PhotoRec TR

From CGSecurity
Jump to: navigation, search

En.png English Cn.png 中文 De.png Deutsch Es.png Español Fr.png Français Hu.png Magyar It.png Italiano Tr.png Türkçe


TestDisk_Download
Latest stable version

7.0
April 18, 2015

Photorec.png

PhotoRec, Digital Picture and File Recovery


PhotoRec, hard disk ve CD-ROMlardan video, belge ve arşiv dosyaları veya dijital kamera hafızalarından resimler (Photo Recovery ismi buradan gelmektedir) gibi kayıp dosyaları kurtarmak için tasarlanmış bir veri kurtarma yazılımıdır. PhotoRec dosya sistemini göz ardı ederek altında yatan veriyi arar, böylece medyanızın dosya sistemi ciddi şekilde zarar görmüş veya yeniden biçimlendirilmiş olsa bile çalışır.

PhotoRec özgürdür - bu açık kaynaklı çoklu platform uygulama GNU Genel Kamu Lisansıyla dağıtılmaktadır. PhotoRec, kayıp disk bölümerini kurtarabilen ve önyüklenemeyen diskleri tekrar önyüklenebilir hale getirebilen TestDiske eşlik eden bir uygulamadır. İki uygulamayı da bağlantısından indirebilirsiniz.

Daha güvenli olması için, PhotoRec kayıp veri kurtarmak istediğiniz sürücü veya hafıza kartını "sadece okuma" erişim izniyle kullanır. Önemli: Bir resim veya dosya kazayla silindikten sonra veya kayıp dosyalar keşfettiğinizde, daha fazla resim veya dosyayı bu hafıza aygıtına veya hard disk sürücüsüne KAYDETMEYİN; aksi halde kayıp verinizin üstüne yazabilirsiniz. Bu ayrıca PhotoRec kullanırken kurtarılan dosyaları, kurtarma işleminin yapıldığı bölüme yazmayı SEÇMEMENİZ gerektiği anlamına gelir.

İşletim Sistemleri

PhotoRec aşağıdaki işletim sistemlerinde çalışır:

  • DOS/Win9x
  • Windows NT 4/2000/XP/2003/Vista/2008/7
  • Linux
  • FreeBSD, NetBSD, OpenBSD
  • Sun Solaris
  • Mac OS X

ve neredeyse tüm Unix sistemlerde derlenebilir.

Dosya sistemleri

Photorec dosya sistemini göz ardı eder, böylece dosya sistemi ciddi şekilde zarar görmüş olsa da çalışır.
Kayıp dosyaları (en azından) aşağıdaki dosya sistemlerinden kurtarır:

  • FAT,
  • NTFS,
  • EXT2/EXT3 dosya sistemi
  • HFS+

ReiserFS includes some special optimizations centered around tails, a name for files and end portions of files that are smaller than a filesystem block. In order to increase performance, ReiserFS is able to store files inside the b*tree leaf nodes themselves, rather than storing the data somewhere else on the disk and pointing to it. Unfortunately, PhotoRec isn't able to deal with this - that's why it doesn't work well with ReiserFS.

Media

PhotoRec works with hard disks, CD-ROMs, memory cards (Compact Flash, Memory Stick, SecureDigital/SD, SmartMedia, Microdrive, MMC, etc.), USB memory drives, DD raw image, EnCase E01 image, etc.
PhotoRec has been successfully tested with various portable media players including iPod and the following Digital Cameras:

  • Canon EOS300D, 10D
  • Casio Exilim EX-Z 750
  • HP PhotoSmart 620, 850, 935
  • Nikon CoolPix 775, 950, 5700
  • Olympus C350N, C860L, Mju 400 Digital, Stylus 300
  • Sony Alpha DSLR, DSC-P9
  • Pentax K20D
  • Praktica DCZ-3.4

Known file formats

PhotoRec searches for known file headers. If there is no data fragmentation, which is often the case, it can recover the whole file. Photorec recognises numerous file formats including ZIP, Office, PDF, HTML, JPEG and various graphics file formats. The whole list of file formats recovered by PhotoRec contains more than 320 file extensions (about 200 file families).

How PhotoRec works

FAT, NTFS, ext2/ext3/ext4 file systems store files in data blocks (also called clusters under Windows). The cluster or block size remains at a constant number of sectors after being initialized during the formatting of the file system. In general, most operating systems try to store the data in a contiguous way so as to minimize data fragmentation. The seek time of mechanical drives is significant for writing and reading data to/from a hard disk, so that's why it's important to keep the fragmentation to a minimum level.

When a file is deleted, the meta-information about this file (file name, date/time, size, location of the first data block/cluster, etc.) is lost; e.g., in an ext3/ext4 file system, the names of deleted files are still present, but the location of the first data block is removed. This means the data is still present on the file system, but only until some or all of it is overwritten by new file data.

To recover these lost files, PhotoRec first tries to find the data block (or cluster) size. If the file system is not corrupted, this value can be read from the superblock (ext2/ext3/ext4) or volume boot record (FAT, NTFS). Otherwise, PhotoRec reads the media, sector by sector, searching for the first ten files, from which it calculates the block/cluster size from their locations. Once this block size is known, PhotoRec reads the media block by block (or cluster by cluster). Each block is checked against a signature database which comes with the program and has grown in the type of files it can recover ever since PhotoRec's first version came out.

For example, PhotoRec identifies a JPEG file when a block begins with:

  • 0xff,0xd8,0xff,0xe0
  • 0xff,0xd8,0xff,0xe1
  • or 0xff,0xd8,0xff,0xfe

If PhotoRec has already started to recover a file, it stops its recovery, checks the consistency of the file when possible and starts to save the new file (which it determined from the signature it found).

If the data is not fragmented, the recovered file should be either identical to or larger than the original file in size. In some cases, PhotoRec can learn the original file size from the file header, so the recovered file is truncated to the correct size. If, however, the recovered file ends up being smaller than its header specifies, it is discarded. Some files, such as *.MP3 types, are data streams. In this case, PhotoRec parses the recovered data, then stops the recovery when the stream ends.

When a file is recovered successfully, PhotoRec checks the previous data blocks to see if a file signature was found but the file wasn't able to be successfully recovered (i.e., the file was too small), and it tries again. This way, some fragmented files can be successfully recovered.

Diğer başlıklar

Problems ?

Aşağıdaki konularda tereddüt etmeden Christophe GRENIER ile iletişime geçebilirsiniz:

  • PhotoRec kullanımında zorluklar,
  • geliştirmek için fikirler,
  • veya eklenmesini istediğiniz bir dosya türü