# PhotoRec Step By Step

### From CGSecurity

PhotoRec Step By Step
PhotoRec Etape par Etape

## Run PhotoRec executable

If PhotoRec is not yet installed, it can be downloaded from TestDisk Download. Extract the files from the archive including the sub-directories.

To recover files from hard disk, USB key, Smart Card, cdrom, dvd..., you need enough rights to access physical device.

- Under Dos, run photorec.exe
- Under Windows, start PhotoRec (ie testdisk-6.9/win/photorec_win.exe) from an account in the Administrator Group. Under Vista, use right-click "run as administrator" to launch PhotoRec.
- Under Unix/Linux/BSD, you need to be root to run PhotoRec (ie. `sudo testdisk-6.9/linux/photorec_static`)
- Under MacOSX, if you are not root, PhotoRec (ie testdisk-6.9/darwin/photorec) will restart itself using sudo after confirmation of your part.
- Under OS/2, PhotoRec doesn't handle physical device, only disk image, sorry.

To recover files from a media image, run

- `photorec image.dd` to carve a raw disk image
- `photorec image.E01` to recover files from an Encase EWF image
- `photorec 'image.E*'` if the Encase image is splitted in several files.

To recover files from other devices, run `photorec device`, i.e.

- `photorec /dev/mapper/truecrypt0` to recover files from a TrueCrypt partition. The same method works with filesystem encrypted with cryptsetup/dm-crypt/LUKS.
- `photorec /dev/md0` to recover files from a Linux software Raid device.

Forensics users can use the parameter `/log` to create a log file named `photorec.log`; it records the location of the files recovered by PhotoRec.

## Disk selection

Available media are listed. Use up/down arrow keys to select the disk that holds the lost files. Press `Enter` to proceed.

## Partition table type selection

Select the partition table type, usually the default value is the correct one as PhotoRec auto-detects the partition table type.

## Source partition selection

Choose

- `Search` after selecting the partition that holds the lost files to start the recovery,
- `Options` to modify the options,
- `File Opt` to modify the list of file types recovered by PhotoRec.

## PhotoRec options

- `Paranoid` By default, recovered files are verified and invalid files rejected.

Enable `bruteforce` if you want to recover more fragmented JPEG files, note it's a very CPU intensive operation.

- `Allow partial last cylinder` modifies how the disk geometry is determined, only non-partitioned media should be affected.
- The `expert mode` option allows the user to force the filesystem blocksize and the offset.
- Enable `Keep corrupted files` to keep files even if they are invalid in the hope that data may still be salvaged from an invalid file using other tools.
- Enable `Low memory` if your system doesn't have enough memory and crashes during recovery. It may be needed for large filesystems heavily fragmented. Don't use this option unless absolutely necessary.

## Selection of files to recover

Enable or disable the recovery of certain file types, e.g.

    [X] tif  Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
    ...
    [X] zip  zip archive including OpenOffice and MSOffice 2007

The whole list of file formats recovered by PhotoRec contains more than 100 file families representing more than 180 file extensions.

## Filesystem type

Once a partition has been selected, PhotoRec needs to know how the data blocks are allocated. Unless it's ext2/ext3 filesystem, choose `Other`.

## Carve the partition or unallocated space only

PhotoRec can search files from

- from the whole partition (useful if the partition is badly corrupted) or
- from the unallocated space only (Available for ext2/ext3, FAT12/FAT6/FAT32 and NTFS). With this option only deleted files are recovered.

## Select where recovered files should be written

Choose the directory where the recovered files should be written.

- Select `..` several times to get the drive list (C:, D:, E:...)
- Filesystem from external disk may be available in a `/media` or `/mnt` sub-directory.
- Partitions from external disk are usually mounted in `/Volumes`.

## Recovery in progress

Number of recovered files is updated in real time.

- During pass 0, PhotoRec searches the first 10 files to determine the blocksize.
- During pass 1 and later, files are recovered including some fragmented files.

Recovered files are written in recup_dir.1, recup_dir.2... sub-directories. It's possible to access the files even if the recovery is not finished.

## Recovery is completed

When the recovery is complete, a summary is displayed. Note that if you interrupt the recovery, the next time PhotoRec is restarted you will be asked to resume the recovery.

##### Data Recovery

- TestDisk
- PhotoRec
- download