17. Scripted run
TestDisk and PhotoRec can run automatically using their own built-in commands. A script file (such as .cmd or .bat batch files under MS-DOS/Windows, or some shell under Linux) may also be helpful.
17.1. Automating recovery using TestDisk
Syntax:
testdisk [/debug] [/log] [/logname file.log] /cmd [file.dd|file.e01|device] cmd
17.1.1. Some examples
testdisk /debug /log /cmd /dev/hda analyze,search
testdisk /debug /log /cmd partition.dd partition_none,geometry,H,32,analyze,list,advanced,boot,rebuildbs,list
17.1.2. Device selection
Use the device name, e.g. /dev/hda, /dev/hdb, /dev/sda.
For DOS version, use /dev/sda128 for first disk, /dev/sda129 for the second and so on…
You may have to use single quote, i.e. 'c:\input dir\image.dd', if the path or file name contains spaces.
For Encase files, you can use file.e?? if you have less than 100 files, otherwise use file.???
17.1.3. Partition type selection
partition_i386
partition_gpt
partition_humax
partition_mac
partition_none
partition_sun
partition_xbox
ask_type: the user will be asked for the partition type (new in 6.9)
If no partition type is specified or asked, TestDisk will detect it automatically.
17.1.8. Options
dump
nodump
align
noalign
expert
noexpert
17.2. Automating recovery using PhotoRec
photorec [/debug] [/log] [/logname file.log][/d recup_dir] [/cmd <device> <command>]
General syntax:
/debug: switch on debug mode
/log: switch on logging (a log file named
photorec.logwill be created/appended to in the current working directory/logname file.log: log will be written to
file.loginstead ofphotorec.log/d recup_dir: specify directory to store the recovered files into. This should be on a device different from the one you are recovering from. PhotoRec will add a numeric extension to the path specified, starting with “.1” - and increase this number as long as a directory with this name already exists.
/cmd: introduces the command section for scripted run
<device>: the device (or image file) to recover from (Hint: use single-quote if the image file contains spaces)
<command>: the command list (see below)
17.2.1. Some examples of data recovery using PhotoRec
Recover from the second IDE drives i386 partition the user selects
photorec /debug /log /cmd /dev/hdb partition_i386,select,search
Recover from the first IDE drives i386 partition #5, which is using ext2/ext3/ext4
photorec /debug /log /cmd /dev/hda partition_i386,options,mode_ext2,5,search
Recover from a given disk image file named disk.dmp which only has a single ext4 partition (or a part of it)
Restore all file types known to PhotoRec to /mnt/recover/disk.
photorec /debug /log /d /mnt/recover/disk /cmd disk.dmp options,mode_ext2, \
fileopt,everything,enable,search
The same without debug and log - but recover only *.gif and *.jpg
photorec /d /mnt/recover/disk /cmd disk.dmp options,mode_ext2,fileopt,everything,disable, \
jpg,enable,gif,enable,search
Recover jpg from the freespace of the first partition
photorec /cmd /dev/hda fileopt,everything,disable,jpg,enable,freespace,search
Recover all files from freespace from each partition as detected by TestDisk
PARENT=`pwd`
DEVICE=/dev/sda
testdisk -l $DEVICE | tee testdisk.log | \
egrep "[[:digit:]][[:space:]][P,E,L,D,*][[:space:]].+([[:space:]]+[[:digit:]]+){3}" | \
cut -f 2 -d\ |while read PARTITION
do
mkdir $PARTITION && cd $PARTITION &&
xterm -e photorec /log /debug /d ./ /cmd $DEVICE freespace,$PARTITION,search
cd $PARENT
done
17.2.2. Command list
Below you find a list of available command options, grouped into categories. It is best to use them in the order they are mentioned here. These options must be separated by a comma. Partition type selection and options from the main menu can be used directly.
17.2.3. PhotoRec - Partition type selection
partition_i386
partition_gpt
partition_humax
partition_mac
partition_none
partition_sun
partition_xbox
ask_type: the user will be asked for the partition type
If no partition type is specified, it is auto-detected.
17.3. Windows UAC
If you run TestDisk and PhotoRec, Windows User Account Control will ask “Do you want the following program from an unknown publisher to make changed to this computer ?” (or something similar). As administrator rights are unneeded for disk images, you may want to avoid this UAC prompt with the __COMPAT_LAYER environment variable. Example:
set __COMPAT_LAYER=RunAsInvoker
photorec_win.exe /cmd image.dd search