Data recovery using PhotoRec and QPhotoRec
Warning: The dd command (aka the disk destroyer) can seriously harm your computer if used incorrectly!
Be very careful when typing and selecting drives or partitions!
Despite its name, PhotoRec recovers virtually every file format imaginable, not just photographic formats such as jpg, png or tiff. Recoverable formats include:
https://www.cgsecurity.org/wiki/File...ed_By_PhotoRec
Install TestDisk (includes PhotoRec) and GNU ddrescue (by Antonio Diaz):
Plug in a USB external hard drive (EHDD) which is at least the same size as the source drive and in Terminal run:
to identify all the disks and partitions, including the EHDD (say, sdb).
It is safer to clone the source drive (sda) first using:
and then later operate on the destination drive sdb (EHDD) using PhotoRec (or TestDisk).
Should TestDisk or PhotoRec fail to recover data from the EHDD (sdb), it is then possible to send the original drive (sda) to a specialist data recovery company.
Personally I have found that using QPhotoRec, the graphical user interface (GUI), version of PhotoRec on a Windows computer much simpler to use (yes, I realise that this is heresy on a Linux forum).
Those wishing to use Linux, please see Using PhotoRec in Linux below.
For those with access to a Windows computer and a preference for a graphical user interface, download qphotorec via testdisk-7.1-WIP.win64.zip from:
https://www.cgsecurity.org/wiki/TestDisk_Download
First create a new folder inside (Windows) Documents called PHOREC or similar.
Then unzip the above files, open the resulting folder and select the qphotorec_win application. Double click on it to open.
On the Windows computer plug in the EHDD containing the clone of the original drive.
NOTE: The recovered files are to be saved to either PHOREC in Windows Documents (OR phorec2 on a different EHDD).
To recover photos or other supported file types:
1.Select the correct disk from the menu at the top. Note that drive letters are not shown by the program. Either use the size of the disk as an indicator or its label (PhysicalDrive0 is the first internal drive for instance).
2. Select one of the available partitions from the list or pick whole disk if you want all of the disk scanned regardless of partition (and thus drive letters).
3. Make sure the file system is correct. On Windows, this is usually FAT or NTFS. On Linux it will be ext4 or similar.
4. Select whether you want to scan unallocated space only (that is free space), or the whole disk or partition.
5. Using the Browse button, select the destination folder, which is either C:\Documents\PHOREC on the Windows computer, OR (say “F”) for a different EHDD for the recovered files. Make sure that the destination folder is not located on the same disk that is being processed by PhotoRec.
6. Click on File Formats and click on Reset. Then select only the required file formats (e.g. for photos only, just select jpg and PNG types etc). Leaving all file formats selected will mean waiting for much longer as the more exhaustive search is carried out.
7. When satisfied that all required file formats have been selected, hit the Search button and wait until the process completes.
https://www.ghacks.net/2015/04/20/ho...tos-and-files/
..........................................................................
Using PhotoRec in Linux:
The PhotoRec user guide for Linux:
https://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
Please see the following links to avoid the error, "Warning: not enough free space available" after recovering a few hundred files.
https://www.linuxquestions.org/quest...ry-4175572611/
https://forums.linuxmint.com/viewtopic.php?t=193197
Sorting PhotoRec recovered files:
https://www.linuxquestions.org/quest...ts-4175436628/
LINKS:
TestDisk 7.0 release:
https://www.cgsecurity.org/wiki/TestDisk_7.0_Release
Testdisk manual:
https://www.cgsecurity.org/testdisk.pdf
GNU ddrescue manual:
https://www.gnu.org/software/ddrescu...ue_manual.html
How to recover lost or inaccessible data from any storage device:
https://superuser.com/questions/2418...storage-device
Be very careful when typing and selecting drives or partitions!
Despite its name, PhotoRec recovers virtually every file format imaginable, not just photographic formats such as jpg, png or tiff. Recoverable formats include:
https://www.cgsecurity.org/wiki/File...ed_By_PhotoRec
Install TestDisk (includes PhotoRec) and GNU ddrescue (by Antonio Diaz):
Code:
sudo apt-get install testdisk sudo apt-get install gddrescue
Code:
lsblk
It is safer to clone the source drive (sda) first using:
Code:
sudo ddrescue -v /dev/sda /dev/sdb
Should TestDisk or PhotoRec fail to recover data from the EHDD (sdb), it is then possible to send the original drive (sda) to a specialist data recovery company.
Personally I have found that using QPhotoRec, the graphical user interface (GUI), version of PhotoRec on a Windows computer much simpler to use (yes, I realise that this is heresy on a Linux forum).
Those wishing to use Linux, please see Using PhotoRec in Linux below.
For those with access to a Windows computer and a preference for a graphical user interface, download qphotorec via testdisk-7.1-WIP.win64.zip from:
https://www.cgsecurity.org/wiki/TestDisk_Download
First create a new folder inside (Windows) Documents called PHOREC or similar.
Then unzip the above files, open the resulting folder and select the qphotorec_win application. Double click on it to open.
On the Windows computer plug in the EHDD containing the clone of the original drive.
NOTE: The recovered files are to be saved to either PHOREC in Windows Documents (OR phorec2 on a different EHDD).
To recover photos or other supported file types:
1.Select the correct disk from the menu at the top. Note that drive letters are not shown by the program. Either use the size of the disk as an indicator or its label (PhysicalDrive0 is the first internal drive for instance).
2. Select one of the available partitions from the list or pick whole disk if you want all of the disk scanned regardless of partition (and thus drive letters).
3. Make sure the file system is correct. On Windows, this is usually FAT or NTFS. On Linux it will be ext4 or similar.
4. Select whether you want to scan unallocated space only (that is free space), or the whole disk or partition.
5. Using the Browse button, select the destination folder, which is either C:\Documents\PHOREC on the Windows computer, OR (say “F”) for a different EHDD for the recovered files. Make sure that the destination folder is not located on the same disk that is being processed by PhotoRec.
6. Click on File Formats and click on Reset. Then select only the required file formats (e.g. for photos only, just select jpg and PNG types etc). Leaving all file formats selected will mean waiting for much longer as the more exhaustive search is carried out.
7. When satisfied that all required file formats have been selected, hit the Search button and wait until the process completes.
https://www.ghacks.net/2015/04/20/ho...tos-and-files/
..........................................................................
Using PhotoRec in Linux:
The PhotoRec user guide for Linux:
https://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
Please see the following links to avoid the error, "Warning: not enough free space available" after recovering a few hundred files.
https://www.linuxquestions.org/quest...ry-4175572611/
https://forums.linuxmint.com/viewtopic.php?t=193197
Sorting PhotoRec recovered files:
https://www.linuxquestions.org/quest...ts-4175436628/
LINKS:
TestDisk 7.0 release:
https://www.cgsecurity.org/wiki/TestDisk_7.0_Release
Testdisk manual:
https://www.cgsecurity.org/testdisk.pdf
GNU ddrescue manual:
https://www.gnu.org/software/ddrescu...ue_manual.html
How to recover lost or inaccessible data from any storage device:
https://superuser.com/questions/2418...storage-device
Total Comments 0
