free space.
Root Privileges: Accessing raw disk devices usually requires root (administrator) privileges.

By default, when photorec is run without specific command-line arguments, it launches a curses-based interactive menu. This guided interface allows users to easily select the disk, partition (or entire disk), file system type (if known, or 'Other' for raw), and the destination directory for recovered files. This mode is highly recommended for most users due to its ease of use.

PhotoRec employs a technique known as 'file carving'. Instead of relying on the file system's structure (which might be corrupted or missing), it scans the raw sectors of the storage device. It looks for known file headers and footers (signatures) that indicate the beginning and end of specific file types. Once a header is identified, PhotoRec attempts to read and save the subsequent data until it finds a footer or estimates the file's end based on its internal structure. This method allows it to recover files even from severely damaged or formatted media.

PhotoRec organizes recovered files into sequentially numbered subdirectories within the specified output location. For example, if you choose /home/user/recovered as the output directory, PhotoRec will create /home/user/recovered/recup_dir.1, /home/user/recovered/recup_dir.2, and so on. Files are placed into these directories and renamed numerically (e.g., f0000001.jpg, f0000002.doc) because the original filenames and directory paths are typically not recoverable.

PhotoRec was developed by Christophe Grenier as part of the TestDisk data recovery suite. Initially released with a focus on recovering photos from digital camera memory cards, its capabilities quickly expanded to include a wide variety of file formats beyond just pictures. It has seen continuous development, evolving into a robust and widely-used tool for recovering data from damaged or formatted partitions and media, regardless of the underlying file system.

testdisk(8), dd(1), foremost(1), scalpel(1), lsblk(8), fdisk(8)