Recovering files from beyond the grave using PhotoRec | Hacker News Reader

Recovering files from beyond the grave using PhotoRec

lost-number.bearblog.dev

77 pointsspeckx21 comments

I love photorec and dd rescue. I have recovered many many disks and memory cards with it.

I even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.

If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!

You say it. A few years ago my homeserver behalved odd and i needed reboots. I took out the SSD, used dd-rescue and after that The SSD did not even show up as storage any more. Yhea. I also have backups since then. :)

PhotoRec saved my ass just earlier this week, after an accidental wipe of a CompactFlash card with client photos on it.

As another commenter noted, create an exact dupe/image of the volume as the very first thing you do.

Also: if it doesn't successfully retrieve files on the first go, try another configuration. I think it took me 3 attempts to get it right.

A fun perk, also noted in the article: you may get back some surprises along with the files you expect - older files revealed in the sediment!

> may get back some surprises along with the files you expect - older files revealed in the sediment

One time a customer brought their computer in. She had wiped and reloaded the system through the recovery partition and didn't understand the big red text stating that all of her data would be removed.

I let her know we might be able to recover some of the data. She agreed that only the photos were important, so I let PhotoRec do its thing.

A few hours later, a panicked husband called worried his wife would find porn in the recovery. We charged him extra to clean up what was basically junk from the Internet Explorer cache. Not an extortionate amount, but extra. I think we could have asked for anything at that moment.

Haha my friend nuked his hdd somehow and asked me to recover his pictures. I also found all his porn, which thankfully was very much vanilla.

Ah ah I was asked by my boss to repair his work laptop after windows shat itself, and the porn stash was one of the first thing to become restored among his work documents

My folks gave me a big box of hard drives from various family computers over the years. Learning to use ddrescue and photorec to get data off of them was a ton of fun. Really cool tools, and not wildly unfriendly to someone who’d never used them before. I even managed to recover the drive that crashed a few days before the start of my junior year of high school, leaving me to re-write all of my summer homework in a panic. A little late on that one.

I hit every thrift store storage device with photorec. I also use it on storage devices I'm getting rid of, just to be sure.

> storage devices I'm getting rid of

When discarding storage, I do a random pass (even if the drive has always been part of an encrypted-at-rest arrangement, if only for the sake of habit), then a zero sweep, then it gets a filesystem created and filled with many copies of a few cat photos/videos¹² to give anyone running something like photorec a treat, then the partition table is emptied.

--------

[1] With filenames to suggest a bumper collection of photo/video backups from several people's phones/cameras, with some porn accidentally mixed in.

[2] If I'm in an evil mood the “treat” filesystem is filled with shock images and Rick Astley instead.

I like to do a low level format. With a hammer.

PhotoRec has saved me many times. But I have noticed that the results aren’t nearly as good for Mac file formats or video, especially professional video formats. A lot of videos I’ve tried to recover have failed. I wish that there was an app like this for those formats, but I understand that may be more of a niche market for them.

Deleted files becomes reclaimable space. Delayed recovery makes those files unrecoverable.

You can try "foremost", it isnt as easy to use but a bit more configurable - at least from memory (I have used it many years ago)

same here wrt recovering files from dying disks, it's a lifesaver.

Anybody got tips for making custom signatures work? I'm trying to rescue Unreal Engine game save files off an EXT4 drive where the containing directory was deleted. I put the `sav 0 "GVAS"` (GVAS is the UE save magic value) in my `.photorec.sig`. `fidentify` correctly works on reference UE saves I have. Grepping the raw partition device finds many hits for GVAS, but photorec runs and doesn't recover any files...

[1] https://www.cgsecurity.org/testdisk_doc/photorec_custom_sign...

Honestly an AI model might be fairly okay at this?

I'm currently working on a tui which includes photorec and foremost among others.

I have also created my first dockerhub image, as the plan is to run it as container on top of a zfs in Truenas.

I'm basically on a hunt for all data, I have 7 disks and some USB that I have imaged and I need to get data out, and I will need to organised all that data (this part is still a work in progress), ideas welcomed.

https://github.com/joanmarcriera/hdd-recovery

At the end of the article I was hoping he'd show a couple of images he managed to recover, just to end it on a fun and satisfying note. I liked the article otherwise though.

I assumed he recovered all the memes he used in the article. /s

Still waiting for someone to tackle file-based encryption. As devices are slowly being sucked into the Android universe, the need to break it to recover files is slowly creeping up on us and we have no solution.

Photorec is great and has improved over the years; it did way better in 2010s than it had done in the early 2000s. (I have a dd image of a corrupt disk of baby photos.)

This reminds me to try it again.

Reply on news.ycombinator.com