PhotoRec FAQ

From CGSecurity
Jump to navigation Jump to search

En.png English It.png Italiano Ro.png Română Ru.png Русский


I can't start PhotoRec

  • Win.png cygwin1.dll not found, c\cygwin is missing

You need to extract all the files from the archive before running TestDisk or PhotoRec.

How to use PhotoRec ?

Read the PhotoRec Step By Step guide.

Can PhotoRec recover data from my phone/disk/usb key/... ?

There are 3 kinds of storage:

  • DAS (Direct Attached Storage) for hard disks connected via
    • IDE/PATA
    • SATA/eSATA
    • SAS
    • firewire
    • devices connected via USB (external disk, digital camera, thumb drive, phone...) in USB mass storage mode
  • SAN (Storage Area Networks)
    • Fibre Channel Protocol (FCP)
    • Fibre Channel over Ethernet (FCoE)
    • iSCSI, mapping of SCSI over TCP/IP
  • NAS (Network Attached Storage)
    • Windows share (CIFS/SMB)
    • Network File System (NFS)
    • Phone or digital camera in Media Transfer Protocol (MTP) mode (even if connected via USB)

TestDisk & PhotoRec can store recovered data on any storage available from your computer. They can recover data from DAS and SAN storage. For NAS server (QNAP, Synology...), TestDisk & PhotoRec need to run on the server itself.

How to enable the USB mass storage mode

If you want to recover data from a memory card used in your phone, put the card in an USB card reader. To recover files from an internal memory, you have to enable the USB mass storage mode.

BlackBerry

  • Connect your device to your computer.
  • In the device options, click Media Card.
  • Change the Mass Storage Mode Support field.
  • Press the Menu key.
  • Click Enable USB Mass Storage.

Android 2.1-2.3.7

ie. Sony Xperia Samsung Galaxy Note, Samsung Galaxy S/S2, Motorola Droid RAZR, Droid 4, LG Optimus L3, HTC Rezound, HTC Sensation, HTC Desire, Kindle Fire

  • Turn on USB debugging by click Menu > Setting > Applications > Development > USB debugging
  • Plug the supplied USB cable into your PC and connect it to your device. A USB icon will appear in the status bar when the device has been recognized.
  • In the main screen of your Android device, use your finger to pull down the top status bar. Then touch USB Connected.
  • Touch Connect USB storage.
  • Tap Ok

Android 4.0-4.1.2

ie. Samsung Galaxy S2/S3 or Nexus, HTC Desire X/V/C, HTC One X/V/S, LG Optimus L5/7/9, Optimus G, Motorola Droid RAZR, Sony Xperia V/T, Kindle Fire HD

  • Open the Setting > More
  • Search then Tap on USB utilities
  • Check the option: Connect Storage to PC

Then plug the USB cable into the device and connect to your computer. The USB connected screen with the large green Android icon will appear. Tap on Connect USB storage. A confirmation dialog box will appear. Tap OK. The green Android icon will turn orange, indicating that the phone is now in USB Mass Storage mode and should now appear as USB disk drives in Devices with Removable Storage

Android 4.2

ie. Nexus 4, Google Nexus 10, Samsung Galaxy S4

  • Go to Settings -> About Phone/Tablet.
  • Go to “Build Number” at the end of the Scroll list.
  • Tap on “Build Number” repeatedly 7 times (Yes, it's not a typo)
  • Now Developer Option will be included in setting list of yours now. Go to “Develop Options” to check USB debugging > OK. Done.

Windows Phone 7

Use Windows Phone 7 USB Storage Enabler

How to add my own signature to PhotoRec ?

To recover more files, it is possible to add your own custom signatures to PhotoRec.

How to use PhotoRec in a script ?

PhotoRec usage can be automated. The action need to be described with some specific parameters and the resulting command line can be added to a Unix shell script or Windows batch file. Read Scripted run.

Where are the recovered files ?

By default, PhotoRec stores the files in directories named recup_dir.1, recup_dir.2... in the current folder. By example, the first directory on a Windows computer is testdisk-6.11.3/win/recup_dir.1 or testdisk-6.12-WIP/recup_dir.1.

  • If you have run PhotoRec from a temporary folder, ie. c:\Users\bob\appdata\local\temp\Rar$EX00.034\testdisk created by WinRar, the archiver may have deleted the folder including the recovered files when you have closed PhotoRec.
  • The directories may be hidden by Windows, check "File name extensions".

It is recommended to extract all the files from the archive before running PhotoRec.

I can't move, delete, rename the recovered files !

  • Win.png You may need to take ownership of the folders: https://support.microsoft.com/kb/308421
  • Macosx.png Linux.png Change the owner of the files, example sudo chown -R username recup_dir.* or sudo chown -R username /home/username/testdisk-6.14/recup_dir.*. (When asked for the password, use the password from your user session to validate the sudo command)

How to get the original filenames ?

If the filesystem isn't damaged, try TestDisk. TestDisk may be able to undelete the file with its filename. It works for FAT, NTFS and ext2.

In some case, the filename is stored in the file itself, PhotoRec try to recover the filename in this case but most of the time, PhotoRec can't. PhotoRec uses the logical sector number to create the filename, it appends the original filename or the document title when possible, the filename ends by the file extension.

How to find the file I am looking for ?

Read After Using PhotoRec to get some tips to sort the recovered files.