Linux

Recover data the right way using Photorec

Data recovery is just a fact of life, but you can be ready for any disaster with a little planning and a lot of foresight.

Accidental file deletion and corruption is just a part of life. To err is human, so we need to be armed with the essential tools to combat our own foolhardiness with file management. Unfortunately, in the field of data recovery, this kind of operation is much more delicate than downloading file recovery software and allowing it to run its stuff. In fact, I consider so-called quick-and-easy file recovery apps for Microsoft Windows to be horrendously irresponsible for allowing users to attempt a scan on the system drive while booted into Windows.

Simply put, there are some important rules that must be followed in order to ensure high probability in recovery rates and high data consistency. I call these "The Three Golden Rules to Data Recovery," and they are as follows.

  • If you accidentally deleted a file, do not initiate any further file transactions to that disk. The more you make, the less likely you will be able to recover said file.
  • Never ever run file recovery software off the same drive you are attempting to recover from.
  • Always have a data recovery kit handy for when disaster strikes. This will consist of a boot disc that contains the necessary data recovery software.

Tool of choice

So now that you know the top three rules for proper data recovery, let's take a look at the best tool I have used to recover files off FAT/FAT32 and NTFS partitions: Photorec. This is an open-source tool designed to deep scan any Windows- or Linux-formatted volumes for deleted files and subsequently recover those files using carefully crafted heuristics. Since this is a Linux-based tool, we will need to create a Linux boot CD. Ultimate Boot CD, a freeware bootable systems utility disc, just so happens to contain Photorec along with its normal suite of tools.

Make the recovery toolkit

To get started, download the burnable ISO image for The Ultimate Boot CD at the main product website, and then burn to disc. As indicated by one of the golden rules I have listed, it is strongly recommended to download and burn on a system other than the one you are recovering files from. Once the disc is prepared, proceed to boot your PC off it and select HDD, Data Recovery and then Photorec accordingly from the boot menu options.

This will boot you into a Linux desktop environment with an array of icons to choose from. For Photorec, we will need to launch a terminal window by clicking the computer monitor icon located on the menu bar.

Within the confines of the terminal window, type in "photorec" and hit Enter. Now, simply select the drive you wish to recover files from, the partition table type (most likely "Intel" on a Windows PC), the partition itself, the file system the partition uses (usually the option labeled "Other"), and, lastly, the amount you want to scan -- only the free space or the whole disk.

Before the scan proceeds, Photorec will ask where you wish to dump your recovered files after it is finished. It is recommended to pick an external disk drive like a flash drive or even a secondary partition. Once you press the [C] key to confirm the destination directory, the scan process commences. Feel free to get up and tackle something else, as Photorec's procedure will take quite awhile on most hard disks.

Photorec

Like any file recovery option, results aren't necessarily guaranteed and your mileage will vary. However, by taking the necessary precautions and extra care, your chances for full recovery increase. Using a boot CD for this process prevents unexpected disk writes while Windows is in operation on the main system drive. Photorec also seems to be more thorough with its scans than other apps like Recuva or even some commercial paid apps, at least in my experience.

Finally, even if you don't have any data that needs restored, it would be an excellent idea to download the ISO for The Ultimate Boot CD, burn it to disc, and then stash it in a safe place for future use. That way, when bad things happen, you'll be ready.

Also read:

About

An avid technology writer and an IT guru, Matthew is here to help bring the best in software, hardware and the web to the collective consciousness of TechRepublic's readership. In addition to writing for TechRepublic, Matthew currently works as a Cus...

11 comments
rrabiii
rrabiii

i recovered my 500GB HDD.  but now the recovered data is completely mess, i want to separate photos from that data, doing it manually is taking hell of a time, is there any application which can do that, any help would be greatly appreciated..

jpgeek5704
jpgeek5704

Nice timing on your article. I'm running this program now against 17 TB Drobo RAID device. I got complacent thinking the Drobo was protecting me against crashes, but not corruptions. Anyway, I'm two days into the recovery, will take a week, and the files getting recovered are being placed into directorates named recup_dir.. Many of the files are named f.ext (f438985864.iso) and they are not complete. Will photorec rebuild the complete files and filenames from this information?

HAL 9000
HAL 9000

I also say Never write anything to the drive you are attempting to recover from. Always save any recovered files to another HDD or media depending on what it is you are attempting at the time. Col

BALTHOR
BALTHOR

Boy I'd sure like to know this one.I would think that this software is installed first.It makes copies of everything that you do!If you need the file back it has it stored someplace.

Matt Nawrocki
Matt Nawrocki

The author of PhotoRec also offers a tool called TestDisk as well. It works in a similar way except it is designed for more all-purpose file recovery on damaged partitions. I just wanted to quickly mention TestDisk for those that want to try a different approach. Even so, Photorec still manages to recover file types that I consider some of the more important kinds anyway, such as image files, Word documents and zip files, just to name a few. TestDisk is also included on the Ultimate Boot CD as well for those who want to give it a look over.

Mark W. Kaelin
Mark W. Kaelin

Recovering lost data is, unfortunately, a reality just about every IT Pro has to deal with from time to time. What are your tools of choice for data recovery? Have you used Phototec? How did it work? Do you have a different tool to recommend?

pgit
pgit

What's worse, if the issue is a corrupted file system, photorec will find fragments of files (deleted or not) and make a separate image (or what have you) for each fragment, building it by following pointers fore and aft. If a gif or jpeg is stored in 122 different non contiguous fragments, you will get 122 copies of the same file. They will all have cryptic names, except maybe one or two. Also, the size and quality will vary, and any thumbnails will also be 'recovered,' so looking through the results to find what you really want is going to take 10 times longer, at least, than the photorec process will take in the first place. I just recovered a corrupt, unmountable windows drive, I tried deleting unrecoverable and duplicate files, but after 3 days of going through the list finally just gave the client 3 DVDs with incomprehensibly named image files and told them to browse them and find what they wanted. There was less 'overlap' with Office files, and most of them recovered (at least one copy) with the original name intact. Most of the 'overkill' was image files. Photorec is a tremendous asset, my gratitude to the authors. In the event the issue is an unmountable drive, the data needed must be valuable enough to warrant the time to recover it. As long as inode tables or whatever drive mapping is intact it's a whole 'nother story. You'll get your files swiftly and the naming should be ok.

Matt Nawrocki
Matt Nawrocki

I heartily agree with you HAL 9000. I do mention later in the article that it is definitely recommended to stash your data on another partition when you select the directory to dump recovered files to. But yes, adding that as another rule in and of itself would probably run that point home.

Matt Nawrocki
Matt Nawrocki

Mac OS X offers Time Machine which does exactly as you describe. If only there was a tool just as nice for Windows though...

jpgeek5704
jpgeek5704

I played with TestDrive before using PhotoRec but could not figure out a way to fix the corrupt NTFS partition. Can you give more guidance on how I could use the tool to fix the partition?

James.robert
James.robert

Yes ! I do have Unistal designed Edb to Pst converter Software to recover the lost or deleted data items from MS Exchange configured Laptops or Computer. Just try it