LinuxCommandLibrary

photorec

Recover lost files from various storage devices

TLDR

Run PhotoRec on a specific device

$ sudo photorec [/dev/sdb]
copy

Run PhotoRec on a disk image (image.dd)
$ sudo photorec [path/to/image.dd]
copy

SYNOPSIS

photorec disk_image [options] or photorec

PARAMETERS

disk_image
    Optional: Specifies a disk image file as the source for recovery. If not provided, PhotoRec presents an interactive selection of available drives.

-h
    Displays the help message.

-v
    Displays verbose output.

-d destination_directory
    Specifies the destination directory for recovered files. This is used only when not running in interactive mode.

-t ftype
    Specifies file type to recover. This is used only when not running in interactive mode.

DESCRIPTION

PhotoRec is a powerful, free, and open-source data recovery software tool. While its name suggests a focus on photo recovery, it is capable of recovering a wide variety of file types from hard drives, CD-ROMs, memory cards, USB drives, and other storage media.

Unlike many file recovery tools, PhotoRec ignores the file system and instead searches for data signatures. This allows it to recover files from severely damaged or reformatted media, even when the file system is corrupted or missing. The software is designed to be user-friendly, guiding the user through the recovery process with a menu-driven interface.

The recovery process involves selecting the target device, specifying the file types to search for, and choosing a destination directory to save the recovered files. PhotoRec also allows you to customize the search by adjusting parameters such as carving parameters, allowing for more targeted and efficient recovery. PhotoRec does not write to the drive it is recovering from, but requires a destination directory. It is a command line tool and thus can be automated in scripts.

CAVEATS

PhotoRec is not designed to recover specific, deleted files. It recovers files based on file signatures and may recover fragments or incomplete files. The recovery process can be time-consuming, especially on large drives. Recovered filenames may not be original, and the software may assign generic names like recup_xxxx.ext.

FILE CARVING

PhotoRec employs a technique called 'file carving.' This involves scanning the storage medium for file headers and footers, identifying potential files based on these signatures. Because it operates at a low level, it doesn't rely on the file system's integrity.

SUPPORTED FILE SYSTEMS

While PhotoRec bypasses the file system for recovery, it can recognize various file system types, including FAT, NTFS, ext2/ext3/ext4, and others. This information is used during drive selection and partition analysis. But it works on a signature basis.

ETHICAL CONSIDERATIONS

When using PhotoRec on storage devices that you do not own, ensure you have proper authorization. Data recovery can expose sensitive information, and unauthorized access is illegal and unethical.

HISTORY

PhotoRec was developed alongside TestDisk, another data recovery tool, by Christophe Grenier. The initial focus was on photo recovery, hence the name, but its capabilities were expanded to support a wider range of file types. It has been continuously developed and updated to support new file formats and storage devices, becoming a popular tool for both personal and professional data recovery. It is often used as a tool for forensic investigation.

SEE ALSO

testdisk(1), dd(1)

Copied to clipboard