Run PhotoRec executable
- Under DOS, run photorec.exe
- Under Windows, start PhotoRec (ie testdisk-6.9/win/photorec_win.exe) from an account in the Administrator group. Under Vista, right click photorec_win.exe and then click Run as administrator to launch PhotoRec.
- Under Unix/Linux/BSD, you need to be root to run PhotoRec (ie.
- Under MacOSX, start PhotoRec (ie testdisk-6.9/darwin/photorec). If you are not root, PhotoRec will restart itself using sudo after a confirmation on your part. Sudo will ask for a password – enter your Mac OS X user password.
- Under OS/2, PhotoRec doesn’t handle physical device, only disk images. Sorry.
photorec image.ddto carve a raw disk image
photorec image.E01to recover files from an Encase EWF image
photorec 'image.???'if the Encase image is split into several files.
photorec '/cygdrive/d/evidence/image.???'if the Encase image is split into several files in the directory d:evidence
/dev/md0) and file system encrypted with cryptsetup, dm-crypt, LUKS or TrueCrypt (ie.
/dev/mapper/truecrypt0). To recover files from other devices, run
/logto create a log file named
photorec.log; it records the location of the files recovered by PhotoRec.
/dev/disk*for faster data transfer.
Partition table type selection
Source partition selection
Searchafter selecting the partition that holds the lost files to start the recovery,
Optionsto modify the options,
File Optto modify the list of file types recovered by PhotoRec.
ParanoidBy default, recovered files are verified and invalid files rejected.
bruteforceif you want to recover more fragmented JPEG files, note it’s a very CPU intensive operation.
Allow partial last cylindermodifies how the disk geometry is determined – only non-partitioned media should be affected.
expert modeoption allows the user to force the file system block size and the offset.
Keep corrupted filesto keep files even if they are invalid in the hope that data may still be salvaged from an invalid file using other tools.
Low memoryif your system doesn’t have enough memory and crashes during recovery. It may be needed for large file systems that are heavily fragmented. Don’t use this option unless absolutely necessary.
Selection of files to recover
FileOpts, enable or disable the recovery of certain file types, e.g.
[X] riff RIFF audio/video: wav, cdr, avi
[X] tif Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
[X] zip zip archive including OpenOffice and MSOffice 2007
File system type
Search, PhotoRec needs to know how the data blocks are allocated. Unless it’s ext2/ext3 filesystem, choose
Carve the partition or unallocated space only
- from the whole partition (useful if the filesystem is corrupted) or
- from the unallocated space only (available for ext2/ext3/ext4, FAT12/FAT16/FAT32 and NTFS). With this option only deleted files are recovered.
Select where recovered files should be written
- To get the drive list (C:, D:, E:, etc.), use the arrow keys to select
.., press the
Enterkey – repeat until you can select the drive of your choice. Validate with
Yes when you get the expected destination.
- File system from external disk may be available in a
- Partitions from external disk are usually mounted in
Recovery in progress
- During pass 0, PhotoRec searches the first 10 files to determine the blocksize.
- During pass 1 and later, files are recovered including some fragmented files.