How to Recover Deleted Files with Photorec

photorec_bigI was searching through my video library, and I discovered that I was missing a few of my videos. Later, I realized that I had previously deleted them by mistake. So right away I went to the recycle bin in my Linux Mint desktop, but the files weren’t there. I didn’t panic. I remember that Photorec from Testdisk has save the day many times. Yes, I know that regular files backup should be done in a regular basis, so you don’t have to get into the hassle of staring at your computer for hours while your data recovery utility tries to recover the files. But, hey sometimes you just have to roll your sleeve and scrape your hard-disk partition with a good data recovery utility like photorec.

Photorec is a data carver used to recover deleted files, and it is very powerful; however, it is very slow. Moreover, Photorec needs to recognize the signature of the file in order to recover it. In addition, it will not recover the file with the original name. Photorec identifies the starting point of a file in hard drive, its end point, and the signature of such file. Then, photorec will recover the files and give it its own name, and it is up to you to sort through the files, and find what you’re looking for. So it would be helpful if, at least, you know the file extension your looking for eg: exe, jpg, pdf. Moreover, recovery time is faster, as you don’t have to search for all extension, but only for the extension of the file you’re looking for. That is of course, if you’re not trying to recover all data stored in hard drive, in that case, your best bet is to leave every filetype extension selected. If you’re not following the technical aspect of photorec I’ve explained here so far, don’t panic, we’re going to do this step by step.

First, you need to install Testdisk because Photorec is a utility that is part of Testdisk.
So in order to recover a file or several files in Photorec, it is helpful to know the extension of the files.
1- first, you need to know the disk and partition where the deleted files are, for this use “fdisk” command

sudo fdisk -l

2- Next, start photorec from command line by typing “photorec”

sudo photorec

3- From the menu displaying all disk available select the disk you detected in step 1
4- Select the partition from the disk, and select “File Opt” in the menu at the buttom
5- Select the file extension you wish to recover eg: exe, jpg, pdf
6- Select filesytem type eg. NTFS, ext2, ext3, FAT32. this you should also get from step 1
7- Select the destination directory where you recovered files will be stored. This has to be a different location that the partition photorec is working on. And let photorec works its magic

Happy Data Carving!

Share This!

Add a Comment

Your email address will not be published.

Sign up for our Newsletter

Download "Google Search Pro"

Enter your email and stay on top of things,