How To: Use Photorec with DDRescue-GUI to recover deleted files

Hi all. In this post and accompanying video, I’ll show you how to recover lost or deleted files using DDRescue-GUI and Photorec. The use case for this is when you’ve accidentally deleted important files, or done a quick format on your disk. There’s a video, and a text writeup – you can use whatever format you prefer, or potentially both if you’re following along.

Note: This won’t work for files that have been overwritten, or if you’ve done a slow or “full” format on your storage drive, as that overwrites all fragments of data on the drive.

The Video

I produced this video for Parted Magic LLC, and you can see the other videos at: https://www.youtube.com/user/darthelmo1.

The Writeup

Setup & Introduction

So, the scenario here is that we have a USB stick (or other similar storage medium), and have accidentally quick formatted it. It had a few different kinds of files on it, including video files, pictures, a Windows executable, and a few different kinds of compressed archive. The USB stick had a FAT filesystem, but these steps will work on many kinds of file system.

Make sure Photorec is installed. If you want to follow the tutorial exactly and not worry about installing software, head to https://partedmagic.com and buy a copy of Parted Magic.

Step 1: Imaging the source medium (optional)

The first step is to image the source drive, preferably to a file. Note that you can skip this if your source drive is in good condition. Generally, it’s best to image the drive first, however, because read errors might make file recovery programs like Photorec choke and fail to recover files.

To image, simply start DDRescue-GUI, and select your source drive as the input file, use a map file on the destination drive, and save the image in the folder with the map file to avoid confusion. If your drive is damaged, this might take a while and need several passes. For more detail on this step, you can look at these tutorials.

Step 2: Configuring Photorec

Once you’ve got your image, you can run Photorec on it. You should also create a folder on the destination drive for Photorec to put any recovered files in. To do this, change directory to where the image is, and run:

photorec ./<image-name>

After this, you’ll be asked which disk to select, so just hit enter. If there are any partitions, you’ll now see a list of them. Pick your desired partition, and use the right arrow key to select “Options”.

Here are the options I used:

Paranoid: Yes (Brute force disabled)
Keep corrupted files: No
Expert mode: No
Low memory: No

The settings that I would change if needed are “keep corrupted files” and “low memory”. For the sake of this tutorial, we’re leaving the other settings at the defaults. You can change the options by scrolling up with the arrow keys and pressing ENTER.

Now head to the file options section. This allows you to select which file types to recover. You can do this by scrolling up and down and hitting the space key. Make sure to press “b” to save the settings!

Step 3: Running Photorec

Go to “Search” and hit ENTER. Then browse around until you find the folder you created earlier, and press “c” to select it. Photorec will now begin recovering files. Depending on the size and speed of your disk, how much memory you have, and the speed of your processor, this might be quick, or it might take a while. In my case, I have a quick processor, lots of RAM, and a small disk, so it only took a few seconds.

As it runs, Photorec will tell you how many files it’s recovered, and the file types. With some luck, this will be relatively quick and will recover most of your files.

Step 4: Inspecting the recovered files

Once Photorec is finished running. quit it and head to the folder you specified for it to put the recovered files in. In here you’ll see lots of folders that start with “recup.dir.”. Inside these are the recovered files.

After browsing into the first folder, you’ll notice that most (or all) files have lost their original file names. It might be worth sorting them by file type. Upon inspecting the files, some will probably be intact, but many are likely to be slightly corrupted or have missing parts. In my quick test, videos and photos were recovered fine, but I had less success with other kinds of files.

Nevertheless, although the success rate is almost definitely not going to be 100%, you will hopefully get quite a lot of your data back. Data that has been overwritten can sadly not be recovered. Files that were fragmented also may have multiple fragments that Photorec has classified as separate files.

Summary

This post has showed how to use Photorec to recover deleted or otherwise lost files from your storage devices. Losing data can be a stressful experience, but I hope this post has showed you that recovering it is often quite simple and easy to do. That’s all for now, but see you soon – I have a lot of ideas for posts that I hope to have out soon! 🙂

Tagged , , , , . Bookmark the permalink.

About Hamish McIntyre-Bhatty

I'm currently studying for a Computing and IT degree with the Open University, and am a software developer as well. I enjoy coding in Python, C++ (still learning), and Java. Having written 4 open-source programs (hosted on launchpad.net), set up my own website, and started volunteering at Wimborne Model Town to work on their river control system, I still find the time to enjoy cycling, acting, photography, and playing bass guitar. I go climbing every now and then as well. More recently, I wrote my first commercial program, Disk Verifier, and created a PSID Unlocker GUI for Parted Magic. I also create tutorial and other informative videos for Parted Magic LLC.

Leave a Reply

Your email address will not be published. Required fields are marked *