PhotoRec FAQ

From CGSecurity
Jump to: navigation, search

En.png english version It.png versione italiana Ro.png versiunea română Ru.png Русская версия


Contents

I can't start PhotoRec

  • win.png cygwin1.dll not found, c\cygwin is missing

You need to extract all the files from the archive before running TestDisk or PhotoRec.

How to use PhotoRec ?

Read the PhotoRec Step By Step guide.

How to add my own signature to PhotoRec ?

To recover more files, it is possible to add your own custom signatures to PhotoRec.

How to use PhotoRec in a script ?

PhotoRec usage can be automated. The action need to be described with some specific parameters and the resulting command line can be added to a Unix shell script or Windows batch file. Read Scripted run.

Where are the recovered files ?

By default, PhotoRec stores the files in directories named recup_dir.1, recup_dir.2... in the current folder. By example, the first directory on a Windows computer is testdisk-6.11.3/win/recup_dir.1 or testdisk-6.12-WIP/recup_dir.1.

  • If you have run PhotoRec from a temporary folder, ie. c:\Users\bob\appdata\local\temp\Rar$EX00.034\testdisk created by WinRar, the archiver may have deleted the folder including the recovered files when you have closed PhotoRec.
  • The directories may be hidden by Windows, modify this settings.

It is recommended to extract all the files from the archive before running PhotoRec.

I can't move, delete, rename the recovered files !

  • win.png You may need to take ownership of the folders: http://support.microsoft.com/kb/308421
  • macosx.png linux.png Change the owner of the files, example sudo chown -R username recup_dir.* or sudo chown -R username /home/username/testdisk-6.14/recup_dir.*. (When asked for the password, use the password from your user session to validate the sudo command)

How to get the original filenames ?

In some case, the filename is stored in the file itself, PhotoRec try to recover the filename in this case but most of the time, PhotoRec can't. PhotoRec uses the logical sector number to create the filename, it appends the original filename or the document title when possible, the filename ends by the file extension.

If the filesystem isn't damaged, TestDisk may be able to undelete the file with its filename. It works for FAT, NTFS and ext2.

How to find the file I am looking for ?

Read After Using PhotoRec to get some tips to sort the recovered files.

Personal tools
Namespaces

Variants
Actions
Data Recovery
Donate
Password recovery
Security
Misc