photorec

Run PhotoRec on a specific device

$ sudo photorec [/dev/sdb]

$ sudo photorec [path/to/image.dd]

photorec disk_image [options] or photorec

disk_image
    Optional: Specifies a disk image file as the source for recovery. If not provided, PhotoRec presents an interactive selection of available drives.

-h
    Displays the help message.

-v
    Displays verbose output.

-d destination_directory
    Specifies the destination directory for recovered files. This is used only when not running in interactive mode.

-t ftype
    Specifies file type to recover. This is used only when not running in interactive mode.

PhotoRec is a powerful, free, and open-source data recovery software tool. While its name suggests a focus on photo recovery, it is capable of recovering a wide variety of file types from hard drives, CD-ROMs, memory cards, USB drives, and other storage media.

Unlike many file recovery tools, PhotoRec ignores the file system and instead searches for data signatures. This allows it to recover files from severely damaged or reformatted media, even when the file system is corrupted or missing. The software is designed to be user-friendly, guiding the user through the recovery process with a menu-driven interface.

The recovery process involves selecting the target device, specifying the file types to search for, and choosing a destination directory to save the recovered files. PhotoRec also allows you to customize the search by adjusting parameters such as carving parameters, allowing for more targeted and efficient recovery. PhotoRec does not write to the drive it is recovering from, but requires a destination directory. It is a command line tool and thus can be automated in scripts.

PhotoRec is not designed to recover specific, deleted files. It recovers files based on file signatures and may recover fragments or incomplete files. The recovery process can be time-consuming, especially on large drives. Recovered filenames may not be original, and the software may assign generic names like recup_xxxx.ext.

PhotoRec employs a technique called 'file carving.' This involves scanning the storage medium for file headers and footers, identifying potential files based on these signatures. Because it operates at a low level, it doesn't rely on the file system's integrity.

While PhotoRec bypasses the file system for recovery, it can recognize various file system types, including FAT, NTFS, ext2/ext3/ext4, and others. This information is used during drive selection and partition analysis. But it works on a signature basis.

When using PhotoRec on storage devices that you do not own, ensure you have proper authorization. Data recovery can expose sensitive information, and unauthorized access is illegal and unethical.

PhotoRec was developed alongside TestDisk, another data recovery tool, by Christophe Grenier. The initial focus was on photo recovery, hence the name, but its capabilities were expanded to support a wider range of file types. It has been continuously developed and updated to support new file formats and storage devices, becoming a popular tool for both personal and professional data recovery. It is often used as a tool for forensic investigation.

testdisk(1), dd(1)