PhotoRec is a

free and open-source Free and open-source software (FOSS) is a term used to refer to groups of software consisting of both free software and open-source software where anyone is freely licensed to use, copy, study, and change the software in any way, and the source ...

utility software Utility software is software designed to help analyze, configure, optimize or maintain a computer. It is used to support the computer infrastructure - in contrast to application software, which is aimed at directly performing tasks that benefit ord ...

for

data recovery In computing, data recovery is a process of retrieving deleted, inaccessible, lost, corrupted, damaged, or formatted data from secondary storage, removable media or files, when the data stored in them cannot be accessed in a usual way. The da ...

with

text-based user interface In computing, text-based user interfaces (TUI) (alternately terminal user interfaces, to reflect a dependence upon the properties of computer terminals and not just text), is a retronym describing a type of user interface (UI) common as an ear ...

using

data carving File carving is the process of reassembling computer files from fragments in the absence of filesystem metadata. Introduction and basic principles All filesystems contain some metadata that describes the actual file system. At a minimum, this inc ...

techniques, designed to recover lost files from various digital camera memory,

hard disk A hard disk drive (HDD), hard disk, hard drive, or fixed disk is an electro-mechanical data storage device that stores and retrieves digital data using magnetic storage with one or more rigid rapidly rotating platters coated with magnet ...

and

CD-ROM A CD-ROM (, compact disc read-only memory) is a type of read-only memory consisting of a pre-pressed optical compact disc that contains data. Computers can read—but not write or erase—CD-ROMs. Some CDs, called enhanced CDs, hold both comput ...

. It can recover the files with more than 480 file extensions (about 300 file families). It is also possible to add custom

file signature {{short description, Data used to identify or verify the content of a file In computing, a file signature is data used to identify or verify the contents of a file. In particular, it may refer to: * File magic number: bytes within a file used to ...

to detect less known files. PhotoRec does not attempt to write to the damaged media the user is about to recover from. Recovered files are instead written to the directory from which PhotoRec is run, any other directory may be chosen. It can be used for

or in a

digital forensics Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery, investigation, examination and analysis of material found in digital devices, often in relation to mobile devices and co ...

context. NIST Test Results for Graphic File Carving Tool: PhotoRec v7.0-WIP
NIST Test Results for Video File Carving Tool: PhotoRec v7.0-WIP
. PhotoRec is shipped with

TestDisk TestDisk is a free and open-source data recovery utility that helps users recover lost partitions or repair corrupted filesystems. TestDisk can collect detailed information about a corrupted drive, which can then be sent to a technician for further ...

Functionality

FAT In nutrition science, nutrition, biology, and chemistry, fat usually means any ester of fatty acids, or a mixture of such chemical compound, compounds, most commonly those that occur in living beings or in food. The term often refers spec ...

NTFS New Technology File System (NTFS) is a proprietary journaling file system developed by Microsoft. Starting with Windows NT 3.1, it is the default file system of the Windows NT family. It superseded File Allocation Table (FAT) as the preferred fil ...

ext2 The ext2 or second extended file system is a file system for the Linux kernel. It was initially designed by French software developer Rémy Card as a replacement for the extended file system (ext). Having been designed according to the same pr ...

ext3 ext3, or third extended filesystem, is a journaled file system that is commonly used by the Linux kernel. It used to be the default file system for many popular Linux distributions. Stephen Tweedie first revealed that he was working on extend ...

ext4 ext4 (fourth extended filesystem) is a journaling file system for Linux, developed as the successor to ext3. ext4 was initially a series of backward-compatible extensions to ext3, many of them originally developed by Cluster File Systems for ...

file system In computing, file system or filesystem (often abbreviated to fs) is a method and data structure that the operating system uses to control how data is stored and retrieved. Without a file system, data placed in a storage medium would be one larg ...

s store files in data blocks (also called

data cluster In computer disk storage, a sector is a subdivision of a track on a magnetic disk or optical disc. Each sector stores a fixed amount of user-accessible data, traditionally 512 bytes for hard disk drives (HDDs) and 2048 bytes for CD-ROMs and DV ...

s under Windows). The cluster or block size remains at a constant number of sectors after being initialized during the formatting of the filesystem. In general, most operating systems try to store the data in a contiguous way so as to minimize data fragmentation. The seek time of mechanical drives is significant for writing and reading data to/from a hard disk, so that is why it is important to keep the fragmentation to a minimum level. When a file is deleted, the meta-information about this file (filename, date/time, size, location of the first data block/cluster, etc.) is lost; e.g., in an ext3/ext4 filesystem, the names of deleted files are still present, but the location of the first data block is removed. This means the data is still present on the filesystem, but only until some or all of it is overwritten by new file data. To recover these "lost" files, PhotoRec first tries to find the data block (or cluster) size. If the filesystem is not corrupted, this value can be read from the superblock (ext2/ext3/ext4) or volume boot record (FAT, NTFS). Otherwise, PhotoRec reads the media, sector by sector, searching for the first ten files, from which it calculates the block/cluster size from their locations. Once this block size is known, PhotoRec reads the media block by block (or cluster by cluster). Each block is checked against a signature database; which comes with the program and has been growing in the type of files it can recover ever since PhotoRec's first version came out. It is a common data recovery method called

file carving File carving is the process of reassembling computer files from fragments in the absence of filesystem metadata. Introduction and basic principles All filesystems contain some metadata that describes the actual file system. At a minimum, this in ...

. For example, PhotoRec identifies a

JPEG JPEG ( ) is a commonly used method of lossy compression for digital images, particularly for those images produced by digital photography. The degree of compression can be adjusted, allowing a selectable tradeoff between storage size and imag ...

file when a block begins with: * Start Of Image + APP0: 0xff, 0xd8, 0xff, 0xe0 * Start Of Image + APP1: 0xff, 0xd8, 0xff, 0xe1 * or Start Of Image + Comment: 0xff, 0xd8, 0xff, 0xfe If PhotoRec has already started to recover a file, it stops its recovery, checks the consistency of the file when possible and starts to save the new file (which it determined from the signature it found). If the data is not fragmented, the recovered file should be identical to (or possibly larger than) the original file in size. In some cases, PhotoRec can learn the original file size from the file header, so the recovered file is truncated to the correct size. If, however, the recovered file ends up being smaller than its header specifies, it is discarded. Some files, such as *.MP3 types, are data streams. In this case, PhotoRec parses the recovered data, then stops the recovery when the stream ends. When a file is recovered successfully, PhotoRec checks the previous data blocks to see whether a file signature was found but the file was not able to be successfully recovered (i.e., the file was too small), and it tries again. This way, some fragmented files can be successfully recovered.How PhotoRec works
(Description from the author website).

Compatibility

PhotoRec is compatible with: *

DOS DOS is shorthand for the MS-DOS and IBM PC DOS family of operating systems. DOS may also refer to: Computing * Data over signalling (DoS), multiplexing data onto a signalling channel * Denial-of-service attack (DoS), an attack on a communicatio ...

(either real or in a Windows 9x DOS box) *

Microsoft Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...

: NT4,

2000 File:2000 Events Collage.png, From left, clockwise: Protests against Bush v. Gore after the 2000 United States presidential election; Heads of state meet for the Millennium Summit; The International Space Station in its infant form as seen from ...

, XP,

2003 File:2003 Events Collage.png, From top left, clockwise: The crew of STS-107 perished when the Space Shuttle Columbia disintegrated during reentry into Earth's atmosphere; SARS became an epidemic in China, and was a precursor to SARS-CoV-2; A des ...

2008 File:2008 Events Collage.png, From left, clockwise: Lehman Brothers went bankrupt following the Subprime mortgage crisis; Cyclone Nargis killed more than 138,000 in Myanmar; A scene from the opening ceremony of the 2008 Summer Olympics in Beijing; ...

2016 File:2016 Events Collage.png, From top left, clockwise: Bombed-out buildings in Ankara following the 2016 Turkish coup d'état attempt; the impeachment trial of Brazilian President Dilma Rousseff; Damaged houses during the 2016 Nagorno-Karabakh ...

Vista Vista usually refers to a distant view. Vista may also refer to: Software *Windows Vista, the line of Microsoft Windows client operating systems released in 2006 and 2007 *VistA, (Veterans Health Information Systems and Technology Architecture) ...

Windows 7 Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009. It is the successor to Windows Vista, released nearly ...

Windows 8 Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on August 1, 2012; it was subsequently made available for downl ...

Windows 8.1 Windows 8.1 is a release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on August 27, 2013, and broadly released for retail sale on October 17, 2013, about a year after the retail release of its pre ...

Windows 10 Windows 10 is a major release of Microsoft's Windows NT operating system. It is the direct successor to Windows 8.1, which was released nearly two years earlier. It was released to manufacturing on July 15, 2015, and later to retail on J ...

Windows 11 Windows 11 is the latest major release of Microsoft's Windows NT operating system, released in October 2021. It is a free upgrade to its predecessor, Windows 10 (2015), and is available for any Windows 10 devices that meet the new Windows 11 ...

Linux Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...

FreeBSD FreeBSD is a free and open-source Unix-like operating system descended from the Berkeley Software Distribution (BSD), which was based on Research Unix. The first version of FreeBSD was released in 1993. In 2005, FreeBSD was the most popular ...

NetBSD NetBSD is a free and open-source Unix operating system based on the Berkeley Software Distribution (BSD). It was the first open-source BSD descendant officially released after 386BSD was forked. It continues to be actively developed and is a ...

OpenBSD OpenBSD is a security-focused, free and open-source, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. According to the website, the OpenBSD project em ...

SunOS SunOS is a Unix-branded operating system developed by Sun Microsystems for their workstation and server computer systems. The ''SunOS'' name is usually only used to refer to versions 1.0 to 4.1.4, which were based on BSD, while versions 5.0 and l ...

macOS macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac computers. Within the market of desktop and lapt ...

ARM In human anatomy, the arm refers to the upper limb in common usage, although academically the term specifically means the upper arm between the glenohumeral joint (shoulder joint) and the elbow joint. The distal part of the upper limb between the ...

Distribution

PhotoRec and

are shipped together. They can be downloaded fro
CGSecurity
website. These utilities can be found on various

Live CD A live CD (also live DVD, live disc, or live operating system) is a complete bootable computer installation including operating system which runs directly from a CD-ROM or similar storage device into a computer's memory, rather than loading fro ...

s: *

GParted GParted (acronym of GNOME Partition Editor) is a GTK front-end to GNU Parted and an official GNOME partition-editing application (alongside Disks). GParted is used for creating, deleting, resizing, moving, checking, and copying disk partitions ...

Live CD *

Parted Magic Parted Magic is a commercial Linux distribution based on Slackware that comes with disk partitioning and data recovery tools. It is sold as a Linux-based bootable disk. The distribution's nomenclature is derived from the names of the GNU Parted ...

* Slax-LFI, a

Slax Slax is a LiveCD Linux distribution developed by Tomáš Matějíček and based on upstream customizable Linux distributions. Packages can be added by apt package manager or can be prepared as modules. The tagline for Slax refers to itself as " ...

-derived distribution *

SystemRescueCD SystemRescue (Previously known as "SystemRescueCD") is a Linux distribution for x86 64 and x86 computers. The primary purpose of SystemRescue is to repair unbootable or otherwise damaged computer systems after a system crash. SystemRescue is ...

* Ubuntu Rescue Remix, an

Ubuntu Ubuntu ( ) is a Linux distribution based on Debian and composed mostly of free and open-source software. Ubuntu is officially released in three editions: ''Desktop'', ''Server'', and ''Core'' for Internet of things devices and robots. All the ...

derivation They are also packaged for numerous *nix (mostly

based) distributions: *

ALT Linux ALT Linux is a set of Russian operating systems based on RPM Package Manager (RPM) and built on a Linux kernel and Sisyphus package repository. ALT Linux has been developed collectively by ALT Linux Team developers community and ALT Linux Ltd. ...

Arch Linux Arch Linux () is an independently developed, x86-64 general-purpose Linux distribution that strives to provide the latest stable versions of most software by following a Rolling release, rolling-release model. The default installation is a minim ...

Extra RepositoryArchLinux Extra Repository
/ref> *

Debian Debian (), also known as Debian GNU/Linux, is a Linux distribution composed of free and open-source software, developed by the community-supported Debian Project, which was established by Ian Murdock on August 16, 1993. The first version of D ...

contribTestDisk on Debian
/ref> *

Fedora A fedora () is a hat with a soft brim and indented crown.Kilgour, Ruth Edwards (1958). ''A Pageant of Hats Ancient and Modern''. R. M. McBride Company. It is typically creased lengthwise down the crown and "pinched" near the front on both sides ...

ExtrasTestDisk in Fedora
*

Red Hat Red Hat, Inc. is an American software company that provides open source software products to enterprises. Founded in 1993, Red Hat has its corporate headquarters in Raleigh, North Carolina, with other offices worldwide. Red Hat has become ass ...

Epel *

portTestDisk in FreeBSD ports
/ref> *

portTestDisk in OpenBSD ports
/ref> * GentooTestDisk in Gentoo
/ref> and Gentoo PortageTestDisk in Gentoo Portage
*

Mandriva Mandriva S.A. was a public software company specializing in Linux and open-source software. Its corporate headquarters was in Paris, and it had development centers in Metz, France and Curitiba, Brazil. Mandriva, S.A. was the developer and mainta ...

contrib *

Source Mage Source Mage is a Linux distribution. As a package is being installed, its source code is automatically downloaded, compiled, and installed. Source Mage is descended from Sorcerer. Notable features Source Mage is, as its name suggests, a sourc ...

LinuxTestDisk in Source Mage
*

References

External links

* {{DEFAULTSORT:Photorec 1998 software Free data recovery software Portable software Hard disk software Free software programmed in C Software that uses ncurses Software using the GPL license

Functionality

Compatibility

Distribution

See also

References

External links