I love photorec and dd rescue. I have recovered many many disks and memory cards with it.
I even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.
If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!
> may get back some surprises along with the files you expect - older files revealed in the sediment
One time a customer brought their computer in. She had wiped and reloaded the system through the recovery partition and didn't understand the big red text stating that all of her data would be removed.
I let her know we might be able to recover some of the data. She agreed that only the photos were important, so I let PhotoRec do its thing.
A few hours later, a panicked husband called worried his wife would find porn in the recovery. We charged him extra to clean up what was basically junk from the Internet Explorer cache. Not an extortionate amount, but extra. I think we could have asked for anything at that moment.
Photorec is great and has improved over the years; it did way better in 2010s than it had done in the early 2000s. (I have a dd image of a corrupt disk of baby photos.)
My folks gave me a big box of hard drives from various family computers over the years. Learning to use ddrescue and photorec to get data off of them was a ton of fun. Really cool tools, and not wildly unfriendly to someone who’d never used them before. I even managed to recover the drive that crashed a few days before the start of my junior year of high school, leaving me to re-write all of my summer homework in a panic. A little late on that one.
PhotoRec has saved me many times. But I have noticed that the results aren’t nearly as good for Mac file formats or video, especially professional video formats. A lot of videos I’ve tried to recover have failed. I wish that there was an app like this for those formats, but I understand that may be more of a niche market for them.
Anybody got tips for making custom signatures work? I'm trying to rescue Unreal Engine game save files off an EXT4 drive where the containing directory was deleted. I put the `sav 0 "GVAS"` (GVAS is the UE save magic value) in my `.photorec.sig`. `fidentify` correctly works on reference UE saves I have. Grepping the raw partition device finds many hits for GVAS, but photorec runs and doesn't recover any files...
At the end of the article I was hoping he'd show a couple of images he managed to recover, just to end it on a fun and satisfying note. I liked the article otherwise though.
Still waiting for someone to tackle file-based encryption. As devices are slowly being sucked into the Android universe, the need to break it to recover files is slowly creeping up on us and we have no solution.
I'm currently working on a tui which includes photorec and foremost among others.
I have also created my first dockerhub image, as the plan is to run it as container on top of a zfs in Truenas.
I'm basically on a hunt for all data, I have 7 disks and some USB that I have imaged and I need to get data out, and I will need to organised all that data (this part is still a work in progress), ideas welcomed.
16 comments
[ 3.7 ms ] story [ 40.3 ms ] threadI even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.
If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!
As another commenter noted, create an exact dupe/image of the volume as the very first thing you do.
Also: if it doesn't successfully retrieve files on the first go, try another configuration. I think it took me 3 attempts to get it right.
A fun perk, also noted in the article: you may get back some surprises along with the files you expect - older files revealed in the sediment!
One time a customer brought their computer in. She had wiped and reloaded the system through the recovery partition and didn't understand the big red text stating that all of her data would be removed.
I let her know we might be able to recover some of the data. She agreed that only the photos were important, so I let PhotoRec do its thing.
A few hours later, a panicked husband called worried his wife would find porn in the recovery. We charged him extra to clean up what was basically junk from the Internet Explorer cache. Not an extortionate amount, but extra. I think we could have asked for anything at that moment.
This reminds me to try it again.
[1] https://www.cgsecurity.org/testdisk_doc/photorec_custom_sign...
I have also created my first dockerhub image, as the plan is to run it as container on top of a zfs in Truenas.
I'm basically on a hunt for all data, I have 7 disks and some USB that I have imaged and I need to get data out, and I will need to organised all that data (this part is still a work in progress), ideas welcomed.
https://github.com/joanmarcriera/hdd-recovery