<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="keywords" content="PhotoRec Step By Step,File Formats Recovered By PhotoRec,PhotoRec Etape par Etape,TestDisk Download" />
<link rel="shortcut icon" href="favicon.ico" />
<link rel="search" type="application/opensearchdescription+xml" href="opensearch_desc.php" title="CGSecurity (English)" />
<link rel="copyright" href="http://www.gnu.org/copyleft/fdl.html" />
<title>PhotoRec Step By Step - CGSecurity</title>
<style type="text/css" media="screen, projection">/*<![CDATA[*/
@import "shared.css_97.css";
@import "main.css_97.css";
/*]]>*/</style>
<link rel="stylesheet" type="text/css" media="print" href="commonprint.css_97.css" />
<!--[if lt IE 5.5000]><style type="text/css">@import "ie50fixes.css_97.css";</style><![endif]-->
<!--[if IE 5.5000]><style type="text/css">@import "ie55fixes.css_97.css";</style><![endif]-->
<!--[if IE 6]><style type="text/css">@import "ie60fixes.css_97.css";</style><![endif]-->
<!--[if IE 7]><style type="text/css">@import "ie70fixes.css_97.css";</style><![endif]-->
<!--[if lt IE 7]><script type="text/javascript" src="iefixes.js_97"></script>
<meta http-equiv="imagetoolbar" content="no" /><![endif]-->
<script type= "text/javascript">/*<![CDATA[*/
var skin = "monobook";
var stylepath = "/mw/skins";
var wgArticlePath = "/wiki/$1";
var wgScriptPath = "/mw";
var wgScript = "/mw/index.php";
var wgServer = "http://www.cgsecurity.org";
var wgCanonicalNamespace = "";
var wgCanonicalSpecialPageName = false;
var wgNamespaceNumber = 0;
var wgPageName = "PhotoRec_Step_By_Step";
var wgTitle = "PhotoRec Step By Step";
var wgAction = "view";
var wgRestrictionEdit = [];
var wgRestrictionMove = [];
var wgArticleId = "1924";
var wgIsArticle = true;
var wgUserName = null;
var wgUserGroups = null;
var wgUserLanguage = "en";
var wgContentLanguage = "en";
var wgBreakFrames = false;
var wgCurRevisionId = "4083";
/*]]>*/</script>
<script type="text/javascript" src="wikibits.js_97"><!-- wikibits js --></script>
<script type="text/javascript" src="http://www.cgsecurity.org/mw/index.php?title=-&action=raw&gen=js&useskin=monobook"><!-- site js --></script>
<style type="text/css">/*<![CDATA[*/
@import "Common.css";
@import "Monobook.css";
@import "dyn.css";
/*]]>*/</style>
<!-- Head Scripts -->
<script type="text/javascript" src="ajax.js_97"></script>
</head>
<body class="mediawiki ns-0 ltr page-PhotoRec_Step_By_Step">
<div id="globalWrapper">
<div id="column-content">
<div id="content">
<a name="top" id="top"></a>
<h1 class="firstHeading">PhotoRec Step By Step</h1>
<div id="bodyContent">
<h3 id="siteSub">From CGSecurity</h3>
<div id="contentSub"></div>
<div id="jump-to-nav">Jump to: <a href="#column-one">navigation</a>, <a href="#searchInput">search</a></div> <!-- start content -->
<p><img src="en.png" alt="en.png" /> <strong class="selflink">PhotoRec Step By Step</strong><br />
<img src="fr.png" alt="fr.png" /> <a href="photorec_etape_par_etape.html" title="PhotoRec Etape par Etape">PhotoRec Etape par Etape</a><br />
</p>
<table id="toc" class="toc" summary="Contents"><tr><td><div id="toctitle"><h2>Contents</h2></div>
<ul>
<li class="toclevel-1"><a href="#Run_PhotoRec_executable"><span class="tocnumber">1</span> <span class="toctext">Run PhotoRec executable</span></a></li>
<li class="toclevel-1"><a href="#Disk_selection"><span class="tocnumber">2</span> <span class="toctext">Disk selection</span></a></li>
<li class="toclevel-1"><a href="#Partition_table_type_selection"><span class="tocnumber">3</span> <span class="toctext">Partition table type selection</span></a></li>
<li class="toclevel-1"><a href="#Source_partition_selection"><span class="tocnumber">4</span> <span class="toctext">Source partition selection</span></a></li>
<li class="toclevel-1"><a href="#PhotoRec_options"><span class="tocnumber">5</span> <span class="toctext">PhotoRec options</span></a></li>
<li class="toclevel-1"><a href="#Selection_of_files_to_recover"><span class="tocnumber">6</span> <span class="toctext">Selection of files to recover</span></a></li>
<li class="toclevel-1"><a href="#Filesystem_type"><span class="tocnumber">7</span> <span class="toctext">Filesystem type</span></a></li>
<li class="toclevel-1"><a href="#Carve_the_partition_or_unallocated_space_only"><span class="tocnumber">8</span> <span class="toctext">Carve the partition or unallocated space only</span></a></li>
<li class="toclevel-1"><a href="#Select_where_recovered_files_should_be_written"><span class="tocnumber">9</span> <span class="toctext">Select where recovered files should be written</span></a></li>
<li class="toclevel-1"><a href="#Recovery_in_progress"><span class="tocnumber">10</span> <span class="toctext">Recovery in progress</span></a></li>
<li class="toclevel-1"><a href="#Recovery_is_completed"><span class="tocnumber">11</span> <span class="toctext">Recovery is completed</span></a></li>
</ul>
</td></tr></table><script type="text/javascript"> if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); } </script>
<a name="Run_PhotoRec_executable"></a><h2> <span class="mw-headline"> Run PhotoRec executable </span></h2>
<p>If PhotoRec is not yet installed, it can be downloaded from <a href="testdisk_download.html" title="TestDisk Download">TestDisk Download</a>. Extract the files from the archive including the sub-directories.
</p><p>To recover files from hard disk, USB key, Smart Card, cdrom, dvd..., you need enough rights to access physical device.
</p>
<ul><li> <img src="dos.png" alt="dos.png" /> Under Dos, run photorec.exe
</li><li> <img src="win.png" alt="win.png" /> Under Windows, start PhotoRec (ie testdisk-6.9/win/photorec_win.exe) from an account in the Administrator Group. Under Vista, use right-click "run as administrator" to launch PhotoRec.
</li><li> <img src="linux.png" alt="linux.png" /> Under Unix/Linux/BSD, you need to be root to run PhotoRec (ie. <code>sudo testdisk-6.9/linux/photorec_static</code>)
</li><li> <img src="macosx.png" alt="macosx.png" /> Under MacOSX, if you are not root, PhotoRec (ie testdisk-6.9/darwin/photorec) will restart itself using sudo after confirmation of your part.
</li><li> <img src="os2.png" alt="os2.png" /> Under OS/2, PhotoRec doesn't handle physical device, only disk image, sorry.
</li></ul>
<p><br />
To recover files from a media image, run
</p>
<ul><li> <code>photorec image.dd</code> to carve a raw disk image
</li><li> <code>photorec image.E01</code> to recover files from an Encase EWF image
</li><li> <code>photorec 'image.E*'</code> if the Encase image is splitted in several files.
</li></ul>
<p><br />
<img src="linux.png" alt="linux.png" /> <img src="macosx.png" alt="macosx.png" /> To recover files from other devices, run <code>photorec device</code>, i.e.
</p>
<ul><li> <code>photorec /dev/mapper/truecrypt0</code> to recover files from a TrueCrypt partition. The same method works with filesystem encrypted with cryptsetup/dm-crypt/LUKS.
</li><li> <code>photorec /dev/md0</code> to recover files from a Linux software Raid device.
</li></ul>
<p>Forensics users can use the parameter <code>/log</code> to create a log file named <code>photorec.log</code>; it records the location of the files recovered by PhotoRec.
</p>
<a name="Disk_selection"></a><h2> <span class="mw-headline"> Disk selection </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_startup.png.html" class="image" title="Image:PhotoRec_startup.png"><img alt="Image:PhotoRec_startup.png" src="photorec_startup.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>Available media are listed. Use up/down arrow keys to select the disk that holds the lost files.
Press <code>Enter</code> to proceed.
</p>
<a name="Partition_table_type_selection"></a><h2> <span class="mw-headline"> Partition table type selection </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_part_type.png.html" class="image" title="Image:PhotoRec_part_type.png"><img alt="Image:PhotoRec_part_type.png" src="photorec_part_type.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>Select the partition table type, usually the default value is the correct one as PhotoRec auto-detects the partition table type.
</p>
<a name="Source_partition_selection"></a><h2> <span class="mw-headline"> Source partition selection </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_src.png.html" class="image" title="Image:PhotoRec_src.png"><img alt="Image:PhotoRec_src.png" src="photorec_src.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>Choose
</p>
<ul><li> <code>Search</code> after selecting the partition that holds the lost files to start the recovery,
</li><li> <code>Options</code> to modify the options,
</li><li> <code>File Opt</code> to modify the list of file types recovered by PhotoRec.
</li></ul>
<a name="PhotoRec_options"></a><h2> <span class="mw-headline"> PhotoRec options </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_options.png.html" class="image" title="Image:PhotoRec_options.png"><img alt="Image:PhotoRec_options.png" src="photorec_options.png" width="665" height="477" border="0" /></a>
</td></tr></table>
<ul><li> <code>Paranoid</code> By default, recovered files are verified and invalid files rejected.
</li></ul>
<p>Enable <code>bruteforce</code> if you want to recover more fragmented JPEG files, note it's a very CPU intensive operation.
</p>
<ul><li> <code>Allow partial last cylinder</code> modifies how the disk geometry is determined, only non-partitioned media should be affected.
</li><li> The <code>expert mode</code> option allows the user to force the filesystem blocksize and the offset.
</li><li> Enable <code>Keep corrupted files</code> to keep files even if they are invalid in the hope that data may still be salvaged from an invalid file using other tools.
</li><li> Enable <code>Low memory</code> if your system doesn't have enough memory and crashes during recovery. It may be needed for large filesystems heavily fragmented. Don't use this option unless absolutely necessary.
</li></ul>
<a name="Selection_of_files_to_recover"></a><h2> <span class="mw-headline"> Selection of files to recover </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_files.png.html" class="image" title="Image:PhotoRec_files.png"><img alt="Image:PhotoRec_files.png" src="photorec_files.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>Enable or disable the recovery of certain file types, e.g.
</p>
<pre>
[X] tif Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
...
[X] zip zip archive including OpenOffice and MSOffice 2007
</pre>
<p>The whole list of <a href="file_formats_recovered_by_photorec.html" title="File Formats Recovered By PhotoRec">file formats recovered by PhotoRec</a> contains more than 100 file families representing more than 180 file extensions.
</p>
<a name="Filesystem_type"></a><h2> <span class="mw-headline"> Filesystem type </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_filesystem.png.html" class="image" title="Image:PhotoRec_filesystem.png"><img alt="Image:PhotoRec_filesystem.png" src="photorec_filesystem.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>Once a partition has been selected, PhotoRec needs to know how the data blocks are allocated.
Unless it's ext2/ext3 filesystem, choose <code>Other</code>.
</p>
<a name="Carve_the_partition_or_unallocated_space_only"></a><h2> <span class="mw-headline"> Carve the partition or unallocated space only </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_free.png.html" class="image" title="Image:PhotoRec_free.png"><img alt="Image:PhotoRec_free.png" src="photorec_free.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>PhotoRec can search files from
</p>
<ul><li> from the whole partition (useful if the partition is badly corrupted) or
</li><li> from the unallocated space only (Available for ext2/ext3, FAT12/FAT6/FAT32 and NTFS). With this option only deleted files are recovered.
</li></ul>
<a name="Select_where_recovered_files_should_be_written"></a><h2> <span class="mw-headline"> Select where recovered files should be written </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_dst.png.html" class="image" title="Image:PhotoRec_dst.png"><img alt="Image:PhotoRec_dst.png" src="photorec_dst.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>Choose the directory where the recovered files should be written.
</p>
<ul><li> <img src="dos.png" alt="dos.png" /> <img src="win.png" alt="win.png" /> <img src="os2.png" alt="os2.png" /> Select <code>..</code> several times to get the drive list (C:, D:, E:...)
</li><li> <img src="linux.png" alt="linux.png" /> Filesystem from external disk may be available in a <code>/media</code> or <code>/mnt</code> sub-directory.
</li><li> <img src="macosx.png" alt="macosx.png" /> Partitions from external disk are usually mounted in <code>/Volumes</code>.
</li></ul>
<a name="Recovery_in_progress"></a><h2> <span class="mw-headline"> Recovery in progress </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_running.png.html" class="image" title="Image:PhotoRec_running.png"><img alt="Image:PhotoRec_running.png" src="photorec_running.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>Number of recovered files is updated in real time.
</p>
<ul><li> During pass 0, PhotoRec searches the first 10 files to determine the blocksize.
</li><li> During pass 1 and later, files are recovered including some fragmented files.
</li></ul>
<p>Recovered files are written in recup_dir.1, recup_dir.2... sub-directories. It's possible to access the files even if the recovery is not finished.
</p>
<a name="Recovery_is_completed"></a><h2> <span class="mw-headline"> Recovery is completed </span></h2>
<table align="center">
<tr>
<td> <a href="image_photorec_end.png.html" class="image" title="Image:PhotoRec_end.png"><img alt="Image:PhotoRec_end.png" src="photorec_end.png" width="667" height="479" border="0" /></a>
</td></tr></table>
<p>When the recovery is complete, a summary is displayed. Note that if you interrupt the recovery, the next time PhotoRec is restarted you will be asked to resume the recovery.
</p>
<!-- Saved in parser cache with key cg_mw-mw_:pcache:idhash:1924-0!1!0!!en!2!edit=0 and timestamp 20080114123422 -->
<!-- end content -->
<div class="visualClear"></div>
</div>
</div>
</div>
<div id="column-one">
<div class="portlet" id="p-logo">
<a style="background-image: url(logo.png);" href="http://www.cgsecurity.org/" title="Visit the Main Page [z]" accesskey="z"></a>
</div>
<script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script>
<div class='portlet' id='p-Data_Recovery'>
<h5>Data Recovery</h5>
<div class='pBody'>
<ul>
<li id="n-TestDisk"><a href="testdisk.html">TestDisk</a></li>
<li id="n-PhotoRec"><a href="photorec.html">PhotoRec</a></li>
<li id="n-Download"><a href="testdisk_download.html">download</a></li>
</ul>
</div>
</div>
</div><!-- end of the left (by default at least) column -->
<div class="visualClear"></div>
<div id="footer">
<div id="f-copyrightico"><a href="http://www.gnu.org/copyleft/fdl.html"><img src="gnu_fdl.png" alt='GNU Free Documentation License 1.2' /></a></div>
<ul id="f-list">
<li id="lastmod"> This page was last modified 12:19, 14 January 2008.</li>
<li id="copyright">Content is available under <a href="http://www.gnu.org/copyleft/fdl.html" class="external " title="http://www.gnu.org/copyleft/fdl.html" rel="nofollow">GNU Free Documentation License 1.2</a>.</li>
</ul>
</div>
<script type="text/javascript">if (window.runOnloadHook) runOnloadHook();</script>
</div>
</body><!-- Cached 20080114123422 -->
</html>
